From: Sasha Levin Date: Sat, 6 May 2023 11:59:16 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v5.15.111~102 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d9f3e9a371bc00b76d5c9dcbb052c7d391bedd83;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch b/queue-5.15/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch new file mode 100644 index 00000000000..ba61977f85b --- /dev/null +++ b/queue-5.15/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch @@ -0,0 +1,146 @@ +From ac3484e681fa7e230fff77e43070f64aa7a98548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 12:13:29 +0100 +Subject: ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit 073828e954459b883f23e53999d31e4c55ab9654 ] + +In ACPI systems, the OS can direct power management, as opposed to the +firmware. This OS-directed Power Management is called OSPM. Part of +telling the firmware that the OS going to direct power management is +making ACPI "_PDC" (Processor Driver Capabilities) calls. These _PDC +methods must be evaluated for every processor object. If these _PDC +calls are not completed for every processor it can lead to +inconsistency and later failures in things like the CPU frequency +driver. + +In a Xen system, the dom0 kernel is responsible for system-wide power +management. The dom0 kernel is in charge of OSPM. However, the +number of CPUs available to dom0 can be different than the number of +CPUs physically present on the system. + +This leads to a problem: the dom0 kernel needs to evaluate _PDC for +all the processors, but it can't always see them. + +In dom0 kernels, ignore the existing ACPI method for determining if a +processor is physically present because it might not be accurate. +Instead, ask the hypervisor for this information. + +Fix this by introducing a custom function to use when running as Xen +dom0 in order to check whether a processor object matches a CPU that's +online. Such checking is done using the existing information fetched +by the Xen pCPU subsystem, extending it to also store the ACPI ID. + +This ensures that _PDC method gets evaluated for all physically online +CPUs, regardless of the number of CPUs made available to dom0. + +Fixes: 5d554a7bb064 ("ACPI: processor: add internal processor_physically_present()") +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_pdc.c | 11 +++++++++++ + drivers/xen/pcpu.c | 20 ++++++++++++++++++++ + include/xen/xen.h | 11 +++++++++++ + 3 files changed, 42 insertions(+) + +diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c +index 8c3f82c9fff35..18fb04523f93b 100644 +--- a/drivers/acpi/processor_pdc.c ++++ b/drivers/acpi/processor_pdc.c +@@ -14,6 +14,8 @@ + #include + #include + ++#include ++ + #include "internal.h" + + static bool __init processor_physically_present(acpi_handle handle) +@@ -47,6 +49,15 @@ static bool __init processor_physically_present(acpi_handle handle) + return false; + } + ++ if (xen_initial_domain()) ++ /* ++ * When running as a Xen dom0 the number of processors Linux ++ * sees can be different from the real number of processors on ++ * the system, and we still need to execute _PDC for all of ++ * them. ++ */ ++ return xen_processor_present(acpi_id); ++ + type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0; + cpuid = acpi_get_cpuid(handle, type, acpi_id); + +diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c +index fd3a644b08559..b3e3d1bb37f3e 100644 +--- a/drivers/xen/pcpu.c ++++ b/drivers/xen/pcpu.c +@@ -58,6 +58,7 @@ struct pcpu { + struct list_head list; + struct device dev; + uint32_t cpu_id; ++ uint32_t acpi_id; + uint32_t flags; + }; + +@@ -249,6 +250,7 @@ static struct pcpu *create_and_register_pcpu(struct xenpf_pcpuinfo *info) + + INIT_LIST_HEAD(&pcpu->list); + pcpu->cpu_id = info->xen_cpuid; ++ pcpu->acpi_id = info->acpi_id; + pcpu->flags = info->flags; + + /* Need hold on xen_pcpu_lock before pcpu list manipulations */ +@@ -381,3 +383,21 @@ static int __init xen_pcpu_init(void) + return ret; + } + arch_initcall(xen_pcpu_init); ++ ++#ifdef CONFIG_ACPI ++bool __init xen_processor_present(uint32_t acpi_id) ++{ ++ const struct pcpu *pcpu; ++ bool online = false; ++ ++ mutex_lock(&xen_pcpu_lock); ++ list_for_each_entry(pcpu, &xen_pcpus, list) ++ if (pcpu->acpi_id == acpi_id) { ++ online = pcpu->flags & XEN_PCPU_FLAGS_ONLINE; ++ break; ++ } ++ mutex_unlock(&xen_pcpu_lock); ++ ++ return online; ++} ++#endif +diff --git a/include/xen/xen.h b/include/xen/xen.h +index 43efba045acc7..5a6a2ab675bed 100644 +--- a/include/xen/xen.h ++++ b/include/xen/xen.h +@@ -61,4 +61,15 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages); + #include + #endif + ++#if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI) && defined(CONFIG_X86) ++bool __init xen_processor_present(uint32_t acpi_id); ++#else ++#include ++static inline bool xen_processor_present(uint32_t acpi_id) ++{ ++ BUG(); ++ return false; ++} ++#endif ++ + #endif /* _XEN_XEN_H */ +-- +2.39.2 + diff --git a/queue-5.15/acpi-viot-initialize-the-correct-iommu-fwspec.patch b/queue-5.15/acpi-viot-initialize-the-correct-iommu-fwspec.patch new file mode 100644 index 00000000000..c53b3a806ba --- /dev/null +++ b/queue-5.15/acpi-viot-initialize-the-correct-iommu-fwspec.patch @@ -0,0 +1,61 @@ +From 6abfe52e493c34316f447daa6df224b2b2646d37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 18:05:29 +0000 +Subject: ACPI: VIOT: Initialize the correct IOMMU fwspec + +From: Jean-Philippe Brucker + +[ Upstream commit 47d26684185d09e083669bbbd0c465ab3493a51f ] + +When setting up DMA for a PCI device, we need to initialize its +iommu_fwspec with all possible alias RIDs (such as PCI bridges). To do +this we use pci_for_each_dma_alias() which calls +viot_pci_dev_iommu_init(). This function incorrectly initializes the +fwspec of the bridge instead of the device being configured. Fix it by +passing the original device as context to pci_for_each_dma_alias(). + +Fixes: 3cf485540e7b ("ACPI: Add driver for the VIOT table") +Link: https://lore.kernel.org/all/Y8qzOKm6kvhGWG1T@myrica +Reported-by: Eric Auger +Signed-off-by: Jean-Philippe Brucker +Reviewed-by: Eric Auger +Tested-by: Eric Auger +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/viot.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/viot.c b/drivers/acpi/viot.c +index 647f11cf165d7..fe4b66dae01b5 100644 +--- a/drivers/acpi/viot.c ++++ b/drivers/acpi/viot.c +@@ -329,6 +329,7 @@ static int viot_pci_dev_iommu_init(struct pci_dev *pdev, u16 dev_id, void *data) + { + u32 epid; + struct viot_endpoint *ep; ++ struct device *aliased_dev = data; + u32 domain_nr = pci_domain_nr(pdev->bus); + + list_for_each_entry(ep, &viot_pci_ranges, list) { +@@ -339,7 +340,7 @@ static int viot_pci_dev_iommu_init(struct pci_dev *pdev, u16 dev_id, void *data) + epid = ((domain_nr - ep->segment_start) << 16) + + dev_id - ep->bdf_start + ep->endpoint_id; + +- return viot_dev_iommu_init(&pdev->dev, ep->viommu, ++ return viot_dev_iommu_init(aliased_dev, ep->viommu, + epid); + } + } +@@ -373,7 +374,7 @@ int viot_iommu_configure(struct device *dev) + { + if (dev_is_pci(dev)) + return pci_for_each_dma_alias(to_pci_dev(dev), +- viot_pci_dev_iommu_init, NULL); ++ viot_pci_dev_iommu_init, dev); + else if (dev_is_platform(dev)) + return viot_mmio_dev_iommu_init(to_platform_device(dev)); + return -ENODEV; +-- +2.39.2 + diff --git a/queue-5.15/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch b/queue-5.15/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch new file mode 100644 index 00000000000..9869ba45f09 --- /dev/null +++ b/queue-5.15/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch @@ -0,0 +1,40 @@ +From be84dacaf17399bcfe6ce3a3eaa649e31cfb1872 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 10:07:01 -0400 +Subject: afs: Fix updating of i_size with dv jump from server + +From: Marc Dionne + +[ Upstream commit d7f74e9a917503ee78f2b603a456d7227cf38919 ] + +If the data version returned from the server is larger than expected, +the local data is invalidated, but we may still want to note the remote +file size. + +Since we're setting change_size, we have to also set data_changed +for the i_size to get updated. + +Fixes: 3f4aa9818163 ("afs: Fix EOF corruption") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 785bacb972da5..91b1f8cabd58f 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -219,6 +219,7 @@ static void afs_apply_status(struct afs_operation *op, + set_bit(AFS_VNODE_ZAP_DATA, &vnode->flags); + } + change_size = true; ++ data_changed = true; + } else if (vnode->status.type == AFS_FTYPE_DIR) { + /* Expected directory change is handled elsewhere so + * that we can locally edit the directory and save on a +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-gta04-fix-excess-dma-channel-usage.patch b/queue-5.15/arm-dts-gta04-fix-excess-dma-channel-usage.patch new file mode 100644 index 00000000000..b2b59b55cd3 --- /dev/null +++ b/queue-5.15/arm-dts-gta04-fix-excess-dma-channel-usage.patch @@ -0,0 +1,73 @@ +From 1018dcced89e8310b2eafd4d589612c4ed64c95f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 22:11:51 +0100 +Subject: ARM: dts: gta04: fix excess dma channel usage + +From: H. Nikolaus Schaller + +[ Upstream commit a622310f7f0185da02e42cdb06475f533efaae60 ] + +OMAP processors support 32 channels but there is no check or +inspect this except booting a device and looking at dmesg reports +of not available channels. + +Recently some more subsystems with DMA (aes1+2) were added filling +the list of dma channels beyond the limit of 32 (even if other +parameters indicate 96 or 128 channels). This leads to random +subsystem failures i(e.g. mcbsp for audio) after boot or boot +messages that DMA can not be initialized. + +Another symptom is that + +/sys/kernel/debug/dmaengine/summary + +has 32 entries and does not show all required channels. + +Fix by disabling unused (on the GTA04 hardware) mcspi1...4. +Each SPI channel allocates 4 DMA channels rapidly filling +the available ones. + +Disabling unused SPI modules on the OMAP3 SoC may also save +some energy (has not been checked). + +Fixes: c312f066314e ("ARM: dts: omap3: Migrate AES from hwmods to sysc-omap2") +Signed-off-by: H. Nikolaus Schaller +[re-enabled aes2, improved commit subject line] +Signed-off-by: Andreas Kemnade +Message-Id: <20230113211151.2314874-1-andreas@kemnade.info> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 3923b38e798d0..bb5e00b36d8dc 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -609,6 +609,22 @@ + clock-frequency = <100000>; + }; + ++&mcspi1 { ++ status = "disabled"; ++}; ++ ++&mcspi2 { ++ status = "disabled"; ++}; ++ ++&mcspi3 { ++ status = "disabled"; ++}; ++ ++&mcspi4 { ++ status = "disabled"; ++}; ++ + &usb_otg_hs { + interface-type = <0>; + usb-phy = <&usb2_phy>; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..2c324dacc2c --- /dev/null +++ b/queue-5.15/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,45 @@ +From ce916f29058c69f98684f249b5c8338011417653 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:51 +0530 +Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 08bc5f46649dd..9dcf308b3ad49 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -424,8 +424,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>, +- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>; ++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>, ++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..693665fe616 --- /dev/null +++ b/queue-5.15/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,68 @@ +From 503eb4e03eed1195018ca2b95785de92422beab4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:52 +0530 +Subject: ARM: dts: qcom: ipq8064: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 0b16b34e491629016109e56747ad64588074194b ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses +(0x0fe00000, 0x31e00000, 0x35e00000) specified in the ranges property for +I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 93241840b664 ("ARM: dts: qcom: Add pcie nodes for ipq8064") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-17-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq8064.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi +index 8ec927f044c38..f4139411c41ed 100644 +--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi +@@ -808,8 +808,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x0fe00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x08000000 0x08000000 0x0 0x07e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -859,8 +859,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x31e00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x2e000000 0x2e000000 0x0 0x03e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -910,8 +910,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x35e00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x32000000 0x32000000 0x0 0x03e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch b/queue-5.15/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch new file mode 100644 index 00000000000..e070e090af5 --- /dev/null +++ b/queue-5.15/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch @@ -0,0 +1,62 @@ +From 80e1352ccf733abdc2c62b3cff10b0287f9019f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 03:09:40 +0200 +Subject: ARM: dts: qcom: ipq8064: reduce pci IO size to 64K + +From: Christian Marangi + +[ Upstream commit 8fafb7e5c041814876266259e5e439f93571dcef ] + +The current value for pci IO is problematic for ath10k wifi card +commonly connected to ipq8064 SoC. +The current value is probably a typo and is actually uncommon to find +1MB IO space even on a x86 arch. Also with recent changes to the pci +driver, pci1 and pci2 now fails to function as any connected device +fails any reg read/write. Reduce this to 64K as it should be more than +enough and 3 * 64K of total IO space doesn't exceed the IO_SPACE_LIMIT +hardcoded for the ARM arch. + +Signed-off-by: Christian Marangi +Tested-by: Jonathan McDowell +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220707010943.20857-7-ansuelsmth@gmail.com +Stable-dep-of: 0b16b34e4916 ("ARM: dts: qcom: ipq8064: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq8064.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi +index 4139d3817bd6f..8ec927f044c38 100644 +--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi +@@ -808,7 +808,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00100000 /* downstream I/O */ ++ ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */ + 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */ + + interrupts = ; +@@ -859,7 +859,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00100000 /* downstream I/O */ ++ ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */ + 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */ + + interrupts = ; +@@ -910,7 +910,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00100000 /* downstream I/O */ ++ ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */ + 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */ + + interrupts = ; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-add-base-dts-file-for-bcmbca-device-asus-g.patch b/queue-5.15/arm64-dts-add-base-dts-file-for-bcmbca-device-asus-g.patch new file mode 100644 index 00000000000..ff6d09b0b5b --- /dev/null +++ b/queue-5.15/arm64-dts-add-base-dts-file-for-bcmbca-device-asus-g.patch @@ -0,0 +1,66 @@ +From fa6d97caae7cb1d25fe249f8600520fff46a4939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 22:03:51 +0200 +Subject: arm64: dts: Add base DTS file for bcmbca device Asus GT-AX6000 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit f3f575c4bef95384e68de552c7b29938fd0d9201 ] + +It's a home router with 1 GiB of RAM, 6 Ethernet ports, 2 USB ports. + +Signed-off-by: Rafał Miłecki +Acked-by: William Zhang +Link: https://lore.kernel.org/r/20220713200351.28526-2-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Stable-dep-of: 5cca02449490 ("arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/Makefile | 4 +++- + .../bcmbca/bcm4912-asus-gt-ax6000.dts | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm4912-asus-gt-ax6000.dts + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +index 4161d557b1329..fd60418478696 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +@@ -1,4 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 +-dtb-$(CONFIG_ARCH_BCMBCA) += bcm94912.dtb \ ++dtb-$(CONFIG_ARCH_BCMBCA) += \ ++ bcm4912-asus-gt-ax6000.dtb \ ++ bcm94912.dtb \ + bcm963158.dtb \ + bcm96858.dtb +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912-asus-gt-ax6000.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912-asus-gt-ax6000.dts +new file mode 100644 +index 0000000000000..ed554666e95ea +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912-asus-gt-ax6000.dts +@@ -0,0 +1,19 @@ ++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT ++ ++/dts-v1/; ++ ++#include "bcm4912.dtsi" ++ ++/ { ++ compatible = "asus,gt-ax6000", "brcm,bcm4912", "brcm,bcmbca"; ++ model = "Asus GT-AX6000"; ++ ++ memory@0 { ++ device_type = "memory"; ++ reg = <0x00 0x00 0x00 0x40000000>; ++ }; ++}; ++ ++&uart0 { ++ status = "okay"; ++}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm4912.patch b/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm4912.patch new file mode 100644 index 00000000000..fd43352ab3d --- /dev/null +++ b/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm4912.patch @@ -0,0 +1,208 @@ +From 71f6f119231939914f20b937ade184fb02e4ae7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 13:17:34 -0700 +Subject: arm64: dts: Add DTS files for bcmbca SoC BCM4912 + +From: William Zhang + +[ Upstream commit 1ba56aeb391401c4cb2126c39f90b3cdbfabdb3f ] + +Add DTS for ARMv8 based broadband SoC BCM4912. bcm4912.dtsi is the +SoC description DTS header and bcm94912.dts is a simple DTS file for +Broadcom BCM94912 Reference board that only enable the UART port. + +Signed-off-by: William Zhang +Acked-by: Krzysztof Kozlowski +Signed-off-by: Florian Fainelli +Stable-dep-of: 5cca02449490 ("arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/Makefile | 3 +- + .../boot/dts/broadcom/bcmbca/bcm4912.dtsi | 128 ++++++++++++++++++ + .../boot/dts/broadcom/bcmbca/bcm94912.dts | 30 ++++ + 3 files changed, 160 insertions(+), 1 deletion(-) + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm94912.dts + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +index d5f89245336c4..b6e520e9f2f21 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +@@ -1,2 +1,3 @@ + # SPDX-License-Identifier: GPL-2.0 +-dtb-$(CONFIG_ARCH_BCMBCA) += bcm963158.dtb ++dtb-$(CONFIG_ARCH_BCMBCA) += bcm94912.dtb \ ++ bcm963158.dtb +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi +new file mode 100644 +index 0000000000000..3d016c2ce6759 +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4912.dtsi +@@ -0,0 +1,128 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright 2022 Broadcom Ltd. ++ */ ++ ++#include ++#include ++ ++/ { ++ compatible = "brcm,bcm4912", "brcm,bcmbca"; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ++ interrupt-parent = <&gic>; ++ ++ cpus { ++ #address-cells = <2>; ++ #size-cells = <0>; ++ ++ B53_0: cpu@0 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x0>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_1: cpu@1 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x1>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_2: cpu@2 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x2>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_3: cpu@3 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x3>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ L2_0: l2-cache0 { ++ compatible = "cache"; ++ }; ++ }; ++ ++ timer { ++ compatible = "arm,armv8-timer"; ++ interrupts = , ++ , ++ , ++ ; ++ }; ++ ++ pmu: pmu { ++ compatible = "arm,cortex-a53-pmu"; ++ interrupts = , ++ , ++ , ++ ; ++ interrupt-affinity = <&B53_0>, <&B53_1>, ++ <&B53_2>, <&B53_3>; ++ }; ++ ++ clocks: clocks { ++ periph_clk: periph-clk { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <200000000>; ++ }; ++ uart_clk: uart-clk { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&periph_clk>; ++ clock-div = <4>; ++ clock-mult = <1>; ++ }; ++ }; ++ ++ psci { ++ compatible = "arm,psci-0.2"; ++ method = "smc"; ++ }; ++ ++ axi@81000000 { ++ compatible = "simple-bus"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x0 0x81000000 0x8000>; ++ ++ gic: interrupt-controller@1000 { ++ compatible = "arm,gic-400"; ++ #interrupt-cells = <3>; ++ interrupt-controller; ++ interrupts = ; ++ reg = <0x1000 0x1000>, ++ <0x2000 0x2000>, ++ <0x4000 0x2000>, ++ <0x6000 0x2000>; ++ }; ++ }; ++ ++ bus@ff800000 { ++ compatible = "simple-bus"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x0 0xff800000 0x800000>; ++ ++ uart0: serial@12000 { ++ compatible = "arm,pl011", "arm,primecell"; ++ reg = <0x12000 0x1000>; ++ interrupts = ; ++ clocks = <&uart_clk>, <&uart_clk>; ++ clock-names = "uartclk", "apb_pclk"; ++ status = "disabled"; ++ }; ++ }; ++}; +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm94912.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm94912.dts +new file mode 100644 +index 0000000000000..a3623e6f6919c +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm94912.dts +@@ -0,0 +1,30 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright 2022 Broadcom Ltd. ++ */ ++ ++/dts-v1/; ++ ++#include "bcm4912.dtsi" ++ ++/ { ++ model = "Broadcom BCM94912 Reference Board"; ++ compatible = "brcm,bcm94912", "brcm,bcm4912", "brcm,bcmbca"; ++ ++ aliases { ++ serial0 = &uart0; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; ++ }; ++ ++ memory@0 { ++ device_type = "memory"; ++ reg = <0x0 0x0 0x0 0x08000000>; ++ }; ++}; ++ ++&uart0 { ++ status = "okay"; ++}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm63158.patch b/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm63158.patch new file mode 100644 index 00000000000..92227f373ad --- /dev/null +++ b/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm63158.patch @@ -0,0 +1,219 @@ +From 8f6a54b46678c1abdb984be1959aae9f93e8b8d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 15:56:51 -0700 +Subject: arm64: dts: Add DTS files for bcmbca SoC BCM63158 + +From: William Zhang + +[ Upstream commit 076dcedc6628c6bf92bd17bfcf8fb7b1af62bfb6 ] + +Add DTS for ARMv8 based broadband SoC BCM63158. bcm63158.dtsi is the +SoC description DTS header and bcm963158.dts is a simple DTS file for +Broadcom BCM963158 Reference board that only enable the UART port. + +Signed-off-by: William Zhang +Signed-off-by: Florian Fainelli +Stable-dep-of: 5cca02449490 ("arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/Makefile | 1 + + arch/arm64/boot/dts/broadcom/bcmbca/Makefile | 2 + + .../boot/dts/broadcom/bcmbca/bcm63158.dtsi | 128 ++++++++++++++++++ + .../boot/dts/broadcom/bcmbca/bcm963158.dts | 30 ++++ + 4 files changed, 161 insertions(+) + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/Makefile + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm963158.dts + +diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile +index 11eae3e3a9447..9a0ea4b97ef23 100644 +--- a/arch/arm64/boot/dts/broadcom/Makefile ++++ b/arch/arm64/boot/dts/broadcom/Makefile +@@ -7,5 +7,6 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-400.dtb \ + bcm2837-rpi-cm3-io3.dtb + + subdir-y += bcm4908 ++subdir-y += bcmbca + subdir-y += northstar2 + subdir-y += stingray +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +new file mode 100644 +index 0000000000000..d5f89245336c4 +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +@@ -0,0 +1,2 @@ ++# SPDX-License-Identifier: GPL-2.0 ++dtb-$(CONFIG_ARCH_BCMBCA) += bcm963158.dtb +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi +new file mode 100644 +index 0000000000000..13629702f70b8 +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm63158.dtsi +@@ -0,0 +1,128 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright 2022 Broadcom Ltd. ++ */ ++ ++#include ++#include ++ ++/ { ++ compatible = "brcm,bcm63158", "brcm,bcmbca"; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ++ interrupt-parent = <&gic>; ++ ++ cpus { ++ #address-cells = <2>; ++ #size-cells = <0>; ++ ++ B53_0: cpu@0 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x0>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_1: cpu@1 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x1>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_2: cpu@2 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x2>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_3: cpu@3 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x3>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ L2_0: l2-cache0 { ++ compatible = "cache"; ++ }; ++ }; ++ ++ timer { ++ compatible = "arm,armv8-timer"; ++ interrupts = , ++ , ++ , ++ ; ++ }; ++ ++ pmu: pmu { ++ compatible = "arm,cortex-a53-pmu"; ++ interrupts = , ++ , ++ , ++ ; ++ interrupt-affinity = <&B53_0>, <&B53_1>, ++ <&B53_2>, <&B53_3>; ++ }; ++ ++ clocks: clocks { ++ periph_clk: periph-clk { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <200000000>; ++ }; ++ uart_clk: uart-clk { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&periph_clk>; ++ clock-div = <4>; ++ clock-mult = <1>; ++ }; ++ }; ++ ++ psci { ++ compatible = "arm,psci-0.2"; ++ method = "smc"; ++ }; ++ ++ axi@81000000 { ++ compatible = "simple-bus"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x0 0x81000000 0x8000>; ++ ++ gic: interrupt-controller@1000 { ++ compatible = "arm,gic-400"; ++ #interrupt-cells = <3>; ++ interrupt-controller; ++ interrupts = ; ++ reg = <0x1000 0x1000>, ++ <0x2000 0x2000>, ++ <0x4000 0x2000>, ++ <0x6000 0x2000>; ++ }; ++ }; ++ ++ bus@ff800000 { ++ compatible = "simple-bus"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x0 0xff800000 0x800000>; ++ ++ uart0: serial@12000 { ++ compatible = "arm,pl011", "arm,primecell"; ++ reg = <0x12000 0x1000>; ++ interrupts = ; ++ clocks = <&uart_clk>, <&uart_clk>; ++ clock-names = "uartclk", "apb_pclk"; ++ status = "disabled"; ++ }; ++ }; ++}; +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm963158.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm963158.dts +new file mode 100644 +index 0000000000000..eba07e0b1ca6f +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm963158.dts +@@ -0,0 +1,30 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright 2022 Broadcom Ltd. ++ */ ++ ++/dts-v1/; ++ ++#include "bcm63158.dtsi" ++ ++/ { ++ model = "Broadcom BCM963158 Reference Board"; ++ compatible = "brcm,bcm963158", "brcm,bcm63158", "brcm,bcmbca"; ++ ++ aliases { ++ serial0 = &uart0; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; ++ }; ++ ++ memory@0 { ++ device_type = "memory"; ++ reg = <0x0 0x0 0x0 0x08000000>; ++ }; ++}; ++ ++&uart0 { ++ status = "okay"; ++}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm6858.patch b/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm6858.patch new file mode 100644 index 00000000000..15f501cbca3 --- /dev/null +++ b/queue-5.15/arm64-dts-add-dts-files-for-bcmbca-soc-bcm6858.patch @@ -0,0 +1,201 @@ +From 651af879f56ad7c9b4410d8b014f54adc5bc27b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 13:19:56 -0700 +Subject: ARM64: dts: Add DTS files for bcmbca SoC BCM6858 + +From: Anand Gore + +[ Upstream commit e663e06bd3f21e64bc2163910f626af68add6308 ] + +Add DTS for ARMv8 based broadband SoC BCM6858. bcm6858.dtsi is the SoC +description DTS header and bcm96858.dts is a simple DTS file for +Broadcom BCM96858 Reference board that only enables the UART port. + +Signed-off-by: Anand Gore +Signed-off-by: Florian Fainelli +Stable-dep-of: 5cca02449490 ("arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/Makefile | 3 +- + .../boot/dts/broadcom/bcmbca/bcm6858.dtsi | 121 ++++++++++++++++++ + .../boot/dts/broadcom/bcmbca/bcm96858.dts | 30 +++++ + 3 files changed, 153 insertions(+), 1 deletion(-) + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi + create mode 100644 arch/arm64/boot/dts/broadcom/bcmbca/bcm96858.dts + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +index b6e520e9f2f21..4161d557b1329 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +@@ -1,3 +1,4 @@ + # SPDX-License-Identifier: GPL-2.0 + dtb-$(CONFIG_ARCH_BCMBCA) += bcm94912.dtb \ +- bcm963158.dtb ++ bcm963158.dtb \ ++ bcm96858.dtb +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi +new file mode 100644 +index 0000000000000..29a880c6c8588 +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm6858.dtsi +@@ -0,0 +1,121 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright 2022 Broadcom Ltd. ++ */ ++ ++#include ++#include ++ ++/ { ++ compatible = "brcm,bcm6858", "brcm,bcmbca"; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ++ interrupt-parent = <&gic>; ++ ++ cpus { ++ #address-cells = <2>; ++ #size-cells = <0>; ++ ++ B53_0: cpu@0 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x0>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_1: cpu@1 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x1>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_2: cpu@2 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x2>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ ++ B53_3: cpu@3 { ++ compatible = "brcm,brahma-b53"; ++ device_type = "cpu"; ++ reg = <0x0 0x3>; ++ next-level-cache = <&L2_0>; ++ enable-method = "psci"; ++ }; ++ L2_0: l2-cache0 { ++ compatible = "cache"; ++ }; ++ }; ++ ++ timer { ++ compatible = "arm,armv8-timer"; ++ interrupts = , ++ , ++ , ++ ; ++ }; ++ ++ pmu: pmu { ++ compatible = "arm,armv8-pmuv3"; ++ interrupts = , ++ , ++ , ++ ; ++ interrupt-affinity = <&B53_0>, <&B53_1>, ++ <&B53_2>, <&B53_3>; ++ }; ++ ++ clocks: clocks { ++ periph_clk:periph-clk { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <200000000>; ++ }; ++ }; ++ ++ psci { ++ compatible = "arm,psci-0.2"; ++ method = "smc"; ++ }; ++ ++ axi@81000000 { ++ compatible = "simple-bus"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x0 0x81000000 0x8000>; ++ ++ gic: interrupt-controller@1000 { ++ compatible = "arm,gic-400"; ++ #interrupt-cells = <3>; ++ interrupt-controller; ++ reg = <0x1000 0x1000>, /* GICD */ ++ <0x2000 0x2000>, /* GICC */ ++ <0x4000 0x2000>, /* GICH */ ++ <0x6000 0x2000>; /* GICV */ ++ interrupts = ; ++ }; ++ }; ++ ++ bus@ff800000 { ++ compatible = "simple-bus"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x0 0xff800000 0x62000>; ++ ++ uart0: serial@640 { ++ compatible = "brcm,bcm6345-uart"; ++ reg = <0x640 0x18>; ++ interrupts = ; ++ clocks = <&periph_clk>; ++ clock-names = "refclk"; ++ status = "disabled"; ++ }; ++ }; ++}; +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm96858.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96858.dts +new file mode 100644 +index 0000000000000..0cbf582f5d545 +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm96858.dts +@@ -0,0 +1,30 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright 2022 Broadcom Ltd. ++ */ ++ ++/dts-v1/; ++ ++#include "bcm6858.dtsi" ++ ++/ { ++ model = "Broadcom BCM96858 Reference Board"; ++ compatible = "brcm,bcm96858", "brcm,bcm6858", "brcm,bcmbca"; ++ ++ aliases { ++ serial0 = &uart0; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; ++ }; ++ ++ memory@0 { ++ device_type = "memory"; ++ reg = <0x0 0x0 0x0 0x08000000>; ++ }; ++}; ++ ++&uart0 { ++ status = "okay"; ++}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-broadcom-bcm4908-add-dt-for-netgear-raxe50.patch b/queue-5.15/arm64-dts-broadcom-bcm4908-add-dt-for-netgear-raxe50.patch new file mode 100644 index 00000000000..8638c53739a --- /dev/null +++ b/queue-5.15/arm64-dts-broadcom-bcm4908-add-dt-for-netgear-raxe50.patch @@ -0,0 +1,95 @@ +From fef019d40bdd022dabf7658b598a41f5abd73bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 11:14:13 +0100 +Subject: arm64: dts: broadcom: bcm4908: add DT for Netgear RAXE500 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit d0e68d354f345873e15876a7b35be1baaf5e3ec9 ] + +It's a home router based on BCM4908 SoC. It has: 1 GiB of RAM, 512 MiB +NAND flash, 6 Ethernet ports and 3 x BCM43684 (WiFi). One of Ethernet +ports is "2.5 G Multi-Gig port" that isn't described yet (it isn't known +how it's wired up). + +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Stable-dep-of: 5cca02449490 ("arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcm4908/Makefile | 1 + + .../bcm4908/bcm4908-netgear-raxe500.dts | 50 +++++++++++++++++++ + 2 files changed, 51 insertions(+) + create mode 100644 arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-netgear-raxe500.dts + +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/Makefile b/arch/arm64/boot/dts/broadcom/bcm4908/Makefile +index cc75854519ac3..6e364e304d4fd 100644 +--- a/arch/arm64/boot/dts/broadcom/bcm4908/Makefile ++++ b/arch/arm64/boot/dts/broadcom/bcm4908/Makefile +@@ -2,3 +2,4 @@ + dtb-$(CONFIG_ARCH_BCM4908) += bcm4906-netgear-r8000p.dtb + dtb-$(CONFIG_ARCH_BCM4908) += bcm4906-tplink-archer-c2300-v1.dtb + dtb-$(CONFIG_ARCH_BCM4908) += bcm4908-asus-gt-ac5300.dtb ++dtb-$(CONFIG_ARCH_BCM4908) += bcm4908-netgear-raxe500.dtb +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-netgear-raxe500.dts b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-netgear-raxe500.dts +new file mode 100644 +index 0000000000000..3c2cf2d238b6f +--- /dev/null ++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-netgear-raxe500.dts +@@ -0,0 +1,50 @@ ++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT ++ ++#include "bcm4908.dtsi" ++ ++/ { ++ compatible = "netgear,raxe500", "brcm,bcm4908"; ++ model = "Netgear RAXE500"; ++ ++ memory@0 { ++ device_type = "memory"; ++ reg = <0x00 0x00 0x00 0x40000000>; ++ }; ++}; ++ ++&ehci { ++ status = "okay"; ++}; ++ ++&ohci { ++ status = "okay"; ++}; ++ ++&xhci { ++ status = "okay"; ++}; ++ ++&ports { ++ port@0 { ++ label = "lan4"; ++ }; ++ ++ port@1 { ++ label = "lan3"; ++ }; ++ ++ port@2 { ++ label = "lan2"; ++ }; ++ ++ port@3 { ++ label = "lan1"; ++ }; ++ ++ port@7 { ++ reg = <7>; ++ phy-mode = "internal"; ++ phy-handle = <&phy12>; ++ label = "wan"; ++ }; ++}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch b/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch new file mode 100644 index 00000000000..a7645d06953 --- /dev/null +++ b/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch @@ -0,0 +1,42 @@ +From b511570de31d60519ce2e7929ab1c643bbbc6896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 15:43:58 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 5cca02449490e767289bda38db1577e2c375c084 ] + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: nand-controller@1800: interrupt-names:0: 'nand_ctlrdy' was expected + From schema: Documentation/devicetree/bindings/mtd/brcm,brcmnand.yaml +arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: nand-controller@1800: Unevaluated properties are not allowed ('interrupt-names' was unexpected) + From schema: Documentation/devicetree/bindings/mtd/brcm,brcmnand.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/all/20230228144400.21689-1-zajec5@gmail.com/ +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +index e510a6961cf95..03e27bcc44464 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +@@ -305,7 +305,7 @@ + reg = <0x1800 0x600>, <0x2000 0x10>; + reg-names = "nand", "nand-int-base"; + interrupts = ; +- interrupt-names = "nand"; ++ interrupt-names = "nand_ctlrdy"; + status = "okay"; + + nandcs: nand@0 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch b/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch new file mode 100644 index 00000000000..95f86e720e7 --- /dev/null +++ b/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch @@ -0,0 +1,40 @@ +From 1c4fe789f85e94671b14fcd178eeabd556e5ccf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 15:44:00 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit f16a8294dd7a02c7ad042cd2e3acc5ea06698dc1 ] + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: syscon@280000: $nodename:0: 'syscon@280000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|localbus|soc|axi|ahb|apb)(@.+)?$' + From schema: schemas/simple-bus.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/all/20230228144400.21689-3-zajec5@gmail.com/ +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +index 03e27bcc44464..b7db95ce0bbf2 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +@@ -253,7 +253,7 @@ + }; + }; + +- procmon: syscon@280000 { ++ procmon: bus@280000 { + compatible = "simple-bus"; + reg = <0x280000 0x1000>; + ranges; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-move-bcm4908-dts-to-bcmbca-folder.patch b/queue-5.15/arm64-dts-move-bcm4908-dts-to-bcmbca-folder.patch new file mode 100644 index 00000000000..7bf8be64a0f --- /dev/null +++ b/queue-5.15/arm64-dts-move-bcm4908-dts-to-bcmbca-folder.patch @@ -0,0 +1,101 @@ +From ed150480d8bd22f704a3407284dc130aec12f99b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 10:54:50 -0700 +Subject: arm64: dts: Move BCM4908 dts to bcmbca folder + +From: William Zhang + +[ Upstream commit ded8f22945899f4e87dd6d952bbc4abce6e64b7e ] + +As part of ARCH_BCM4908 to ARCH_BCMBCA migration, move the BCM4908 dts +files to bcmbca folder and use CONFIG_ARCH_BCMBCA to build all the +BCM4908 board dts. Delete bcm4908 folder and its makefile as well. + +Signed-off-by: William Zhang +Link: https://lore.kernel.org/r/20220803175455.47638-5-william.zhang@broadcom.com +Signed-off-by: Florian Fainelli +Stable-dep-of: 5cca02449490 ("arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/Makefile | 1 - + arch/arm64/boot/dts/broadcom/bcm4908/Makefile | 5 ----- + arch/arm64/boot/dts/broadcom/bcmbca/Makefile | 4 ++++ + .../broadcom/{bcm4908 => bcmbca}/bcm4906-netgear-r8000p.dts | 0 + .../{bcm4908 => bcmbca}/bcm4906-tplink-archer-c2300-v1.dts | 0 + .../arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4906.dtsi | 0 + .../broadcom/{bcm4908 => bcmbca}/bcm4908-asus-gt-ac5300.dts | 0 + .../broadcom/{bcm4908 => bcmbca}/bcm4908-netgear-raxe500.dts | 0 + .../arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4908.dtsi | 0 + 9 files changed, 4 insertions(+), 6 deletions(-) + delete mode 100644 arch/arm64/boot/dts/broadcom/bcm4908/Makefile + rename arch/arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4906-netgear-r8000p.dts (100%) + rename arch/arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4906-tplink-archer-c2300-v1.dts (100%) + rename arch/arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4906.dtsi (100%) + rename arch/arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4908-asus-gt-ac5300.dts (100%) + rename arch/arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4908-netgear-raxe500.dts (100%) + rename arch/arm64/boot/dts/broadcom/{bcm4908 => bcmbca}/bcm4908.dtsi (100%) + +diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile +index 9a0ea4b97ef23..bce0a12554539 100644 +--- a/arch/arm64/boot/dts/broadcom/Makefile ++++ b/arch/arm64/boot/dts/broadcom/Makefile +@@ -6,7 +6,6 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-400.dtb \ + bcm2837-rpi-3-b-plus.dtb \ + bcm2837-rpi-cm3-io3.dtb + +-subdir-y += bcm4908 + subdir-y += bcmbca + subdir-y += northstar2 + subdir-y += stingray +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/Makefile b/arch/arm64/boot/dts/broadcom/bcm4908/Makefile +deleted file mode 100644 +index 6e364e304d4fd..0000000000000 +--- a/arch/arm64/boot/dts/broadcom/bcm4908/Makefile ++++ /dev/null +@@ -1,5 +0,0 @@ +-# SPDX-License-Identifier: GPL-2.0 +-dtb-$(CONFIG_ARCH_BCM4908) += bcm4906-netgear-r8000p.dtb +-dtb-$(CONFIG_ARCH_BCM4908) += bcm4906-tplink-archer-c2300-v1.dtb +-dtb-$(CONFIG_ARCH_BCM4908) += bcm4908-asus-gt-ac5300.dtb +-dtb-$(CONFIG_ARCH_BCM4908) += bcm4908-netgear-raxe500.dtb +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +index fd60418478696..dc68357849a9b 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/Makefile ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/Makefile +@@ -1,5 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0 + dtb-$(CONFIG_ARCH_BCMBCA) += \ ++ bcm4906-netgear-r8000p.dtb \ ++ bcm4906-tplink-archer-c2300-v1.dtb \ ++ bcm4908-asus-gt-ac5300.dtb \ ++ bcm4908-netgear-raxe500.dtb \ + bcm4912-asus-gt-ax6000.dtb \ + bcm94912.dtb \ + bcm963158.dtb \ +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906-netgear-r8000p.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts +similarity index 100% +rename from arch/arm64/boot/dts/broadcom/bcm4908/bcm4906-netgear-r8000p.dts +rename to arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-netgear-r8000p.dts +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906-tplink-archer-c2300-v1.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts +similarity index 100% +rename from arch/arm64/boot/dts/broadcom/bcm4908/bcm4906-tplink-archer-c2300-v1.dts +rename to arch/arm64/boot/dts/broadcom/bcmbca/bcm4906-tplink-archer-c2300-v1.dts +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4906.dtsi +similarity index 100% +rename from arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi +rename to arch/arm64/boot/dts/broadcom/bcmbca/bcm4906.dtsi +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts +similarity index 100% +rename from arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-asus-gt-ac5300.dts +rename to arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-netgear-raxe500.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-netgear-raxe500.dts +similarity index 100% +rename from arch/arm64/boot/dts/broadcom/bcm4908/bcm4908-netgear-raxe500.dts +rename to arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-netgear-raxe500.dts +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +similarity index 100% +rename from arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi +rename to arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch new file mode 100644 index 00000000000..7021513afd9 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch @@ -0,0 +1,71 @@ +From 92d057b6ac998a413c5903375aa21d8dc1c0f2fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Sep 2021 21:58:53 +0200 +Subject: arm64: dts: qcom: apq8016-sbc: Clarify firmware-names + +From: Stephan Gerhold + +[ Upstream commit 2533786f46d074d67a4bca04c2d44d3825594415 ] + +Commit 0f6b380d580c ("arm64: dts: qcom: apq8016-sbc: Update modem and WiFi +firmware path") added "firmware-name"s to the APQ8016 SBC (DB410c) device +tree to separate the (test key)-signed firmware from other devices. + +However, the added names are a bit confusing. The "modem" firmware used by +DB410c is actually a simplified version for APQ8016 that lacks most of the +modem functionality (phone calls, SMS etc) that is available on MSM8916. +Placing it in "qcom/msm8916/modem.mbn" suggests that it supports all +functionality for MSM and not just the reduced functionality for APQ. + +Request the firmware from "qcom/apq8016/modem.mbn" instead to clarify this. +Do the same for "wcnss.mbn" for consistency (although the WCNSS firmware +works just fine on MSM8916). + +Finally, add a "_sbc" suffix to the WCNSS_qcom_wlan_nv.bin firmware file. +It seems like the nv.bin firmware is somewhat board specific and can +therefore vary a bit from device to device. This makes it more clear +which board it is intended to be used for. + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210922195853.95574-1-stephan@gerhold.net +Stable-dep-of: ec57cbce1a6d ("arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 351c68d29afb7..0e4a1f0040211 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -308,7 +308,7 @@ + &mpss { + status = "okay"; + +- firmware-name = "qcom/msm8916/mba.mbn", "qcom/msm8916/modem.mbn"; ++ firmware-name = "qcom/apq8016/mba.mbn", "qcom/apq8016/modem.mbn"; + }; + + &pm8916_resin { +@@ -319,7 +319,7 @@ + &pronto { + status = "okay"; + +- firmware-name = "qcom/msm8916/wcnss.mbn"; ++ firmware-name = "qcom/apq8016/wcnss.mbn"; + }; + + &sdhc_1 { +@@ -403,7 +403,7 @@ + }; + + &wcnss_ctrl { +- firmware-name = "qcom/msm8916/WCNSS_qcom_wlan_nv.bin"; ++ firmware-name = "qcom/apq8016/WCNSS_qcom_wlan_nv_sbc.bin"; + }; + + /* Enable CoreSight */ +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch new file mode 100644 index 00000000000..a7d3b89fa54 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch @@ -0,0 +1,47 @@ +From 2d031b1558f06a2ce4c1f74167c80bf09255cd25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Oct 2021 04:25:11 +0300 +Subject: arm64: dts: qcom: apq8016-sbc: fix mpps state names + +From: Dmitry Baryshkov + +[ Upstream commit a4344427eadd6caf0dc9e5384b023083e567221d ] + +The majority of device tree nodes for mpps use xxxx-state as pinctrl +nodes. Change names of mpps pinctrl nodes for the apq8016-sbc board to +follow that pattern. + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211008012524.481877-13-dmitry.baryshkov@linaro.org +Stable-dep-of: ec57cbce1a6d ("arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 0e4a1f0040211..1c097098f1e0f 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -821,7 +821,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&ls_exp_gpio_f>; + +- ls_exp_gpio_f: pm8916-mpp4 { ++ ls_exp_gpio_f: pm8916-mpp4-state { + pins = "mpp4"; + function = "digital"; + +@@ -829,7 +829,7 @@ + power-source = ; // 1.8V + }; + +- pm8916_mpps_leds: pm8916-mpps-leds { ++ pm8916_mpps_leds: pm8916-mpps-state { + pins = "mpp2", "mpp3"; + function = "digital"; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch new file mode 100644 index 00000000000..823adc9e181 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch @@ -0,0 +1,81 @@ +From b5280427a7a5edb53c75c4f64a2741c13c5e69c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 15:44:53 -0700 +Subject: arm64: dts: qcom: apq8016-sbc: Update modem and WiFi firmware path + +From: Bjorn Andersson + +[ Upstream commit 0f6b380d580cd081d5e385d349f55dfc52e3d68c ] + +The firmware for the modem and WiFi subsystems platform specific and is +signed with a OEM specific key (or a test key). In order to support more +than a single device it is therefor not possible to rely on the default +path and stash these files directly in the firmware directory. + +This has already been addressed for other platforms, but the APQ8016 SBC +(aka db410c) was never finished upstream. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Stephan Gerhold +Tested-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20210531224453.783218-1-bjorn.andersson@linaro.org +Stable-dep-of: ec57cbce1a6d ("arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 12 ++++++++++++ + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index f8d8f3e3664ec..351c68d29afb7 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -305,6 +305,12 @@ + status = "okay"; + }; + ++&mpss { ++ status = "okay"; ++ ++ firmware-name = "qcom/msm8916/mba.mbn", "qcom/msm8916/modem.mbn"; ++}; ++ + &pm8916_resin { + status = "okay"; + linux,code = ; +@@ -312,6 +318,8 @@ + + &pronto { + status = "okay"; ++ ++ firmware-name = "qcom/msm8916/wcnss.mbn"; + }; + + &sdhc_1 { +@@ -394,6 +402,10 @@ + qcom,mbhc-vthreshold-high = <75 150 237 450 500>; + }; + ++&wcnss_ctrl { ++ firmware-name = "qcom/msm8916/WCNSS_qcom_wlan_nv.bin"; ++}; ++ + /* Enable CoreSight */ + &cti0 { status = "okay"; }; + &cti1 { status = "okay"; }; +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index b967dbfba3b84..af3b4cf2ad2cf 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1771,7 +1771,7 @@ + + label = "pronto"; + +- wcnss { ++ wcnss_ctrl: wcnss { + compatible = "qcom,wcnss"; + qcom,smd-channels = "WCNSS_CTRL"; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8096-db820c-add-missing-regulator-.patch b/queue-5.15/arm64-dts-qcom-apq8096-db820c-add-missing-regulator-.patch new file mode 100644 index 00000000000..52c3cdd1830 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8096-db820c-add-missing-regulator-.patch @@ -0,0 +1,55 @@ +From 651980cd6ecc6b60e4fd7b5cfa9db0ae98cfdc08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 03:29:46 +0300 +Subject: arm64: dts: qcom: apq8096-db820c: add missing regulator details + +From: Dmitry Baryshkov + +[ Upstream commit 7c57dcae949d1d39068f1e92233a9bc2dc7dcfba ] + +Specify that S11 (well, whole block of s8+s9+s10+s11) of pm8994 and S2 +(s2 + s3) of pmi8994 are supplied by vph_pwr. While we are at it, add +regulator name to S11, so that is displayed as VDD_APCC in the system. + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211104002949.2204727-2-dmitry.baryshkov@linaro.org +Stable-dep-of: ec57cbce1a6d ("arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dts | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +index d01a512634cfe..7593d28d37412 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +@@ -632,6 +632,8 @@ + + &pm8994_spmi_regulators { + qcom,saw-reg = <&saw3>; ++ vdd_s11-supply = <&vph_pwr>; ++ + s9 { + qcom,saw-slave; + }; +@@ -640,6 +642,7 @@ + }; + s11 { + qcom,saw-leader; ++ regulator-name = "VDD_APCC"; + regulator-always-on; + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; +@@ -672,6 +675,8 @@ + }; + + &pmi8994_spmi_regulators { ++ vdd_s2-supply = <&vph_pwr>; ++ + vdd_gfx: s2@1700 { + reg = <0x1700 0x100>; + regulator-name = "VDD_GFX"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch b/queue-5.15/arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch new file mode 100644 index 00000000000..5e60b8e905b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch @@ -0,0 +1,53 @@ +From dc7f4ddf4637aca5a53508e70996f1a0fcf28796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:22 +0100 +Subject: arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 + regulator + +From: Krzysztof Kozlowski + +[ Upstream commit ec57cbce1a6d9384f8ac1ff966b204dc262f4927 ] + +The PMIC regulators are not supposed to have unit addresses. + +Fixes: 2317b87a2a6f ("arm64: dts: qcom: db820c: Add vdd_gfx and tie it into mmcc") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-8-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dts | 3 +-- + arch/arm64/boot/dts/qcom/pmi8994.dtsi | 2 -- + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +index 7593d28d37412..3f1f658c92631 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +@@ -677,8 +677,7 @@ + &pmi8994_spmi_regulators { + vdd_s2-supply = <&vph_pwr>; + +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; ++ vdd_gfx: s2 { + regulator-name = "VDD_GFX"; + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; +diff --git a/arch/arm64/boot/dts/qcom/pmi8994.dtsi b/arch/arm64/boot/dts/qcom/pmi8994.dtsi +index a06ea9adae810..304f99c900bb1 100644 +--- a/arch/arm64/boot/dts/qcom/pmi8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmi8994.dtsi +@@ -29,8 +29,6 @@ + + pmi8994_spmi_regulators: regulators { + compatible = "qcom,pmi8994-regulators"; +- #address-cells = <1>; +- #size-cells = <1>; + }; + + pmi8994_wled: wled@d800 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch b/queue-5.15/arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch new file mode 100644 index 00000000000..311aed79a9a --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch @@ -0,0 +1,107 @@ +From 3638c4a785990acabf522ea181b2dd3409929cb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 19:33:24 +0000 +Subject: arm64: dts: qcom: db820c: Move blsp1_uart2 pin states to msm8996.dtsi + +From: Yassine Oudjana + +[ Upstream commit c57b4247faaf6d17a319c91d5eb736c3bc65aca2 ] + +Move blsp1_uart2_default and blsp1_uart2_sleep to the SoC device tree to +avoid duplicating them in other device trees. + +Signed-off-by: Yassine Oudjana +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210901193214.250375-2-y.oudjana@protonmail.com +Stable-dep-of: ec57cbce1a6d ("arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 29 -------------------- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 17 ++++++++++++ + 2 files changed, 17 insertions(+), 29 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +index 51e17094d7b18..eca428ab2517a 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +@@ -148,9 +148,6 @@ + &blsp1_uart2 { + label = "BT-UART"; + status = "okay"; +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&blsp1_uart2_default>; +- pinctrl-1 = <&blsp1_uart2_sleep>; + + bluetooth { + compatible = "qcom,qca6174-bt"; +@@ -437,32 +434,6 @@ + }; + }; + +- blsp1_uart2_default: blsp1_uart2_default { +- mux { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- function = "blsp_uart2"; +- }; +- +- config { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- drive-strength = <16>; +- bias-disable; +- }; +- }; +- +- blsp1_uart2_sleep: blsp1_uart2_sleep { +- mux { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- drive-strength = <2>; +- bias-disable; +- }; +- }; +- + hdmi_hpd_active: hdmi_hpd_active { + mux { + pins = "gpio34"; +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index b22d3c8db3b39..3266ad5112d56 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1228,6 +1228,20 @@ + }; + }; + ++ blsp1_uart2_default: blsp1-uart2-default { ++ pins = "gpio41", "gpio42", "gpio43", "gpio44"; ++ function = "blsp_uart2"; ++ drive-strength = <16>; ++ bias-disable; ++ }; ++ ++ blsp1_uart2_sleep: blsp1-uart2-sleep { ++ pins = "gpio41", "gpio42", "gpio43", "gpio44"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; ++ }; ++ + blsp1_i2c3_default: blsp1-i2c2-default { + pins = "gpio47", "gpio48"; + function = "blsp_i2c3"; +@@ -2721,6 +2735,9 @@ + clocks = <&gcc GCC_BLSP1_UART2_APPS_CLK>, + <&gcc GCC_BLSP1_AHB_CLK>; + clock-names = "core", "iface"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&blsp1_uart2_default>; ++ pinctrl-1 = <&blsp1_uart2_sleep>; + dmas = <&blsp1_dma 2>, <&blsp1_dma 3>; + dma-names = "tx", "rx"; + status = "disabled"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch b/queue-5.15/arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch new file mode 100644 index 00000000000..c15ce97c5de --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch @@ -0,0 +1,4029 @@ +From 2d7584cc14880288f7e6f43ea23a23145b128b3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:36:56 +0200 +Subject: arm64: dts: qcom: Drop unneeded extra device-specific includes + +From: Stephan Gerhold + +[ Upstream commit 442ee1fc60c47539253fafd4cbbe2f1ec22e2a46 ] + +For some reason apq8016-sbc, apq8096-db820c, msm8916-mtp and msm8996-mtp +were added as separate .dts and .dtsi files where the first only contains +the model name and the latter contains most of the actual definitions. +Perhaps this was done with the expectation that there would be other +devices also making use of exactly the same. However, this has not +been the case until now and it also seems unlikely in the future. +Having the extra .dtsi only clutters the file list and provides +little benefit. + +Move the contents of the .dtsi into the .dts file to make this consistent +with most other devices that simply define everything in the .dts. + +There are no functional changes introduced by this patch: +The compiled ".dtb"s are completely identical. + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211018133656.32649-1-stephan@gerhold.net +Stable-dep-of: ec57cbce1a6d ("arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 832 +++++++++++++- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 838 -------------- + arch/arm64/boot/dts/qcom/apq8096-db820c.dts | 1070 ++++++++++++++++- + arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 1076 ------------------ + arch/arm64/boot/dts/qcom/msm8916-mtp.dts | 15 +- + arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi | 21 - + arch/arm64/boot/dts/qcom/msm8996-mtp.dts | 24 +- + arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi | 30 - + 8 files changed, 1937 insertions(+), 1969 deletions(-) + delete mode 100644 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi + delete mode 100644 arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi + delete mode 100644 arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi + delete mode 100644 arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index f3c0dbfd0a232..a5320d6d30e7b 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -5,9 +5,839 @@ + + /dts-v1/; + +-#include "apq8016-sbc.dtsi" ++#include "msm8916-pm8916.dtsi" ++#include ++#include ++#include ++#include ++#include + + / { + model = "Qualcomm Technologies, Inc. APQ 8016 SBC"; + compatible = "qcom,apq8016-sbc", "qcom,apq8016"; ++ ++ aliases { ++ serial0 = &blsp1_uart2; ++ serial1 = &blsp1_uart1; ++ usid0 = &pm8916_0; ++ i2c0 = &blsp_i2c2; ++ i2c1 = &blsp_i2c6; ++ i2c3 = &blsp_i2c4; ++ spi0 = &blsp_spi5; ++ spi1 = &blsp_spi3; ++ }; ++ ++ chosen { ++ stdout-path = "serial0"; ++ }; ++ ++ camera_vdddo_1v8: camera-vdddo-1v8 { ++ compatible = "regulator-fixed"; ++ regulator-name = "camera_vdddo"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-always-on; ++ }; ++ ++ camera_vdda_2v8: camera-vdda-2v8 { ++ compatible = "regulator-fixed"; ++ regulator-name = "camera_vdda"; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ regulator-always-on; ++ }; ++ ++ camera_vddd_1v5: camera-vddd-1v5 { ++ compatible = "regulator-fixed"; ++ regulator-name = "camera_vddd"; ++ regulator-min-microvolt = <1500000>; ++ regulator-max-microvolt = <1500000>; ++ regulator-always-on; ++ }; ++ ++ reserved-memory { ++ ramoops@bff00000 { ++ compatible = "ramoops"; ++ reg = <0x0 0xbff00000 0x0 0x100000>; ++ ++ record-size = <0x20000>; ++ console-size = <0x20000>; ++ ftrace-size = <0x20000>; ++ }; ++ }; ++ ++ usb2513 { ++ compatible = "smsc,usb3503"; ++ reset-gpios = <&pm8916_gpios 3 GPIO_ACTIVE_LOW>; ++ initial-mode = <1>; ++ }; ++ ++ usb_id: usb-id { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&msmgpio 121 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb_id_default>; ++ }; ++ ++ hdmi-out { ++ compatible = "hdmi-connector"; ++ type = "a"; ++ ++ port { ++ hdmi_con: endpoint { ++ remote-endpoint = <&adv7533_out>; ++ }; ++ }; ++ }; ++ ++ gpio-keys { ++ compatible = "gpio-keys"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ autorepeat; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&msm_key_volp_n_default>; ++ ++ button@0 { ++ label = "Volume Up"; ++ linux,code = ; ++ gpios = <&msmgpio 107 GPIO_ACTIVE_LOW>; ++ }; ++ }; ++ ++ leds { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&msmgpio_leds>, ++ <&pm8916_gpios_leds>, ++ <&pm8916_mpps_leds>; ++ ++ compatible = "gpio-leds"; ++ ++ led@1 { ++ label = "apq8016-sbc:green:user1"; ++ gpios = <&msmgpio 21 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "heartbeat"; ++ default-state = "off"; ++ }; ++ ++ led@2 { ++ label = "apq8016-sbc:green:user2"; ++ gpios = <&msmgpio 120 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "mmc0"; ++ default-state = "off"; ++ }; ++ ++ led@3 { ++ label = "apq8016-sbc:green:user3"; ++ gpios = <&pm8916_gpios 1 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "mmc1"; ++ default-state = "off"; ++ }; ++ ++ led@4 { ++ label = "apq8016-sbc:green:user4"; ++ gpios = <&pm8916_gpios 2 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "none"; ++ panic-indicator; ++ default-state = "off"; ++ }; ++ ++ led@5 { ++ label = "apq8016-sbc:yellow:wlan"; ++ gpios = <&pm8916_mpps 2 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "phy0tx"; ++ default-state = "off"; ++ }; ++ ++ led@6 { ++ label = "apq8016-sbc:blue:bt"; ++ gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "bluetooth-power"; ++ default-state = "off"; ++ }; ++ }; ++}; ++ ++&blsp_dma { ++ status = "okay"; ++}; ++ ++&blsp_i2c2 { ++ /* On Low speed expansion */ ++ status = "okay"; ++ label = "LS-I2C0"; ++}; ++ ++&blsp_i2c4 { ++ /* On High speed expansion */ ++ status = "okay"; ++ label = "HS-I2C2"; ++ ++ adv_bridge: bridge@39 { ++ status = "okay"; ++ ++ compatible = "adi,adv7533"; ++ reg = <0x39>; ++ ++ interrupt-parent = <&msmgpio>; ++ interrupts = <31 IRQ_TYPE_EDGE_FALLING>; ++ ++ adi,dsi-lanes = <4>; ++ clocks = <&rpmcc RPM_SMD_BB_CLK2>; ++ clock-names = "cec"; ++ ++ pd-gpios = <&msmgpio 32 GPIO_ACTIVE_HIGH>; ++ ++ avdd-supply = <&pm8916_l6>; ++ v1p2-supply = <&pm8916_l6>; ++ v3p3-supply = <&pm8916_l17>; ++ ++ pinctrl-names = "default","sleep"; ++ pinctrl-0 = <&adv7533_int_active &adv7533_switch_active>; ++ pinctrl-1 = <&adv7533_int_suspend &adv7533_switch_suspend>; ++ #sound-dai-cells = <1>; ++ ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ adv7533_in: endpoint { ++ remote-endpoint = <&dsi0_out>; ++ }; ++ }; ++ ++ port@1 { ++ reg = <1>; ++ adv7533_out: endpoint { ++ remote-endpoint = <&hdmi_con>; ++ }; ++ }; ++ }; ++ }; ++}; ++ ++&blsp_i2c6 { ++ /* On Low speed expansion */ ++ status = "okay"; ++ label = "LS-I2C1"; ++}; ++ ++&blsp_spi3 { ++ /* On High speed expansion */ ++ status = "okay"; ++ label = "HS-SPI1"; ++}; ++ ++&blsp_spi5 { ++ /* On Low speed expansion */ ++ status = "okay"; ++ label = "LS-SPI0"; ++}; ++ ++&blsp1_uart1 { ++ status = "okay"; ++ label = "LS-UART0"; ++}; ++ ++&blsp1_uart2 { ++ status = "okay"; ++ label = "LS-UART1"; ++}; ++ ++&camss { ++ status = "okay"; ++ ports { ++ port@0 { ++ reg = <0>; ++ csiphy0_ep: endpoint { ++ clock-lanes = <1>; ++ data-lanes = <0 2>; ++ remote-endpoint = <&ov5640_ep>; ++ status = "okay"; ++ }; ++ }; ++ }; ++}; ++ ++&cci { ++ status = "okay"; ++}; ++ ++&cci_i2c0 { ++ camera_rear@3b { ++ compatible = "ovti,ov5640"; ++ reg = <0x3b>; ++ ++ enable-gpios = <&msmgpio 34 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&camera_rear_default>; ++ ++ clocks = <&gcc GCC_CAMSS_MCLK0_CLK>; ++ clock-names = "xclk"; ++ clock-frequency = <23880000>; ++ ++ vdddo-supply = <&camera_vdddo_1v8>; ++ vdda-supply = <&camera_vdda_2v8>; ++ vddd-supply = <&camera_vddd_1v5>; ++ ++ /* No camera mezzanine by default */ ++ status = "disabled"; ++ ++ port { ++ ov5640_ep: endpoint { ++ clock-lanes = <1>; ++ data-lanes = <0 2>; ++ remote-endpoint = <&csiphy0_ep>; ++ }; ++ }; ++ }; ++}; ++ ++&dsi0_out { ++ data-lanes = <0 1 2 3>; ++ remote-endpoint = <&adv7533_in>; ++}; ++ ++&lpass { ++ status = "okay"; ++}; ++ ++&mdss { ++ status = "okay"; ++}; ++ ++&mpss { ++ status = "okay"; ++ ++ firmware-name = "qcom/apq8016/mba.mbn", "qcom/apq8016/modem.mbn"; ++}; ++ ++&pm8916_resin { ++ status = "okay"; ++ linux,code = ; ++}; ++ ++&pronto { ++ status = "okay"; ++ ++ firmware-name = "qcom/apq8016/wcnss.mbn"; ++}; ++ ++&sdhc_1 { ++ status = "okay"; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on>; ++ pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off>; ++}; ++ ++&sdhc_2 { ++ status = "okay"; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>; ++ pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>; ++ ++ cd-gpios = <&msmgpio 38 GPIO_ACTIVE_LOW>; ++}; ++ ++&sound { ++ status = "okay"; ++ ++ pinctrl-0 = <&cdc_pdm_lines_act &ext_sec_tlmm_lines_act &ext_mclk_tlmm_lines_act>; ++ pinctrl-1 = <&cdc_pdm_lines_sus &ext_sec_tlmm_lines_sus &ext_mclk_tlmm_lines_sus>; ++ pinctrl-names = "default", "sleep"; ++ qcom,model = "DB410c"; ++ qcom,audio-routing = ++ "AMIC2", "MIC BIAS Internal2", ++ "AMIC3", "MIC BIAS External1"; ++ ++ external-dai-link@0 { ++ link-name = "ADV7533"; ++ cpu { ++ sound-dai = <&lpass MI2S_QUATERNARY>; ++ }; ++ codec { ++ sound-dai = <&adv_bridge 0>; ++ }; ++ }; ++ ++ internal-codec-playback-dai-link@0 { ++ link-name = "WCD"; ++ cpu { ++ sound-dai = <&lpass MI2S_PRIMARY>; ++ }; ++ codec { ++ sound-dai = <&lpass_codec 0>, <&wcd_codec 0>; ++ }; ++ }; ++ ++ internal-codec-capture-dai-link@0 { ++ link-name = "WCD-Capture"; ++ cpu { ++ sound-dai = <&lpass MI2S_TERTIARY>; ++ }; ++ codec { ++ sound-dai = <&lpass_codec 1>, <&wcd_codec 1>; ++ }; ++ }; ++}; ++ ++&usb { ++ status = "okay"; ++ extcon = <&usb_id>, <&usb_id>; ++ ++ pinctrl-names = "default", "device"; ++ pinctrl-0 = <&usb_sw_sel_pm &usb_hub_reset_pm>; ++ pinctrl-1 = <&usb_sw_sel_pm_device &usb_hub_reset_pm_device>; ++}; ++ ++&usb_hs_phy { ++ extcon = <&usb_id>; ++}; ++ ++&wcd_codec { ++ clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>; ++ clock-names = "mclk"; ++ qcom,mbhc-vthreshold-low = <75 150 237 450 500>; ++ qcom,mbhc-vthreshold-high = <75 150 237 450 500>; ++}; ++ ++&wcnss_ctrl { ++ firmware-name = "qcom/apq8016/WCNSS_qcom_wlan_nv_sbc.bin"; ++}; ++ ++/* Enable CoreSight */ ++&cti0 { status = "okay"; }; ++&cti1 { status = "okay"; }; ++&cti12 { status = "okay"; }; ++&cti13 { status = "okay"; }; ++&cti14 { status = "okay"; }; ++&cti15 { status = "okay"; }; ++&debug0 { status = "okay"; }; ++&debug1 { status = "okay"; }; ++&debug2 { status = "okay"; }; ++&debug3 { status = "okay"; }; ++&etf { status = "okay"; }; ++&etm0 { status = "okay"; }; ++&etm1 { status = "okay"; }; ++&etm2 { status = "okay"; }; ++&etm3 { status = "okay"; }; ++&etr { status = "okay"; }; ++&funnel0 { status = "okay"; }; ++&funnel1 { status = "okay"; }; ++&replicator { status = "okay"; }; ++&stm { status = "okay"; }; ++&tpiu { status = "okay"; }; ++ ++&smd_rpm_regulators { ++ vdd_l1_l2_l3-supply = <&pm8916_s3>; ++ vdd_l4_l5_l6-supply = <&pm8916_s4>; ++ vdd_l7-supply = <&pm8916_s4>; ++ ++ s3 { ++ regulator-min-microvolt = <375000>; ++ regulator-max-microvolt = <1562000>; ++ }; ++ ++ s4 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ ++ l1 { ++ regulator-min-microvolt = <375000>; ++ regulator-max-microvolt = <1525000>; ++ }; ++ ++ l2 { ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ ++ l4 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l5 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l6 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ l7 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l8 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l9 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l10 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l11 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ regulator-allow-set-load; ++ regulator-system-load = <200000>; ++ }; ++ ++ l12 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l13 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l14 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ /** ++ * 1.8v required on LS expansion ++ * for mezzanine boards ++ */ ++ l15 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ regulator-always-on; ++ }; ++ ++ l16 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l17 { ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ ++ l18 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++}; ++ ++/* ++ * 2mA drive strength is not enough when connecting multiple ++ * I2C devices with different pull up resistors. ++ */ ++&i2c2_default { ++ drive-strength = <16>; ++}; ++ ++&i2c4_default { ++ drive-strength = <16>; ++}; ++ ++&i2c6_default { ++ drive-strength = <16>; ++}; ++ ++/* ++ * GPIO name legend: proper name = the GPIO line is used as GPIO ++ * NC = not connected (pin out but not routed from the chip to ++ * anything the board) ++ * "[PER]" = pin is muxed for [peripheral] (not GPIO) ++ * LSEC = Low Speed External Connector ++ * HSEC = High Speed External Connector ++ * ++ * Line names are taken from the schematic "DragonBoard410c" ++ * dated monday, august 31, 2015. Page 5 in particular. ++ * ++ * For the lines routed to the external connectors the ++ * lines are named after the 96Boards CE Specification 1.0, ++ * Appendix "Expansion Connector Signal Description". ++ * ++ * When the 96Board naming of a line and the schematic name of ++ * the same line are in conflict, the 96Board specification ++ * takes precedence, which means that the external UART on the ++ * LSEC is named UART0 while the schematic and SoC names this ++ * UART3. This is only for the informational lines i.e. "[FOO]", ++ * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only ++ * ones actually used for GPIO. ++ */ ++ ++&msmgpio { ++ gpio-line-names = ++ "[UART0_TX]", /* GPIO_0, LSEC pin 5 */ ++ "[UART0_RX]", /* GPIO_1, LSEC pin 7 */ ++ "[UART0_CTS_N]", /* GPIO_2, LSEC pin 3 */ ++ "[UART0_RTS_N]", /* GPIO_3, LSEC pin 9 */ ++ "[UART1_TX]", /* GPIO_4, LSEC pin 11 */ ++ "[UART1_RX]", /* GPIO_5, LSEC pin 13 */ ++ "[I2C0_SDA]", /* GPIO_8, LSEC pin 17 */ ++ "[I2C0_SCL]", /* GPIO_7, LSEC pin 15 */ ++ "[SPI1_DOUT]", /* SPI1_MOSI, HSEC pin 1 */ ++ "[SPI1_DIN]", /* SPI1_MISO, HSEC pin 11 */ ++ "[SPI1_CS]", /* SPI1_CS_N, HSEC pin 7 */ ++ "[SPI1_SCLK]", /* SPI1_CLK, HSEC pin 9 */ ++ "GPIO-B", /* LS_EXP_GPIO_B, LSEC pin 24 */ ++ "GPIO-C", /* LS_EXP_GPIO_C, LSEC pin 25 */ ++ "[I2C3_SDA]", /* HSEC pin 38 */ ++ "[I2C3_SCL]", /* HSEC pin 36 */ ++ "[SPI0_MOSI]", /* LSEC pin 14 */ ++ "[SPI0_MISO]", /* LSEC pin 10 */ ++ "[SPI0_CS_N]", /* LSEC pin 12 */ ++ "[SPI0_CLK]", /* LSEC pin 8 */ ++ "HDMI_HPD_N", /* GPIO 20 */ ++ "USR_LED_1_CTRL", ++ "[I2C1_SDA]", /* GPIO_22, LSEC pin 21 */ ++ "[I2C1_SCL]", /* GPIO_23, LSEC pin 19 */ ++ "GPIO-G", /* LS_EXP_GPIO_G, LSEC pin 29 */ ++ "GPIO-H", /* LS_EXP_GPIO_H, LSEC pin 30 */ ++ "[CSI0_MCLK]", /* HSEC pin 15 */ ++ "[CSI1_MCLK]", /* HSEC pin 17 */ ++ "GPIO-K", /* LS_EXP_GPIO_K, LSEC pin 33 */ ++ "[I2C2_SDA]", /* HSEC pin 34 */ ++ "[I2C2_SCL]", /* HSEC pin 32 */ ++ "DSI2HDMI_INT_N", ++ "DSI_SW_SEL_APQ", ++ "GPIO-L", /* LS_EXP_GPIO_L, LSEC pin 34 */ ++ "GPIO-J", /* LS_EXP_GPIO_J, LSEC pin 32 */ ++ "GPIO-I", /* LS_EXP_GPIO_I, LSEC pin 31 */ ++ "GPIO-A", /* LS_EXP_GPIO_A, LSEC pin 23 */ ++ "FORCED_USB_BOOT", ++ "SD_CARD_DET_N", ++ "[WCSS_BT_SSBI]", ++ "[WCSS_WLAN_DATA_2]", /* GPIO 40 */ ++ "[WCSS_WLAN_DATA_1]", ++ "[WCSS_WLAN_DATA_0]", ++ "[WCSS_WLAN_SET]", ++ "[WCSS_WLAN_CLK]", ++ "[WCSS_FM_SSBI]", ++ "[WCSS_FM_SDI]", ++ "[WCSS_BT_DAT_CTL]", ++ "[WCSS_BT_DAT_STB]", ++ "NC", ++ "NC", /* GPIO 50 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 60 */ ++ "NC", ++ "NC", ++ "[CDC_PDM0_CLK]", ++ "[CDC_PDM0_SYNC]", ++ "[CDC_PDM0_TX0]", ++ "[CDC_PDM0_RX0]", ++ "[CDC_PDM0_RX1]", ++ "[CDC_PDM0_RX2]", ++ "GPIO-D", /* LS_EXP_GPIO_D, LSEC pin 26 */ ++ "NC", /* GPIO 70 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 74 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "BOOT_CONFIG_0", /* GPIO 80 */ ++ "BOOT_CONFIG_1", ++ "BOOT_CONFIG_2", ++ "BOOT_CONFIG_3", ++ "NC", ++ "NC", ++ "BOOT_CONFIG_5", ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 90 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 100 */ ++ "NC", ++ "NC", ++ "NC", ++ "SSBI_GPS", ++ "NC", ++ "NC", ++ "KEY_VOLP_N", ++ "NC", ++ "NC", ++ "[LS_EXP_MI2S_WS]", /* GPIO 110 */ ++ "NC", ++ "NC", ++ "[LS_EXP_MI2S_SCK]", ++ "[LS_EXP_MI2S_DATA0]", ++ "GPIO-E", /* LS_EXP_GPIO_E, LSEC pin 27 */ ++ "NC", ++ "[DSI2HDMI_MI2S_WS]", ++ "[DSI2HDMI_MI2S_SCK]", ++ "[DSI2HDMI_MI2S_DATA0]", ++ "USR_LED_2_CTRL", /* GPIO 120 */ ++ "SB_HS_ID"; ++ ++ msmgpio_leds: msmgpio-leds { ++ pins = "gpio21", "gpio120"; ++ function = "gpio"; ++ ++ output-low; ++ }; ++ ++ usb_id_default: usb-id-default { ++ pins = "gpio121"; ++ function = "gpio"; ++ ++ drive-strength = <8>; ++ input-enable; ++ bias-pull-up; ++ }; ++ ++ adv7533_int_active: adv533-int-active { ++ pins = "gpio31"; ++ function = "gpio"; ++ ++ drive-strength = <16>; ++ bias-disable; ++ }; ++ ++ adv7533_int_suspend: adv7533-int-suspend { ++ pins = "gpio31"; ++ function = "gpio"; ++ ++ drive-strength = <2>; ++ bias-disable; ++ }; ++ ++ adv7533_switch_active: adv7533-switch-active { ++ pins = "gpio32"; ++ function = "gpio"; ++ ++ drive-strength = <16>; ++ bias-disable; ++ }; ++ ++ adv7533_switch_suspend: adv7533-switch-suspend { ++ pins = "gpio32"; ++ function = "gpio"; ++ ++ drive-strength = <2>; ++ bias-disable; ++ }; ++ ++ msm_key_volp_n_default: msm-key-volp-n-default { ++ pins = "gpio107"; ++ function = "gpio"; ++ ++ drive-strength = <8>; ++ input-enable; ++ bias-pull-up; ++ }; ++}; ++ ++&pm8916_gpios { ++ gpio-line-names = ++ "USR_LED_3_CTRL", ++ "USR_LED_4_CTRL", ++ "USB_HUB_RESET_N_PM", ++ "USB_SW_SEL_PM"; ++ ++ usb_hub_reset_pm: usb-hub-reset-pm { ++ pins = "gpio3"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ input-disable; ++ output-high; ++ }; ++ ++ usb_hub_reset_pm_device: usb-hub-reset-pm-device { ++ pins = "gpio3"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ output-low; ++ }; ++ ++ usb_sw_sel_pm: usb-sw-sel-pm { ++ pins = "gpio4"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ power-source = ; ++ input-disable; ++ output-high; ++ }; ++ ++ usb_sw_sel_pm_device: usb-sw-sel-pm-device { ++ pins = "gpio4"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ power-source = ; ++ input-disable; ++ output-low; ++ }; ++ ++ pm8916_gpios_leds: pm8916-gpios-leds { ++ pins = "gpio1", "gpio2"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ output-low; ++ }; ++}; ++ ++&pm8916_mpps { ++ gpio-line-names = ++ "VDD_PX_BIAS", ++ "WLAN_LED_CTRL", ++ "BT_LED_CTRL", ++ "GPIO-F"; /* LS_EXP_GPIO_F, LSEC pin 28 */ ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ls_exp_gpio_f>; ++ ++ ls_exp_gpio_f: pm8916-mpp4-state { ++ pins = "mpp4"; ++ function = "digital"; ++ ++ output-low; ++ power-source = ; // 1.8V ++ }; ++ ++ pm8916_mpps_leds: pm8916-mpps-state { ++ pins = "mpp2", "mpp3"; ++ function = "digital"; ++ ++ output-low; ++ }; + }; +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +deleted file mode 100644 +index 1c097098f1e0f..0000000000000 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ /dev/null +@@ -1,838 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2015, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8916-pm8916.dtsi" +-#include +-#include +-#include +-#include +-#include +- +-/ { +- aliases { +- serial0 = &blsp1_uart2; +- serial1 = &blsp1_uart1; +- usid0 = &pm8916_0; +- i2c0 = &blsp_i2c2; +- i2c1 = &blsp_i2c6; +- i2c3 = &blsp_i2c4; +- spi0 = &blsp_spi5; +- spi1 = &blsp_spi3; +- }; +- +- chosen { +- stdout-path = "serial0"; +- }; +- +- camera_vdddo_1v8: camera-vdddo-1v8 { +- compatible = "regulator-fixed"; +- regulator-name = "camera_vdddo"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- regulator-always-on; +- }; +- +- camera_vdda_2v8: camera-vdda-2v8 { +- compatible = "regulator-fixed"; +- regulator-name = "camera_vdda"; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; +- regulator-always-on; +- }; +- +- camera_vddd_1v5: camera-vddd-1v5 { +- compatible = "regulator-fixed"; +- regulator-name = "camera_vddd"; +- regulator-min-microvolt = <1500000>; +- regulator-max-microvolt = <1500000>; +- regulator-always-on; +- }; +- +- reserved-memory { +- ramoops@bff00000 { +- compatible = "ramoops"; +- reg = <0x0 0xbff00000 0x0 0x100000>; +- +- record-size = <0x20000>; +- console-size = <0x20000>; +- ftrace-size = <0x20000>; +- }; +- }; +- +- usb2513 { +- compatible = "smsc,usb3503"; +- reset-gpios = <&pm8916_gpios 3 GPIO_ACTIVE_LOW>; +- initial-mode = <1>; +- }; +- +- usb_id: usb-id { +- compatible = "linux,extcon-usb-gpio"; +- id-gpio = <&msmgpio 121 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&usb_id_default>; +- }; +- +- hdmi-out { +- compatible = "hdmi-connector"; +- type = "a"; +- +- port { +- hdmi_con: endpoint { +- remote-endpoint = <&adv7533_out>; +- }; +- }; +- }; +- +- gpio-keys { +- compatible = "gpio-keys"; +- #address-cells = <1>; +- #size-cells = <0>; +- autorepeat; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&msm_key_volp_n_default>; +- +- button@0 { +- label = "Volume Up"; +- linux,code = ; +- gpios = <&msmgpio 107 GPIO_ACTIVE_LOW>; +- }; +- }; +- +- leds { +- pinctrl-names = "default"; +- pinctrl-0 = <&msmgpio_leds>, +- <&pm8916_gpios_leds>, +- <&pm8916_mpps_leds>; +- +- compatible = "gpio-leds"; +- +- led@1 { +- label = "apq8016-sbc:green:user1"; +- gpios = <&msmgpio 21 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "heartbeat"; +- default-state = "off"; +- }; +- +- led@2 { +- label = "apq8016-sbc:green:user2"; +- gpios = <&msmgpio 120 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "mmc0"; +- default-state = "off"; +- }; +- +- led@3 { +- label = "apq8016-sbc:green:user3"; +- gpios = <&pm8916_gpios 1 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "mmc1"; +- default-state = "off"; +- }; +- +- led@4 { +- label = "apq8016-sbc:green:user4"; +- gpios = <&pm8916_gpios 2 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "none"; +- panic-indicator; +- default-state = "off"; +- }; +- +- led@5 { +- label = "apq8016-sbc:yellow:wlan"; +- gpios = <&pm8916_mpps 2 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "phy0tx"; +- default-state = "off"; +- }; +- +- led@6 { +- label = "apq8016-sbc:blue:bt"; +- gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bluetooth-power"; +- default-state = "off"; +- }; +- }; +-}; +- +-&blsp_dma { +- status = "okay"; +-}; +- +-&blsp_i2c2 { +- /* On Low speed expansion */ +- status = "okay"; +- label = "LS-I2C0"; +-}; +- +-&blsp_i2c4 { +- /* On High speed expansion */ +- status = "okay"; +- label = "HS-I2C2"; +- +- adv_bridge: bridge@39 { +- status = "okay"; +- +- compatible = "adi,adv7533"; +- reg = <0x39>; +- +- interrupt-parent = <&msmgpio>; +- interrupts = <31 IRQ_TYPE_EDGE_FALLING>; +- +- adi,dsi-lanes = <4>; +- clocks = <&rpmcc RPM_SMD_BB_CLK2>; +- clock-names = "cec"; +- +- pd-gpios = <&msmgpio 32 GPIO_ACTIVE_HIGH>; +- +- avdd-supply = <&pm8916_l6>; +- v1p2-supply = <&pm8916_l6>; +- v3p3-supply = <&pm8916_l17>; +- +- pinctrl-names = "default","sleep"; +- pinctrl-0 = <&adv7533_int_active &adv7533_switch_active>; +- pinctrl-1 = <&adv7533_int_suspend &adv7533_switch_suspend>; +- #sound-dai-cells = <1>; +- +- ports { +- #address-cells = <1>; +- #size-cells = <0>; +- +- port@0 { +- reg = <0>; +- adv7533_in: endpoint { +- remote-endpoint = <&dsi0_out>; +- }; +- }; +- +- port@1 { +- reg = <1>; +- adv7533_out: endpoint { +- remote-endpoint = <&hdmi_con>; +- }; +- }; +- }; +- }; +-}; +- +-&blsp_i2c6 { +- /* On Low speed expansion */ +- status = "okay"; +- label = "LS-I2C1"; +-}; +- +-&blsp_spi3 { +- /* On High speed expansion */ +- status = "okay"; +- label = "HS-SPI1"; +-}; +- +-&blsp_spi5 { +- /* On Low speed expansion */ +- status = "okay"; +- label = "LS-SPI0"; +-}; +- +-&blsp1_uart1 { +- status = "okay"; +- label = "LS-UART0"; +-}; +- +-&blsp1_uart2 { +- status = "okay"; +- label = "LS-UART1"; +-}; +- +-&camss { +- status = "okay"; +- ports { +- port@0 { +- reg = <0>; +- csiphy0_ep: endpoint { +- clock-lanes = <1>; +- data-lanes = <0 2>; +- remote-endpoint = <&ov5640_ep>; +- status = "okay"; +- }; +- }; +- }; +-}; +- +-&cci { +- status = "okay"; +-}; +- +-&cci_i2c0 { +- camera_rear@3b { +- compatible = "ovti,ov5640"; +- reg = <0x3b>; +- +- enable-gpios = <&msmgpio 34 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>; +- pinctrl-names = "default"; +- pinctrl-0 = <&camera_rear_default>; +- +- clocks = <&gcc GCC_CAMSS_MCLK0_CLK>; +- clock-names = "xclk"; +- clock-frequency = <23880000>; +- +- vdddo-supply = <&camera_vdddo_1v8>; +- vdda-supply = <&camera_vdda_2v8>; +- vddd-supply = <&camera_vddd_1v5>; +- +- /* No camera mezzanine by default */ +- status = "disabled"; +- +- port { +- ov5640_ep: endpoint { +- clock-lanes = <1>; +- data-lanes = <0 2>; +- remote-endpoint = <&csiphy0_ep>; +- }; +- }; +- }; +-}; +- +-&dsi0_out { +- data-lanes = <0 1 2 3>; +- remote-endpoint = <&adv7533_in>; +-}; +- +-&lpass { +- status = "okay"; +-}; +- +-&mdss { +- status = "okay"; +-}; +- +-&mpss { +- status = "okay"; +- +- firmware-name = "qcom/apq8016/mba.mbn", "qcom/apq8016/modem.mbn"; +-}; +- +-&pm8916_resin { +- status = "okay"; +- linux,code = ; +-}; +- +-&pronto { +- status = "okay"; +- +- firmware-name = "qcom/apq8016/wcnss.mbn"; +-}; +- +-&sdhc_1 { +- status = "okay"; +- +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on>; +- pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off>; +-}; +- +-&sdhc_2 { +- status = "okay"; +- +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>; +- pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>; +- +- cd-gpios = <&msmgpio 38 GPIO_ACTIVE_LOW>; +-}; +- +-&sound { +- status = "okay"; +- +- pinctrl-0 = <&cdc_pdm_lines_act &ext_sec_tlmm_lines_act &ext_mclk_tlmm_lines_act>; +- pinctrl-1 = <&cdc_pdm_lines_sus &ext_sec_tlmm_lines_sus &ext_mclk_tlmm_lines_sus>; +- pinctrl-names = "default", "sleep"; +- qcom,model = "DB410c"; +- qcom,audio-routing = +- "AMIC2", "MIC BIAS Internal2", +- "AMIC3", "MIC BIAS External1"; +- +- external-dai-link@0 { +- link-name = "ADV7533"; +- cpu { +- sound-dai = <&lpass MI2S_QUATERNARY>; +- }; +- codec { +- sound-dai = <&adv_bridge 0>; +- }; +- }; +- +- internal-codec-playback-dai-link@0 { +- link-name = "WCD"; +- cpu { +- sound-dai = <&lpass MI2S_PRIMARY>; +- }; +- codec { +- sound-dai = <&lpass_codec 0>, <&wcd_codec 0>; +- }; +- }; +- +- internal-codec-capture-dai-link@0 { +- link-name = "WCD-Capture"; +- cpu { +- sound-dai = <&lpass MI2S_TERTIARY>; +- }; +- codec { +- sound-dai = <&lpass_codec 1>, <&wcd_codec 1>; +- }; +- }; +-}; +- +-&usb { +- status = "okay"; +- extcon = <&usb_id>, <&usb_id>; +- +- pinctrl-names = "default", "device"; +- pinctrl-0 = <&usb_sw_sel_pm &usb_hub_reset_pm>; +- pinctrl-1 = <&usb_sw_sel_pm_device &usb_hub_reset_pm_device>; +-}; +- +-&usb_hs_phy { +- extcon = <&usb_id>; +-}; +- +-&wcd_codec { +- clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>; +- clock-names = "mclk"; +- qcom,mbhc-vthreshold-low = <75 150 237 450 500>; +- qcom,mbhc-vthreshold-high = <75 150 237 450 500>; +-}; +- +-&wcnss_ctrl { +- firmware-name = "qcom/apq8016/WCNSS_qcom_wlan_nv_sbc.bin"; +-}; +- +-/* Enable CoreSight */ +-&cti0 { status = "okay"; }; +-&cti1 { status = "okay"; }; +-&cti12 { status = "okay"; }; +-&cti13 { status = "okay"; }; +-&cti14 { status = "okay"; }; +-&cti15 { status = "okay"; }; +-&debug0 { status = "okay"; }; +-&debug1 { status = "okay"; }; +-&debug2 { status = "okay"; }; +-&debug3 { status = "okay"; }; +-&etf { status = "okay"; }; +-&etm0 { status = "okay"; }; +-&etm1 { status = "okay"; }; +-&etm2 { status = "okay"; }; +-&etm3 { status = "okay"; }; +-&etr { status = "okay"; }; +-&funnel0 { status = "okay"; }; +-&funnel1 { status = "okay"; }; +-&replicator { status = "okay"; }; +-&stm { status = "okay"; }; +-&tpiu { status = "okay"; }; +- +-&smd_rpm_regulators { +- vdd_l1_l2_l3-supply = <&pm8916_s3>; +- vdd_l4_l5_l6-supply = <&pm8916_s4>; +- vdd_l7-supply = <&pm8916_s4>; +- +- s3 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1562000>; +- }; +- +- s4 { +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- +- regulator-always-on; +- regulator-boot-on; +- }; +- +- l1 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1525000>; +- }; +- +- l2 { +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <1200000>; +- }; +- +- l4 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l5 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l6 { +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- +- l7 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l8 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l9 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l10 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l11 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- regulator-allow-set-load; +- regulator-system-load = <200000>; +- }; +- +- l12 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l13 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l14 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- /** +- * 1.8v required on LS expansion +- * for mezzanine boards +- */ +- l15 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- regulator-always-on; +- }; +- +- l16 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l17 { +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- }; +- +- l18 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +-}; +- +-/* +- * 2mA drive strength is not enough when connecting multiple +- * I2C devices with different pull up resistors. +- */ +-&i2c2_default { +- drive-strength = <16>; +-}; +- +-&i2c4_default { +- drive-strength = <16>; +-}; +- +-&i2c6_default { +- drive-strength = <16>; +-}; +- +-/* +- * GPIO name legend: proper name = the GPIO line is used as GPIO +- * NC = not connected (pin out but not routed from the chip to +- * anything the board) +- * "[PER]" = pin is muxed for [peripheral] (not GPIO) +- * LSEC = Low Speed External Connector +- * HSEC = High Speed External Connector +- * +- * Line names are taken from the schematic "DragonBoard410c" +- * dated monday, august 31, 2015. Page 5 in particular. +- * +- * For the lines routed to the external connectors the +- * lines are named after the 96Boards CE Specification 1.0, +- * Appendix "Expansion Connector Signal Description". +- * +- * When the 96Board naming of a line and the schematic name of +- * the same line are in conflict, the 96Board specification +- * takes precedence, which means that the external UART on the +- * LSEC is named UART0 while the schematic and SoC names this +- * UART3. This is only for the informational lines i.e. "[FOO]", +- * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only +- * ones actually used for GPIO. +- */ +- +-&msmgpio { +- gpio-line-names = +- "[UART0_TX]", /* GPIO_0, LSEC pin 5 */ +- "[UART0_RX]", /* GPIO_1, LSEC pin 7 */ +- "[UART0_CTS_N]", /* GPIO_2, LSEC pin 3 */ +- "[UART0_RTS_N]", /* GPIO_3, LSEC pin 9 */ +- "[UART1_TX]", /* GPIO_4, LSEC pin 11 */ +- "[UART1_RX]", /* GPIO_5, LSEC pin 13 */ +- "[I2C0_SDA]", /* GPIO_8, LSEC pin 17 */ +- "[I2C0_SCL]", /* GPIO_7, LSEC pin 15 */ +- "[SPI1_DOUT]", /* SPI1_MOSI, HSEC pin 1 */ +- "[SPI1_DIN]", /* SPI1_MISO, HSEC pin 11 */ +- "[SPI1_CS]", /* SPI1_CS_N, HSEC pin 7 */ +- "[SPI1_SCLK]", /* SPI1_CLK, HSEC pin 9 */ +- "GPIO-B", /* LS_EXP_GPIO_B, LSEC pin 24 */ +- "GPIO-C", /* LS_EXP_GPIO_C, LSEC pin 25 */ +- "[I2C3_SDA]", /* HSEC pin 38 */ +- "[I2C3_SCL]", /* HSEC pin 36 */ +- "[SPI0_MOSI]", /* LSEC pin 14 */ +- "[SPI0_MISO]", /* LSEC pin 10 */ +- "[SPI0_CS_N]", /* LSEC pin 12 */ +- "[SPI0_CLK]", /* LSEC pin 8 */ +- "HDMI_HPD_N", /* GPIO 20 */ +- "USR_LED_1_CTRL", +- "[I2C1_SDA]", /* GPIO_22, LSEC pin 21 */ +- "[I2C1_SCL]", /* GPIO_23, LSEC pin 19 */ +- "GPIO-G", /* LS_EXP_GPIO_G, LSEC pin 29 */ +- "GPIO-H", /* LS_EXP_GPIO_H, LSEC pin 30 */ +- "[CSI0_MCLK]", /* HSEC pin 15 */ +- "[CSI1_MCLK]", /* HSEC pin 17 */ +- "GPIO-K", /* LS_EXP_GPIO_K, LSEC pin 33 */ +- "[I2C2_SDA]", /* HSEC pin 34 */ +- "[I2C2_SCL]", /* HSEC pin 32 */ +- "DSI2HDMI_INT_N", +- "DSI_SW_SEL_APQ", +- "GPIO-L", /* LS_EXP_GPIO_L, LSEC pin 34 */ +- "GPIO-J", /* LS_EXP_GPIO_J, LSEC pin 32 */ +- "GPIO-I", /* LS_EXP_GPIO_I, LSEC pin 31 */ +- "GPIO-A", /* LS_EXP_GPIO_A, LSEC pin 23 */ +- "FORCED_USB_BOOT", +- "SD_CARD_DET_N", +- "[WCSS_BT_SSBI]", +- "[WCSS_WLAN_DATA_2]", /* GPIO 40 */ +- "[WCSS_WLAN_DATA_1]", +- "[WCSS_WLAN_DATA_0]", +- "[WCSS_WLAN_SET]", +- "[WCSS_WLAN_CLK]", +- "[WCSS_FM_SSBI]", +- "[WCSS_FM_SDI]", +- "[WCSS_BT_DAT_CTL]", +- "[WCSS_BT_DAT_STB]", +- "NC", +- "NC", /* GPIO 50 */ +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 60 */ +- "NC", +- "NC", +- "[CDC_PDM0_CLK]", +- "[CDC_PDM0_SYNC]", +- "[CDC_PDM0_TX0]", +- "[CDC_PDM0_RX0]", +- "[CDC_PDM0_RX1]", +- "[CDC_PDM0_RX2]", +- "GPIO-D", /* LS_EXP_GPIO_D, LSEC pin 26 */ +- "NC", /* GPIO 70 */ +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 74 */ +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "BOOT_CONFIG_0", /* GPIO 80 */ +- "BOOT_CONFIG_1", +- "BOOT_CONFIG_2", +- "BOOT_CONFIG_3", +- "NC", +- "NC", +- "BOOT_CONFIG_5", +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 90 */ +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 100 */ +- "NC", +- "NC", +- "NC", +- "SSBI_GPS", +- "NC", +- "NC", +- "KEY_VOLP_N", +- "NC", +- "NC", +- "[LS_EXP_MI2S_WS]", /* GPIO 110 */ +- "NC", +- "NC", +- "[LS_EXP_MI2S_SCK]", +- "[LS_EXP_MI2S_DATA0]", +- "GPIO-E", /* LS_EXP_GPIO_E, LSEC pin 27 */ +- "NC", +- "[DSI2HDMI_MI2S_WS]", +- "[DSI2HDMI_MI2S_SCK]", +- "[DSI2HDMI_MI2S_DATA0]", +- "USR_LED_2_CTRL", /* GPIO 120 */ +- "SB_HS_ID"; +- +- msmgpio_leds: msmgpio-leds { +- pins = "gpio21", "gpio120"; +- function = "gpio"; +- +- output-low; +- }; +- +- usb_id_default: usb-id-default { +- pins = "gpio121"; +- function = "gpio"; +- +- drive-strength = <8>; +- input-enable; +- bias-pull-up; +- }; +- +- adv7533_int_active: adv533-int-active { +- pins = "gpio31"; +- function = "gpio"; +- +- drive-strength = <16>; +- bias-disable; +- }; +- +- adv7533_int_suspend: adv7533-int-suspend { +- pins = "gpio31"; +- function = "gpio"; +- +- drive-strength = <2>; +- bias-disable; +- }; +- +- adv7533_switch_active: adv7533-switch-active { +- pins = "gpio32"; +- function = "gpio"; +- +- drive-strength = <16>; +- bias-disable; +- }; +- +- adv7533_switch_suspend: adv7533-switch-suspend { +- pins = "gpio32"; +- function = "gpio"; +- +- drive-strength = <2>; +- bias-disable; +- }; +- +- msm_key_volp_n_default: msm-key-volp-n-default { +- pins = "gpio107"; +- function = "gpio"; +- +- drive-strength = <8>; +- input-enable; +- bias-pull-up; +- }; +-}; +- +-&pm8916_gpios { +- gpio-line-names = +- "USR_LED_3_CTRL", +- "USR_LED_4_CTRL", +- "USB_HUB_RESET_N_PM", +- "USB_SW_SEL_PM"; +- +- usb_hub_reset_pm: usb-hub-reset-pm { +- pins = "gpio3"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- input-disable; +- output-high; +- }; +- +- usb_hub_reset_pm_device: usb-hub-reset-pm-device { +- pins = "gpio3"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- output-low; +- }; +- +- usb_sw_sel_pm: usb-sw-sel-pm { +- pins = "gpio4"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- power-source = ; +- input-disable; +- output-high; +- }; +- +- usb_sw_sel_pm_device: usb-sw-sel-pm-device { +- pins = "gpio4"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- power-source = ; +- input-disable; +- output-low; +- }; +- +- pm8916_gpios_leds: pm8916-gpios-leds { +- pins = "gpio1", "gpio2"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- output-low; +- }; +-}; +- +-&pm8916_mpps { +- gpio-line-names = +- "VDD_PX_BIAS", +- "WLAN_LED_CTRL", +- "BT_LED_CTRL", +- "GPIO-F"; /* LS_EXP_GPIO_F, LSEC pin 28 */ +- +- pinctrl-names = "default"; +- pinctrl-0 = <&ls_exp_gpio_f>; +- +- ls_exp_gpio_f: pm8916-mpp4-state { +- pins = "mpp4"; +- function = "digital"; +- +- output-low; +- power-source = ; // 1.8V +- }; +- +- pm8916_mpps_leds: pm8916-mpps-state { +- pins = "mpp2", "mpp3"; +- function = "digital"; +- +- output-low; +- }; +-}; +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +index 757afa27424dd..d01a512634cfe 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +@@ -5,9 +5,1077 @@ + + /dts-v1/; + +-#include "apq8096-db820c.dtsi" ++#include "msm8996.dtsi" ++#include "pm8994.dtsi" ++#include "pmi8994.dtsi" ++#include ++#include ++#include ++#include ++#include ++ ++/* ++ * GPIO name legend: proper name = the GPIO line is used as GPIO ++ * NC = not connected (pin out but not routed from the chip to ++ * anything the board) ++ * "[PER]" = pin is muxed for [peripheral] (not GPIO) ++ * LSEC = Low Speed External Connector ++ * P HSEC = Primary High Speed External Connector ++ * S HSEC = Secondary High Speed External Connector ++ * J14 = Camera Connector ++ * TP = Test Points ++ * ++ * Line names are taken from the schematic "DragonBoard 820c", ++ * drawing no: LM25-P2751-1 ++ * ++ * For the lines routed to the external connectors the ++ * lines are named after the 96Boards CE Specification 1.0, ++ * Appendix "Expansion Connector Signal Description". ++ * ++ * When the 96Board naming of a line and the schematic name of ++ * the same line are in conflict, the 96Board specification ++ * takes precedence, which means that the external UART on the ++ * LSEC is named UART0 while the schematic and SoC names this ++ * UART3. This is only for the informational lines i.e. "[FOO]", ++ * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only ++ * ones actually used for GPIO. ++ */ + + / { + model = "Qualcomm Technologies, Inc. DB820c"; + compatible = "arrow,apq8096-db820c", "qcom,apq8096-sbc", "qcom,apq8096"; ++ ++ aliases { ++ serial0 = &blsp2_uart2; ++ serial1 = &blsp2_uart3; ++ serial2 = &blsp1_uart2; ++ i2c0 = &blsp1_i2c3; ++ i2c1 = &blsp2_i2c1; ++ i2c2 = &blsp2_i2c1; ++ spi0 = &blsp1_spi1; ++ spi1 = &blsp2_spi6; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; ++ }; ++ ++ clocks { ++ compatible = "simple-bus"; ++ divclk4: divclk4 { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <32768>; ++ clock-output-names = "divclk4"; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&divclk4_pin_a>; ++ }; ++ ++ div1_mclk: divclk1 { ++ compatible = "gpio-gate-clock"; ++ pinctrl-0 = <&audio_mclk>; ++ pinctrl-names = "default"; ++ clocks = <&rpmcc RPM_SMD_DIV_CLK1>; ++ #clock-cells = <0>; ++ enable-gpios = <&pm8994_gpios 15 0>; ++ }; ++ }; ++ ++ gpio_keys { ++ compatible = "gpio-keys"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ autorepeat; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&volume_up_gpio>; ++ ++ button@0 { ++ label = "Volume Up"; ++ linux,code = ; ++ gpios = <&pm8994_gpios 2 GPIO_ACTIVE_LOW>; ++ }; ++ }; ++ ++ usb2_id: usb2-id { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&pmi8994_gpios 6 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb2_vbus_det_gpio>; ++ }; ++ ++ usb3_id: usb3-id { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&pm8994_gpios 22 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_vbus_det_gpio>; ++ }; ++ ++ vph_pwr: vph-pwr-regulator { ++ compatible = "regulator-fixed"; ++ regulator-name = "vph_pwr"; ++ regulator-always-on; ++ regulator-boot-on; ++ ++ regulator-min-microvolt = <3700000>; ++ regulator-max-microvolt = <3700000>; ++ }; ++ ++ wlan_en: wlan-en-1-8v { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&wlan_en_gpios>; ++ compatible = "regulator-fixed"; ++ regulator-name = "wlan-en-regulator"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ ++ gpio = <&pm8994_gpios 8 0>; ++ ++ /* WLAN card specific delay */ ++ startup-delay-us = <70000>; ++ enable-active-high; ++ }; ++}; ++ ++&blsp1_i2c3 { ++ /* On Low speed expansion */ ++ label = "LS-I2C0"; ++ status = "okay"; ++}; ++ ++&blsp1_spi1 { ++ /* On Low speed expansion */ ++ label = "LS-SPI0"; ++ status = "okay"; ++}; ++ ++&blsp1_uart2 { ++ label = "BT-UART"; ++ status = "okay"; ++ ++ bluetooth { ++ compatible = "qcom,qca6174-bt"; ++ ++ /* bt_disable_n gpio */ ++ enable-gpios = <&pm8994_gpios 19 GPIO_ACTIVE_HIGH>; ++ ++ clocks = <&divclk4>; ++ }; ++}; ++ ++&adsp_pil { ++ status = "okay"; ++}; ++ ++&blsp2_i2c1 { ++ /* On High speed expansion */ ++ label = "HS-I2C2"; ++ status = "okay"; ++}; ++ ++&blsp2_i2c1 { ++ /* On Low speed expansion */ ++ label = "LS-I2C1"; ++ status = "okay"; ++}; ++ ++&blsp2_spi6 { ++ /* On High speed expansion */ ++ label = "HS-SPI1"; ++ status = "okay"; ++}; ++ ++&blsp2_uart2 { ++ label = "LS-UART1"; ++ status = "okay"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&blsp2_uart2_2pins_default>; ++ pinctrl-1 = <&blsp2_uart2_2pins_sleep>; ++}; ++ ++&blsp2_uart3 { ++ label = "LS-UART0"; ++ status = "disabled"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&blsp2_uart3_4pins_default>; ++ pinctrl-1 = <&blsp2_uart3_4pins_sleep>; ++}; ++ ++&camss { ++ vdda-supply = <&vreg_l2a_1p25>; ++}; ++ ++&gpu { ++ status = "okay"; ++}; ++ ++&hdmi { ++ status = "okay"; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&hdmi_hpd_active &hdmi_ddc_active>; ++ pinctrl-1 = <&hdmi_hpd_suspend &hdmi_ddc_suspend>; ++ ++ core-vdda-supply = <&vreg_l12a_1p8>; ++ core-vcc-supply = <&vreg_s4a_1p8>; ++}; ++ ++&hdmi_phy { ++ status = "okay"; ++ ++ vddio-supply = <&vreg_l12a_1p8>; ++ vcca-supply = <&vreg_l28a_0p925>; ++ #phy-cells = <0>; ++}; ++ ++&hsusb_phy1 { ++ status = "okay"; ++ ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; ++}; ++ ++&hsusb_phy2 { ++ status = "okay"; ++ ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; ++}; ++ ++&mdp { ++ status = "okay"; ++}; ++ ++&mdss { ++ status = "okay"; ++}; ++ ++&mmcc { ++ vdd-gfx-supply = <&vdd_gfx>; ++}; ++ ++&pm8994_resin { ++ status = "okay"; ++ linux,code = ; ++}; ++ ++&tlmm { ++ gpio-line-names = ++ "[SPI0_DOUT]", /* GPIO_0, BLSP1_SPI_MOSI, LSEC pin 14 */ ++ "[SPI0_DIN]", /* GPIO_1, BLSP1_SPI_MISO, LSEC pin 10 */ ++ "[SPI0_CS]", /* GPIO_2, BLSP1_SPI_CS_N, LSEC pin 12 */ ++ "[SPI0_SCLK]", /* GPIO_3, BLSP1_SPI_CLK, LSEC pin 8 */ ++ "[UART1_TxD]", /* GPIO_4, BLSP8_UART_TX, LSEC pin 11 */ ++ "[UART1_RxD]", /* GPIO_5, BLSP8_UART_RX, LSEC pin 13 */ ++ "[I2C1_SDA]", /* GPIO_6, BLSP8_I2C_SDA, LSEC pin 21 */ ++ "[I2C1_SCL]", /* GPIO_7, BLSP8_I2C_SCL, LSEC pin 19 */ ++ "GPIO-H", /* GPIO_8, LCD0_RESET_N, LSEC pin 30 */ ++ "TP93", /* GPIO_9 */ ++ "GPIO-G", /* GPIO_10, MDP_VSYNC_P, LSEC pin 29 */ ++ "[MDP_VSYNC_S]", /* GPIO_11, S HSEC pin 55 */ ++ "NC", /* GPIO_12 */ ++ "[CSI0_MCLK]", /* GPIO_13, CAM_MCLK0, P HSEC pin 15 */ ++ "[CAM_MCLK1]", /* GPIO_14, J14 pin 11 */ ++ "[CSI1_MCLK]", /* GPIO_15, CAM_MCLK2, P HSEC pin 17 */ ++ "TP99", /* GPIO_16 */ ++ "[I2C2_SDA]", /* GPIO_17, CCI_I2C_SDA0, P HSEC pin 34 */ ++ "[I2C2_SCL]", /* GPIO_18, CCI_I2C_SCL0, P HSEC pin 32 */ ++ "[CCI_I2C_SDA1]", /* GPIO_19, S HSEC pin 38 */ ++ "[CCI_I2C_SCL1]", /* GPIO_20, S HSEC pin 36 */ ++ "FLASH_STROBE_EN", /* GPIO_21, S HSEC pin 5 */ ++ "FLASH_STROBE_TRIG", /* GPIO_22, S HSEC pin 1 */ ++ "GPIO-K", /* GPIO_23, CAM2_RST_N, LSEC pin 33 */ ++ "GPIO-D", /* GPIO_24, LSEC pin 26 */ ++ "GPIO-I", /* GPIO_25, CAM0_RST_N, LSEC pin 31 */ ++ "GPIO-J", /* GPIO_26, CAM0_STANDBY_N, LSEC pin 32 */ ++ "BLSP6_I2C_SDA", /* GPIO_27 */ ++ "BLSP6_I2C_SCL", /* GPIO_28 */ ++ "GPIO-B", /* GPIO_29, TS0_RESET_N, LSEC pin 24 */ ++ "GPIO30", /* GPIO_30, S HSEC pin 4 */ ++ "HDMI_CEC", /* GPIO_31 */ ++ "HDMI_DDC_CLOCK", /* GPIO_32 */ ++ "HDMI_DDC_DATA", /* GPIO_33 */ ++ "HDMI_HOT_PLUG_DETECT", /* GPIO_34 */ ++ "PCIE0_RST_N", /* GPIO_35 */ ++ "PCIE0_CLKREQ_N", /* GPIO_36 */ ++ "PCIE0_WAKE", /* GPIO_37 */ ++ "SD_CARD_DET_N", /* GPIO_38 */ ++ "TSIF1_SYNC", /* GPIO_39, S HSEC pin 48 */ ++ "W_DISABLE_N", /* GPIO_40 */ ++ "[BLSP9_UART_TX]", /* GPIO_41 */ ++ "[BLSP9_UART_RX]", /* GPIO_42 */ ++ "[BLSP2_UART_CTS_N]", /* GPIO_43 */ ++ "[BLSP2_UART_RFR_N]", /* GPIO_44 */ ++ "[BLSP3_UART_TX]", /* GPIO_45 */ ++ "[BLSP3_UART_RX]", /* GPIO_46 */ ++ "[I2C0_SDA]", /* GPIO_47, LS_I2C0_SDA, LSEC pin 17 */ ++ "[I2C0_SCL]", /* GPIO_48, LS_I2C0_SCL, LSEC pin 15 */ ++ "[UART0_TxD]", /* GPIO_49, BLSP9_UART_TX, LSEC pin 5 */ ++ "[UART0_RxD]", /* GPIO_50, BLSP9_UART_RX, LSEC pin 7 */ ++ "[UART0_CTS]", /* GPIO_51, BLSP9_UART_CTS_N, LSEC pin 3 */ ++ "[UART0_RTS]", /* GPIO_52, BLSP9_UART_RFR_N, LSEC pin 9 */ ++ "[CODEC_INT1_N]", /* GPIO_53 */ ++ "[CODEC_INT2_N]", /* GPIO_54 */ ++ "[BLSP7_I2C_SDA]", /* GPIO_55 */ ++ "[BLSP7_I2C_SCL]", /* GPIO_56 */ ++ "MI2S_MCLK", /* GPIO_57, S HSEC pin 3 */ ++ "[PCM_CLK]", /* GPIO_58, QUA_MI2S_SCK, LSEC pin 18 */ ++ "[PCM_FS]", /* GPIO_59, QUA_MI2S_WS, LSEC pin 16 */ ++ "[PCM_DO]", /* GPIO_60, QUA_MI2S_DATA0, LSEC pin 20 */ ++ "[PCM_DI]", /* GPIO_61, QUA_MI2S_DATA1, LSEC pin 22 */ ++ "GPIO-E", /* GPIO_62, LSEC pin 27 */ ++ "TP87", /* GPIO_63 */ ++ "[CODEC_RST_N]", /* GPIO_64 */ ++ "[PCM1_CLK]", /* GPIO_65 */ ++ "[PCM1_SYNC]", /* GPIO_66 */ ++ "[PCM1_DIN]", /* GPIO_67 */ ++ "[PCM1_DOUT]", /* GPIO_68 */ ++ "AUDIO_REF_CLK", /* GPIO_69 */ ++ "SLIMBUS_CLK", /* GPIO_70 */ ++ "SLIMBUS_DATA0", /* GPIO_71 */ ++ "SLIMBUS_DATA1", /* GPIO_72 */ ++ "NC", /* GPIO_73 */ ++ "NC", /* GPIO_74 */ ++ "NC", /* GPIO_75 */ ++ "NC", /* GPIO_76 */ ++ "TP94", /* GPIO_77 */ ++ "NC", /* GPIO_78 */ ++ "TP95", /* GPIO_79 */ ++ "GPIO-A", /* GPIO_80, MEMS_RESET_N, LSEC pin 23 */ ++ "TP88", /* GPIO_81 */ ++ "TP89", /* GPIO_82 */ ++ "TP90", /* GPIO_83 */ ++ "TP91", /* GPIO_84 */ ++ "[SD_DAT0]", /* GPIO_85, BLSP12_SPI_MOSI, P HSEC pin 1 */ ++ "[SD_CMD]", /* GPIO_86, BLSP12_SPI_MISO, P HSEC pin 11 */ ++ "[SD_DAT3]", /* GPIO_87, BLSP12_SPI_CS_N, P HSEC pin 7 */ ++ "[SD_SCLK]", /* GPIO_88, BLSP12_SPI_CLK, P HSEC pin 9 */ ++ "TSIF1_CLK", /* GPIO_89, S HSEC pin 42 */ ++ "TSIF1_EN", /* GPIO_90, S HSEC pin 46 */ ++ "TSIF1_DATA", /* GPIO_91, S HSEC pin 44 */ ++ "NC", /* GPIO_92 */ ++ "TSIF2_CLK", /* GPIO_93, S HSEC pin 52 */ ++ "TSIF2_EN", /* GPIO_94, S HSEC pin 56 */ ++ "TSIF2_DATA", /* GPIO_95, S HSEC pin 54 */ ++ "TSIF2_SYNC", /* GPIO_96, S HSEC pin 58 */ ++ "NC", /* GPIO_97 */ ++ "CAM1_STANDBY_N", /* GPIO_98 */ ++ "NC", /* GPIO_99 */ ++ "NC", /* GPIO_100 */ ++ "[LCD1_RESET_N]", /* GPIO_101, S HSEC pin 51 */ ++ "BOOT_CONFIG1", /* GPIO_102 */ ++ "USB_HUB_RESET", /* GPIO_103 */ ++ "CAM1_RST_N", /* GPIO_104 */ ++ "NC", /* GPIO_105 */ ++ "NC", /* GPIO_106 */ ++ "NC", /* GPIO_107 */ ++ "NC", /* GPIO_108 */ ++ "NC", /* GPIO_109 */ ++ "NC", /* GPIO_110 */ ++ "NC", /* GPIO_111 */ ++ "NC", /* GPIO_112 */ ++ "PMI8994_BUA", /* GPIO_113 */ ++ "PCIE2_RST_N", /* GPIO_114 */ ++ "PCIE2_CLKREQ_N", /* GPIO_115 */ ++ "PCIE2_WAKE", /* GPIO_116 */ ++ "SSC_IRQ_0", /* GPIO_117 */ ++ "SSC_IRQ_1", /* GPIO_118 */ ++ "SSC_IRQ_2", /* GPIO_119 */ ++ "NC", /* GPIO_120 */ ++ "GPIO121", /* GPIO_121, S HSEC pin 2 */ ++ "NC", /* GPIO_122 */ ++ "SSC_IRQ_6", /* GPIO_123 */ ++ "SSC_IRQ_7", /* GPIO_124 */ ++ "GPIO-C", /* GPIO_125, TS_INT0, LSEC pin 25 */ ++ "BOOT_CONFIG5", /* GPIO_126 */ ++ "NC", /* GPIO_127 */ ++ "NC", /* GPIO_128 */ ++ "BOOT_CONFIG7", /* GPIO_129 */ ++ "PCIE1_RST_N", /* GPIO_130 */ ++ "PCIE1_CLKREQ_N", /* GPIO_131 */ ++ "PCIE1_WAKE", /* GPIO_132 */ ++ "GPIO-L", /* GPIO_133, CAM2_STANDBY_N, LSEC pin 34 */ ++ "NC", /* GPIO_134 */ ++ "NC", /* GPIO_135 */ ++ "BOOT_CONFIG8", /* GPIO_136 */ ++ "NC", /* GPIO_137 */ ++ "NC", /* GPIO_138 */ ++ "GPS_SSBI2", /* GPIO_139 */ ++ "GPS_SSBI1", /* GPIO_140 */ ++ "NC", /* GPIO_141 */ ++ "NC", /* GPIO_142 */ ++ "NC", /* GPIO_143 */ ++ "BOOT_CONFIG6", /* GPIO_144 */ ++ "NC", /* GPIO_145 */ ++ "NC", /* GPIO_146 */ ++ "NC", /* GPIO_147 */ ++ "NC", /* GPIO_148 */ ++ "NC"; /* GPIO_149 */ ++ ++ sdc2_cd_on: sdc2_cd_on { ++ mux { ++ pins = "gpio38"; ++ function = "gpio"; ++ }; ++ ++ config { ++ pins = "gpio38"; ++ bias-pull-up; /* pull up */ ++ drive-strength = <16>; /* 16 MA */ ++ }; ++ }; ++ ++ sdc2_cd_off: sdc2_cd_off { ++ mux { ++ pins = "gpio38"; ++ function = "gpio"; ++ }; ++ ++ config { ++ pins = "gpio38"; ++ bias-pull-up; /* pull up */ ++ drive-strength = <2>; /* 2 MA */ ++ }; ++ }; ++ ++ hdmi_hpd_active: hdmi_hpd_active { ++ mux { ++ pins = "gpio34"; ++ function = "hdmi_hot"; ++ }; ++ ++ config { ++ pins = "gpio34"; ++ bias-pull-down; ++ drive-strength = <16>; ++ }; ++ }; ++ ++ hdmi_hpd_suspend: hdmi_hpd_suspend { ++ mux { ++ pins = "gpio34"; ++ function = "hdmi_hot"; ++ }; ++ ++ config { ++ pins = "gpio34"; ++ bias-pull-down; ++ drive-strength = <2>; ++ }; ++ }; ++ ++ hdmi_ddc_active: hdmi_ddc_active { ++ mux { ++ pins = "gpio32", "gpio33"; ++ function = "hdmi_ddc"; ++ }; ++ ++ config { ++ pins = "gpio32", "gpio33"; ++ drive-strength = <2>; ++ bias-pull-up; ++ }; ++ }; ++ ++ hdmi_ddc_suspend: hdmi_ddc_suspend { ++ mux { ++ pins = "gpio32", "gpio33"; ++ function = "hdmi_ddc"; ++ }; ++ ++ config { ++ pins = "gpio32", "gpio33"; ++ drive-strength = <2>; ++ bias-pull-down; ++ }; ++ }; ++}; ++ ++&pcie0 { ++ status = "okay"; ++ perst-gpio = <&tlmm 35 GPIO_ACTIVE_LOW>; ++ vddpe-3v3-supply = <&wlan_en>; ++ vdda-supply = <&vreg_l28a_0p925>; ++}; ++ ++&pcie1 { ++ status = "okay"; ++ perst-gpio = <&tlmm 130 GPIO_ACTIVE_LOW>; ++ vdda-supply = <&vreg_l28a_0p925>; ++}; ++ ++&pcie2 { ++ status = "okay"; ++ perst-gpio = <&tlmm 114 GPIO_ACTIVE_LOW>; ++ vdda-supply = <&vreg_l28a_0p925>; ++}; ++ ++&pcie_phy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l28a_0p925>; ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++}; ++ ++&pm8994_gpios { ++ gpio-line-names = ++ "NC", ++ "KEY_VOLP_N", ++ "NC", ++ "BL1_PWM", ++ "GPIO-F", /* BL0_PWM, LSEC pin 28 */ ++ "BL1_EN", ++ "NC", ++ "WLAN_EN", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "DIVCLK1", ++ "DIVCLK2", ++ "DIVCLK3", ++ "DIVCLK4", ++ "BT_EN", ++ "PMIC_SLB", ++ "PMIC_BUA", ++ "USB_VBUS_DET"; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ls_exp_gpio_f &bt_en_gpios>; ++ ++ ls_exp_gpio_f: pm8994_gpio5 { ++ pinconf { ++ pins = "gpio5"; ++ output-low; ++ power-source = <2>; // PM8994_GPIO_S4, 1.8V ++ }; ++ }; ++ ++ bt_en_gpios: bt_en_gpios { ++ pinconf { ++ pins = "gpio19"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ output-low; ++ power-source = ; // 1.8V ++ qcom,drive-strength = ; ++ bias-pull-down; ++ }; ++ }; ++ ++ wlan_en_gpios: wlan_en_gpios { ++ pinconf { ++ pins = "gpio8"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ output-low; ++ power-source = ; // 1.8V ++ qcom,drive-strength = ; ++ bias-pull-down; ++ }; ++ }; ++ ++ audio_mclk: clk_div1 { ++ pinconf { ++ pins = "gpio15"; ++ function = "func1"; ++ power-source = ; // 1.8V ++ }; ++ }; ++ ++ volume_up_gpio: pm8996_gpio2 { ++ pinconf { ++ pins = "gpio2"; ++ function = "normal"; ++ input-enable; ++ drive-push-pull; ++ bias-pull-up; ++ qcom,drive-strength = ; ++ power-source = ; // 1.8V ++ }; ++ }; ++ ++ divclk4_pin_a: divclk4 { ++ pinconf { ++ pins = "gpio18"; ++ function = PMIC_GPIO_FUNC_FUNC2; ++ ++ bias-disable; ++ power-source = ; ++ }; ++ }; ++ ++ usb3_vbus_det_gpio: pm8996_gpio22 { ++ pinconf { ++ pins = "gpio22"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ input-enable; ++ bias-pull-down; ++ qcom,drive-strength = ; ++ power-source = ; // 1.8V ++ }; ++ }; ++}; ++ ++&pm8994_mpps { ++ gpio-line-names = ++ "VDDPX_BIAS", ++ "WIFI_LED", ++ "NC", ++ "BT_LED", ++ "PM_MPP05", ++ "PM_MPP06", ++ "PM_MPP07", ++ "NC"; ++}; ++ ++&pm8994_spmi_regulators { ++ qcom,saw-reg = <&saw3>; ++ s9 { ++ qcom,saw-slave; ++ }; ++ s10 { ++ qcom,saw-slave; ++ }; ++ s11 { ++ qcom,saw-leader; ++ regulator-always-on; ++ regulator-min-microvolt = <980000>; ++ regulator-max-microvolt = <980000>; ++ }; ++}; ++ ++&pmi8994_gpios { ++ gpio-line-names = ++ "NC", ++ "SPKR_AMP_EN1", ++ "SPKR_AMP_EN2", ++ "TP61", ++ "NC", ++ "USB2_VBUS_DET", ++ "NC", ++ "NC", ++ "NC", ++ "NC"; ++ ++ usb2_vbus_det_gpio: pmi8996_gpio6 { ++ pinconf { ++ pins = "gpio6"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ input-enable; ++ bias-pull-down; ++ qcom,drive-strength = ; ++ power-source = ; // 1.8V ++ }; ++ }; ++}; ++ ++&pmi8994_spmi_regulators { ++ vdd_gfx: s2@1700 { ++ reg = <0x1700 0x100>; ++ regulator-name = "VDD_GFX"; ++ regulator-min-microvolt = <980000>; ++ regulator-max-microvolt = <980000>; ++ }; ++}; ++ ++&rpm_requests { ++ pm8994-regulators { ++ compatible = "qcom,rpm-pm8994-regulators"; ++ ++ vdd_s1-supply = <&vph_pwr>; ++ vdd_s2-supply = <&vph_pwr>; ++ vdd_s3-supply = <&vph_pwr>; ++ vdd_s4-supply = <&vph_pwr>; ++ vdd_s5-supply = <&vph_pwr>; ++ vdd_s6-supply = <&vph_pwr>; ++ vdd_s7-supply = <&vph_pwr>; ++ vdd_s8-supply = <&vph_pwr>; ++ vdd_s9-supply = <&vph_pwr>; ++ vdd_s10-supply = <&vph_pwr>; ++ vdd_s11-supply = <&vph_pwr>; ++ vdd_s12-supply = <&vph_pwr>; ++ vdd_l1-supply = <&vreg_s1b_1p025>; ++ vdd_l2_l26_l28-supply = <&vreg_s3a_1p3>; ++ vdd_l3_l11-supply = <&vreg_s3a_1p3>; ++ vdd_l4_l27_l31-supply = <&vreg_s3a_1p3>; ++ vdd_l5_l7-supply = <&vreg_s5a_2p15>; ++ vdd_l6_l12_l32-supply = <&vreg_s5a_2p15>; ++ vdd_l8_l16_l30-supply = <&vph_pwr>; ++ vdd_l9_l10_l18_l22-supply = <&vph_pwr_bbyp>; ++ vdd_l13_l19_l23_l24-supply = <&vph_pwr_bbyp>; ++ vdd_l14_l15-supply = <&vreg_s5a_2p15>; ++ vdd_l17_l29-supply = <&vph_pwr_bbyp>; ++ vdd_l20_l21-supply = <&vph_pwr_bbyp>; ++ vdd_l25-supply = <&vreg_s3a_1p3>; ++ vdd_lvs1_lvs2-supply = <&vreg_s4a_1p8>; ++ ++ vreg_s3a_1p3: s3 { ++ regulator-name = "vreg_s3a_1p3"; ++ regulator-min-microvolt = <1300000>; ++ regulator-max-microvolt = <1300000>; ++ }; ++ ++ /** ++ * 1.8v required on LS expansion ++ * for mezzanine boards ++ */ ++ vreg_s4a_1p8: s4 { ++ regulator-name = "vreg_s4a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-always-on; ++ }; ++ vreg_s5a_2p15: s5 { ++ regulator-name = "vreg_s5a_2p15"; ++ regulator-min-microvolt = <2150000>; ++ regulator-max-microvolt = <2150000>; ++ }; ++ vreg_s7a_1p0: s7 { ++ regulator-name = "vreg_s7a_1p0"; ++ regulator-min-microvolt = <800000>; ++ regulator-max-microvolt = <800000>; ++ }; ++ ++ vreg_l1a_1p0: l1 { ++ regulator-name = "vreg_l1a_1p0"; ++ regulator-min-microvolt = <1000000>; ++ regulator-max-microvolt = <1000000>; ++ }; ++ vreg_l2a_1p25: l2 { ++ regulator-name = "vreg_l2a_1p25"; ++ regulator-min-microvolt = <1250000>; ++ regulator-max-microvolt = <1250000>; ++ }; ++ vreg_l3a_0p875: l3 { ++ regulator-name = "vreg_l3a_0p875"; ++ regulator-min-microvolt = <850000>; ++ regulator-max-microvolt = <850000>; ++ }; ++ vreg_l4a_1p225: l4 { ++ regulator-name = "vreg_l4a_1p225"; ++ regulator-min-microvolt = <1225000>; ++ regulator-max-microvolt = <1225000>; ++ }; ++ vreg_l6a_1p2: l6 { ++ regulator-name = "vreg_l6a_1p2"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ vreg_l8a_1p8: l8 { ++ regulator-name = "vreg_l8a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l9a_1p8: l9 { ++ regulator-name = "vreg_l9a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l10a_1p8: l10 { ++ regulator-name = "vreg_l10a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l11a_1p15: l11 { ++ regulator-name = "vreg_l11a_1p15"; ++ regulator-min-microvolt = <1150000>; ++ regulator-max-microvolt = <1150000>; ++ }; ++ vreg_l12a_1p8: l12 { ++ regulator-name = "vreg_l12a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l13a_2p95: l13 { ++ regulator-name = "vreg_l13a_2p95"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <2950000>; ++ }; ++ vreg_l14a_1p8: l14 { ++ regulator-name = "vreg_l14a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l15a_1p8: l15 { ++ regulator-name = "vreg_l15a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l16a_2p7: l16 { ++ regulator-name = "vreg_l16a_2p7"; ++ regulator-min-microvolt = <2700000>; ++ regulator-max-microvolt = <2700000>; ++ }; ++ vreg_l17a_2p8: l17 { ++ regulator-name = "vreg_l17a_2p8"; ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ }; ++ vreg_l18a_2p85: l18 { ++ regulator-name = "vreg_l18a_2p85"; ++ regulator-min-microvolt = <2700000>; ++ regulator-max-microvolt = <2900000>; ++ }; ++ vreg_l19a_2p8: l19 { ++ regulator-name = "vreg_l19a_2p8"; ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ }; ++ vreg_l20a_2p95: l20 { ++ regulator-name = "vreg_l20a_2p95"; ++ regulator-min-microvolt = <2950000>; ++ regulator-max-microvolt = <2950000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l21a_2p95: l21 { ++ regulator-name = "vreg_l21a_2p95"; ++ regulator-min-microvolt = <2950000>; ++ regulator-max-microvolt = <2950000>; ++ regulator-allow-set-load; ++ regulator-system-load = <200000>; ++ }; ++ vreg_l22a_3p0: l22 { ++ regulator-name = "vreg_l22a_3p0"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ vreg_l23a_2p8: l23 { ++ regulator-name = "vreg_l23a_2p8"; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ }; ++ vreg_l24a_3p075: l24 { ++ regulator-name = "vreg_l24a_3p075"; ++ regulator-min-microvolt = <3075000>; ++ regulator-max-microvolt = <3075000>; ++ }; ++ vreg_l25a_1p2: l25 { ++ regulator-name = "vreg_l25a_1p2"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l26a_0p8: l27 { ++ regulator-name = "vreg_l26a_0p8"; ++ regulator-min-microvolt = <1000000>; ++ regulator-max-microvolt = <1000000>; ++ }; ++ vreg_l28a_0p925: l28 { ++ regulator-name = "vreg_l28a_0p925"; ++ regulator-min-microvolt = <925000>; ++ regulator-max-microvolt = <925000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l29a_2p8: l29 { ++ regulator-name = "vreg_l29a_2p8"; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ }; ++ vreg_l30a_1p8: l30 { ++ regulator-name = "vreg_l30a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l32a_1p8: l32 { ++ regulator-name = "vreg_l32a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ vreg_lvs1a_1p8: lvs1 { ++ regulator-name = "vreg_lvs1a_1p8"; ++ }; ++ ++ vreg_lvs2a_1p8: lvs2 { ++ regulator-name = "vreg_lvs2a_1p8"; ++ }; ++ }; ++ ++ pmi8994-regulators { ++ compatible = "qcom,rpm-pmi8994-regulators"; ++ ++ vdd_s1-supply = <&vph_pwr>; ++ vdd_s2-supply = <&vph_pwr>; ++ vdd_s3-supply = <&vph_pwr>; ++ vdd_bst_byp-supply = <&vph_pwr>; ++ ++ vph_pwr_bbyp: boost-bypass { ++ regulator-name = "vph_pwr_bbyp"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ ++ vreg_s1b_1p025: s1 { ++ regulator-name = "vreg_s1b_1p025"; ++ regulator-min-microvolt = <1025000>; ++ regulator-max-microvolt = <1025000>; ++ }; ++ }; ++}; ++ ++&sdhc2 { ++ /* External SD card */ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc2_state_on &sdc2_cd_on>; ++ pinctrl-1 = <&sdc2_state_off &sdc2_cd_off>; ++ cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>; ++ vmmc-supply = <&vreg_l21a_2p95>; ++ vqmmc-supply = <&vreg_l13a_2p95>; ++ status = "okay"; ++}; ++ ++&q6asmdai { ++ dai@0 { ++ reg = <0>; ++ }; ++ ++ dai@1 { ++ reg = <1>; ++ }; ++ ++ dai@2 { ++ reg = <2>; ++ }; ++}; ++ ++&sound { ++ compatible = "qcom,apq8096-sndcard"; ++ model = "DB820c"; ++ audio-routing = "RX_BIAS", "MCLK", ++ "MM_DL1", "MultiMedia1 Playback", ++ "MM_DL2", "MultiMedia2 Playback", ++ "MultiMedia3 Capture", "MM_UL3"; ++ ++ mm1-dai-link { ++ link-name = "MultiMedia1"; ++ cpu { ++ sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA1>; ++ }; ++ }; ++ ++ mm2-dai-link { ++ link-name = "MultiMedia2"; ++ cpu { ++ sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA2>; ++ }; ++ }; ++ ++ mm3-dai-link { ++ link-name = "MultiMedia3"; ++ cpu { ++ sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA3>; ++ }; ++ }; ++ ++ hdmi-dai-link { ++ link-name = "HDMI"; ++ cpu { ++ sound-dai = <&q6afedai HDMI_RX>; ++ }; ++ ++ platform { ++ sound-dai = <&q6routing>; ++ }; ++ ++ codec { ++ sound-dai = <&hdmi 0>; ++ }; ++ }; ++ ++ slim-dai-link { ++ link-name = "SLIM Playback"; ++ cpu { ++ sound-dai = <&q6afedai SLIMBUS_6_RX>; ++ }; ++ ++ platform { ++ sound-dai = <&q6routing>; ++ }; ++ ++ codec { ++ sound-dai = <&wcd9335 6>; ++ }; ++ }; ++ ++ slimcap-dai-link { ++ link-name = "SLIM Capture"; ++ cpu { ++ sound-dai = <&q6afedai SLIMBUS_0_TX>; ++ }; ++ ++ platform { ++ sound-dai = <&q6routing>; ++ }; ++ ++ codec { ++ sound-dai = <&wcd9335 1>; ++ }; ++ }; ++}; ++ ++&ufsphy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l28a_0p925>; ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vddp-ref-clk-supply = <&vreg_l25a_1p2>; ++}; ++ ++&ufshc { ++ status = "okay"; ++ ++ vcc-supply = <&vreg_l20a_2p95>; ++ vccq-supply = <&vreg_l25a_1p2>; ++ vccq2-supply = <&vreg_s4a_1p8>; ++ ++ vcc-max-microamp = <600000>; ++ vccq-max-microamp = <450000>; ++ vccq2-max-microamp = <450000>; ++}; ++ ++&usb2 { ++ status = "okay"; ++ extcon = <&usb2_id>; ++ ++ dwc3@7600000 { ++ extcon = <&usb2_id>; ++ dr_mode = "otg"; ++ maximum-speed = "high-speed"; ++ }; ++}; ++ ++&usb3 { ++ status = "okay"; ++ extcon = <&usb3_id>; ++ ++ dwc3@6a00000 { ++ extcon = <&usb3_id>; ++ dr_mode = "otg"; ++ }; ++}; ++ ++&usb3phy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l28a_0p925>; ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ ++}; ++ ++&venus { ++ status = "okay"; ++}; ++ ++&wcd9335 { ++ clock-names = "mclk", "slimbus"; ++ clocks = <&div1_mclk>, ++ <&rpmcc RPM_SMD_BB_CLK1>; ++ ++ vdd-buck-supply = <&vreg_s4a_1p8>; ++ vdd-buck-sido-supply = <&vreg_s4a_1p8>; ++ vdd-tx-supply = <&vreg_s4a_1p8>; ++ vdd-rx-supply = <&vreg_s4a_1p8>; ++ vdd-io-supply = <&vreg_s4a_1p8>; + }; +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +deleted file mode 100644 +index eca428ab2517a..0000000000000 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ /dev/null +@@ -1,1076 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8996.dtsi" +-#include "pm8994.dtsi" +-#include "pmi8994.dtsi" +-#include +-#include +-#include +-#include +-#include +- +-/* +- * GPIO name legend: proper name = the GPIO line is used as GPIO +- * NC = not connected (pin out but not routed from the chip to +- * anything the board) +- * "[PER]" = pin is muxed for [peripheral] (not GPIO) +- * LSEC = Low Speed External Connector +- * P HSEC = Primary High Speed External Connector +- * S HSEC = Secondary High Speed External Connector +- * J14 = Camera Connector +- * TP = Test Points +- * +- * Line names are taken from the schematic "DragonBoard 820c", +- * drawing no: LM25-P2751-1 +- * +- * For the lines routed to the external connectors the +- * lines are named after the 96Boards CE Specification 1.0, +- * Appendix "Expansion Connector Signal Description". +- * +- * When the 96Board naming of a line and the schematic name of +- * the same line are in conflict, the 96Board specification +- * takes precedence, which means that the external UART on the +- * LSEC is named UART0 while the schematic and SoC names this +- * UART3. This is only for the informational lines i.e. "[FOO]", +- * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only +- * ones actually used for GPIO. +- */ +- +-/ { +- aliases { +- serial0 = &blsp2_uart2; +- serial1 = &blsp2_uart3; +- serial2 = &blsp1_uart2; +- i2c0 = &blsp1_i2c3; +- i2c1 = &blsp2_i2c1; +- i2c2 = &blsp2_i2c1; +- spi0 = &blsp1_spi1; +- spi1 = &blsp2_spi6; +- }; +- +- chosen { +- stdout-path = "serial0:115200n8"; +- }; +- +- clocks { +- compatible = "simple-bus"; +- divclk4: divclk4 { +- compatible = "fixed-clock"; +- #clock-cells = <0>; +- clock-frequency = <32768>; +- clock-output-names = "divclk4"; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&divclk4_pin_a>; +- }; +- +- div1_mclk: divclk1 { +- compatible = "gpio-gate-clock"; +- pinctrl-0 = <&audio_mclk>; +- pinctrl-names = "default"; +- clocks = <&rpmcc RPM_SMD_DIV_CLK1>; +- #clock-cells = <0>; +- enable-gpios = <&pm8994_gpios 15 0>; +- }; +- }; +- +- gpio_keys { +- compatible = "gpio-keys"; +- #address-cells = <1>; +- #size-cells = <0>; +- autorepeat; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&volume_up_gpio>; +- +- button@0 { +- label = "Volume Up"; +- linux,code = ; +- gpios = <&pm8994_gpios 2 GPIO_ACTIVE_LOW>; +- }; +- }; +- +- usb2_id: usb2-id { +- compatible = "linux,extcon-usb-gpio"; +- id-gpio = <&pmi8994_gpios 6 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&usb2_vbus_det_gpio>; +- }; +- +- usb3_id: usb3-id { +- compatible = "linux,extcon-usb-gpio"; +- id-gpio = <&pm8994_gpios 22 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&usb3_vbus_det_gpio>; +- }; +- +- vph_pwr: vph-pwr-regulator { +- compatible = "regulator-fixed"; +- regulator-name = "vph_pwr"; +- regulator-always-on; +- regulator-boot-on; +- +- regulator-min-microvolt = <3700000>; +- regulator-max-microvolt = <3700000>; +- }; +- +- wlan_en: wlan-en-1-8v { +- pinctrl-names = "default"; +- pinctrl-0 = <&wlan_en_gpios>; +- compatible = "regulator-fixed"; +- regulator-name = "wlan-en-regulator"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- +- gpio = <&pm8994_gpios 8 0>; +- +- /* WLAN card specific delay */ +- startup-delay-us = <70000>; +- enable-active-high; +- }; +-}; +- +-&blsp1_i2c3 { +- /* On Low speed expansion */ +- label = "LS-I2C0"; +- status = "okay"; +-}; +- +-&blsp1_spi1 { +- /* On Low speed expansion */ +- label = "LS-SPI0"; +- status = "okay"; +-}; +- +-&blsp1_uart2 { +- label = "BT-UART"; +- status = "okay"; +- +- bluetooth { +- compatible = "qcom,qca6174-bt"; +- +- /* bt_disable_n gpio */ +- enable-gpios = <&pm8994_gpios 19 GPIO_ACTIVE_HIGH>; +- +- clocks = <&divclk4>; +- }; +-}; +- +-&adsp_pil { +- status = "okay"; +-}; +- +-&blsp2_i2c1 { +- /* On High speed expansion */ +- label = "HS-I2C2"; +- status = "okay"; +-}; +- +-&blsp2_i2c1 { +- /* On Low speed expansion */ +- label = "LS-I2C1"; +- status = "okay"; +-}; +- +-&blsp2_spi6 { +- /* On High speed expansion */ +- label = "HS-SPI1"; +- status = "okay"; +-}; +- +-&blsp2_uart2 { +- label = "LS-UART1"; +- status = "okay"; +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&blsp2_uart2_2pins_default>; +- pinctrl-1 = <&blsp2_uart2_2pins_sleep>; +-}; +- +-&blsp2_uart3 { +- label = "LS-UART0"; +- status = "disabled"; +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&blsp2_uart3_4pins_default>; +- pinctrl-1 = <&blsp2_uart3_4pins_sleep>; +-}; +- +-&camss { +- vdda-supply = <&vreg_l2a_1p25>; +-}; +- +-&gpu { +- status = "okay"; +-}; +- +-&hdmi { +- status = "okay"; +- +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&hdmi_hpd_active &hdmi_ddc_active>; +- pinctrl-1 = <&hdmi_hpd_suspend &hdmi_ddc_suspend>; +- +- core-vdda-supply = <&vreg_l12a_1p8>; +- core-vcc-supply = <&vreg_s4a_1p8>; +-}; +- +-&hdmi_phy { +- status = "okay"; +- +- vddio-supply = <&vreg_l12a_1p8>; +- vcca-supply = <&vreg_l28a_0p925>; +- #phy-cells = <0>; +-}; +- +-&hsusb_phy1 { +- status = "okay"; +- +- vdda-pll-supply = <&vreg_l12a_1p8>; +- vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; +-}; +- +-&hsusb_phy2 { +- status = "okay"; +- +- vdda-pll-supply = <&vreg_l12a_1p8>; +- vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; +-}; +- +-&mdp { +- status = "okay"; +-}; +- +-&mdss { +- status = "okay"; +-}; +- +-&mmcc { +- vdd-gfx-supply = <&vdd_gfx>; +-}; +- +-&pm8994_resin { +- status = "okay"; +- linux,code = ; +-}; +- +-&tlmm { +- gpio-line-names = +- "[SPI0_DOUT]", /* GPIO_0, BLSP1_SPI_MOSI, LSEC pin 14 */ +- "[SPI0_DIN]", /* GPIO_1, BLSP1_SPI_MISO, LSEC pin 10 */ +- "[SPI0_CS]", /* GPIO_2, BLSP1_SPI_CS_N, LSEC pin 12 */ +- "[SPI0_SCLK]", /* GPIO_3, BLSP1_SPI_CLK, LSEC pin 8 */ +- "[UART1_TxD]", /* GPIO_4, BLSP8_UART_TX, LSEC pin 11 */ +- "[UART1_RxD]", /* GPIO_5, BLSP8_UART_RX, LSEC pin 13 */ +- "[I2C1_SDA]", /* GPIO_6, BLSP8_I2C_SDA, LSEC pin 21 */ +- "[I2C1_SCL]", /* GPIO_7, BLSP8_I2C_SCL, LSEC pin 19 */ +- "GPIO-H", /* GPIO_8, LCD0_RESET_N, LSEC pin 30 */ +- "TP93", /* GPIO_9 */ +- "GPIO-G", /* GPIO_10, MDP_VSYNC_P, LSEC pin 29 */ +- "[MDP_VSYNC_S]", /* GPIO_11, S HSEC pin 55 */ +- "NC", /* GPIO_12 */ +- "[CSI0_MCLK]", /* GPIO_13, CAM_MCLK0, P HSEC pin 15 */ +- "[CAM_MCLK1]", /* GPIO_14, J14 pin 11 */ +- "[CSI1_MCLK]", /* GPIO_15, CAM_MCLK2, P HSEC pin 17 */ +- "TP99", /* GPIO_16 */ +- "[I2C2_SDA]", /* GPIO_17, CCI_I2C_SDA0, P HSEC pin 34 */ +- "[I2C2_SCL]", /* GPIO_18, CCI_I2C_SCL0, P HSEC pin 32 */ +- "[CCI_I2C_SDA1]", /* GPIO_19, S HSEC pin 38 */ +- "[CCI_I2C_SCL1]", /* GPIO_20, S HSEC pin 36 */ +- "FLASH_STROBE_EN", /* GPIO_21, S HSEC pin 5 */ +- "FLASH_STROBE_TRIG", /* GPIO_22, S HSEC pin 1 */ +- "GPIO-K", /* GPIO_23, CAM2_RST_N, LSEC pin 33 */ +- "GPIO-D", /* GPIO_24, LSEC pin 26 */ +- "GPIO-I", /* GPIO_25, CAM0_RST_N, LSEC pin 31 */ +- "GPIO-J", /* GPIO_26, CAM0_STANDBY_N, LSEC pin 32 */ +- "BLSP6_I2C_SDA", /* GPIO_27 */ +- "BLSP6_I2C_SCL", /* GPIO_28 */ +- "GPIO-B", /* GPIO_29, TS0_RESET_N, LSEC pin 24 */ +- "GPIO30", /* GPIO_30, S HSEC pin 4 */ +- "HDMI_CEC", /* GPIO_31 */ +- "HDMI_DDC_CLOCK", /* GPIO_32 */ +- "HDMI_DDC_DATA", /* GPIO_33 */ +- "HDMI_HOT_PLUG_DETECT", /* GPIO_34 */ +- "PCIE0_RST_N", /* GPIO_35 */ +- "PCIE0_CLKREQ_N", /* GPIO_36 */ +- "PCIE0_WAKE", /* GPIO_37 */ +- "SD_CARD_DET_N", /* GPIO_38 */ +- "TSIF1_SYNC", /* GPIO_39, S HSEC pin 48 */ +- "W_DISABLE_N", /* GPIO_40 */ +- "[BLSP9_UART_TX]", /* GPIO_41 */ +- "[BLSP9_UART_RX]", /* GPIO_42 */ +- "[BLSP2_UART_CTS_N]", /* GPIO_43 */ +- "[BLSP2_UART_RFR_N]", /* GPIO_44 */ +- "[BLSP3_UART_TX]", /* GPIO_45 */ +- "[BLSP3_UART_RX]", /* GPIO_46 */ +- "[I2C0_SDA]", /* GPIO_47, LS_I2C0_SDA, LSEC pin 17 */ +- "[I2C0_SCL]", /* GPIO_48, LS_I2C0_SCL, LSEC pin 15 */ +- "[UART0_TxD]", /* GPIO_49, BLSP9_UART_TX, LSEC pin 5 */ +- "[UART0_RxD]", /* GPIO_50, BLSP9_UART_RX, LSEC pin 7 */ +- "[UART0_CTS]", /* GPIO_51, BLSP9_UART_CTS_N, LSEC pin 3 */ +- "[UART0_RTS]", /* GPIO_52, BLSP9_UART_RFR_N, LSEC pin 9 */ +- "[CODEC_INT1_N]", /* GPIO_53 */ +- "[CODEC_INT2_N]", /* GPIO_54 */ +- "[BLSP7_I2C_SDA]", /* GPIO_55 */ +- "[BLSP7_I2C_SCL]", /* GPIO_56 */ +- "MI2S_MCLK", /* GPIO_57, S HSEC pin 3 */ +- "[PCM_CLK]", /* GPIO_58, QUA_MI2S_SCK, LSEC pin 18 */ +- "[PCM_FS]", /* GPIO_59, QUA_MI2S_WS, LSEC pin 16 */ +- "[PCM_DO]", /* GPIO_60, QUA_MI2S_DATA0, LSEC pin 20 */ +- "[PCM_DI]", /* GPIO_61, QUA_MI2S_DATA1, LSEC pin 22 */ +- "GPIO-E", /* GPIO_62, LSEC pin 27 */ +- "TP87", /* GPIO_63 */ +- "[CODEC_RST_N]", /* GPIO_64 */ +- "[PCM1_CLK]", /* GPIO_65 */ +- "[PCM1_SYNC]", /* GPIO_66 */ +- "[PCM1_DIN]", /* GPIO_67 */ +- "[PCM1_DOUT]", /* GPIO_68 */ +- "AUDIO_REF_CLK", /* GPIO_69 */ +- "SLIMBUS_CLK", /* GPIO_70 */ +- "SLIMBUS_DATA0", /* GPIO_71 */ +- "SLIMBUS_DATA1", /* GPIO_72 */ +- "NC", /* GPIO_73 */ +- "NC", /* GPIO_74 */ +- "NC", /* GPIO_75 */ +- "NC", /* GPIO_76 */ +- "TP94", /* GPIO_77 */ +- "NC", /* GPIO_78 */ +- "TP95", /* GPIO_79 */ +- "GPIO-A", /* GPIO_80, MEMS_RESET_N, LSEC pin 23 */ +- "TP88", /* GPIO_81 */ +- "TP89", /* GPIO_82 */ +- "TP90", /* GPIO_83 */ +- "TP91", /* GPIO_84 */ +- "[SD_DAT0]", /* GPIO_85, BLSP12_SPI_MOSI, P HSEC pin 1 */ +- "[SD_CMD]", /* GPIO_86, BLSP12_SPI_MISO, P HSEC pin 11 */ +- "[SD_DAT3]", /* GPIO_87, BLSP12_SPI_CS_N, P HSEC pin 7 */ +- "[SD_SCLK]", /* GPIO_88, BLSP12_SPI_CLK, P HSEC pin 9 */ +- "TSIF1_CLK", /* GPIO_89, S HSEC pin 42 */ +- "TSIF1_EN", /* GPIO_90, S HSEC pin 46 */ +- "TSIF1_DATA", /* GPIO_91, S HSEC pin 44 */ +- "NC", /* GPIO_92 */ +- "TSIF2_CLK", /* GPIO_93, S HSEC pin 52 */ +- "TSIF2_EN", /* GPIO_94, S HSEC pin 56 */ +- "TSIF2_DATA", /* GPIO_95, S HSEC pin 54 */ +- "TSIF2_SYNC", /* GPIO_96, S HSEC pin 58 */ +- "NC", /* GPIO_97 */ +- "CAM1_STANDBY_N", /* GPIO_98 */ +- "NC", /* GPIO_99 */ +- "NC", /* GPIO_100 */ +- "[LCD1_RESET_N]", /* GPIO_101, S HSEC pin 51 */ +- "BOOT_CONFIG1", /* GPIO_102 */ +- "USB_HUB_RESET", /* GPIO_103 */ +- "CAM1_RST_N", /* GPIO_104 */ +- "NC", /* GPIO_105 */ +- "NC", /* GPIO_106 */ +- "NC", /* GPIO_107 */ +- "NC", /* GPIO_108 */ +- "NC", /* GPIO_109 */ +- "NC", /* GPIO_110 */ +- "NC", /* GPIO_111 */ +- "NC", /* GPIO_112 */ +- "PMI8994_BUA", /* GPIO_113 */ +- "PCIE2_RST_N", /* GPIO_114 */ +- "PCIE2_CLKREQ_N", /* GPIO_115 */ +- "PCIE2_WAKE", /* GPIO_116 */ +- "SSC_IRQ_0", /* GPIO_117 */ +- "SSC_IRQ_1", /* GPIO_118 */ +- "SSC_IRQ_2", /* GPIO_119 */ +- "NC", /* GPIO_120 */ +- "GPIO121", /* GPIO_121, S HSEC pin 2 */ +- "NC", /* GPIO_122 */ +- "SSC_IRQ_6", /* GPIO_123 */ +- "SSC_IRQ_7", /* GPIO_124 */ +- "GPIO-C", /* GPIO_125, TS_INT0, LSEC pin 25 */ +- "BOOT_CONFIG5", /* GPIO_126 */ +- "NC", /* GPIO_127 */ +- "NC", /* GPIO_128 */ +- "BOOT_CONFIG7", /* GPIO_129 */ +- "PCIE1_RST_N", /* GPIO_130 */ +- "PCIE1_CLKREQ_N", /* GPIO_131 */ +- "PCIE1_WAKE", /* GPIO_132 */ +- "GPIO-L", /* GPIO_133, CAM2_STANDBY_N, LSEC pin 34 */ +- "NC", /* GPIO_134 */ +- "NC", /* GPIO_135 */ +- "BOOT_CONFIG8", /* GPIO_136 */ +- "NC", /* GPIO_137 */ +- "NC", /* GPIO_138 */ +- "GPS_SSBI2", /* GPIO_139 */ +- "GPS_SSBI1", /* GPIO_140 */ +- "NC", /* GPIO_141 */ +- "NC", /* GPIO_142 */ +- "NC", /* GPIO_143 */ +- "BOOT_CONFIG6", /* GPIO_144 */ +- "NC", /* GPIO_145 */ +- "NC", /* GPIO_146 */ +- "NC", /* GPIO_147 */ +- "NC", /* GPIO_148 */ +- "NC"; /* GPIO_149 */ +- +- sdc2_cd_on: sdc2_cd_on { +- mux { +- pins = "gpio38"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio38"; +- bias-pull-up; /* pull up */ +- drive-strength = <16>; /* 16 MA */ +- }; +- }; +- +- sdc2_cd_off: sdc2_cd_off { +- mux { +- pins = "gpio38"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio38"; +- bias-pull-up; /* pull up */ +- drive-strength = <2>; /* 2 MA */ +- }; +- }; +- +- hdmi_hpd_active: hdmi_hpd_active { +- mux { +- pins = "gpio34"; +- function = "hdmi_hot"; +- }; +- +- config { +- pins = "gpio34"; +- bias-pull-down; +- drive-strength = <16>; +- }; +- }; +- +- hdmi_hpd_suspend: hdmi_hpd_suspend { +- mux { +- pins = "gpio34"; +- function = "hdmi_hot"; +- }; +- +- config { +- pins = "gpio34"; +- bias-pull-down; +- drive-strength = <2>; +- }; +- }; +- +- hdmi_ddc_active: hdmi_ddc_active { +- mux { +- pins = "gpio32", "gpio33"; +- function = "hdmi_ddc"; +- }; +- +- config { +- pins = "gpio32", "gpio33"; +- drive-strength = <2>; +- bias-pull-up; +- }; +- }; +- +- hdmi_ddc_suspend: hdmi_ddc_suspend { +- mux { +- pins = "gpio32", "gpio33"; +- function = "hdmi_ddc"; +- }; +- +- config { +- pins = "gpio32", "gpio33"; +- drive-strength = <2>; +- bias-pull-down; +- }; +- }; +-}; +- +-&pcie0 { +- status = "okay"; +- perst-gpio = <&tlmm 35 GPIO_ACTIVE_LOW>; +- vddpe-3v3-supply = <&wlan_en>; +- vdda-supply = <&vreg_l28a_0p925>; +-}; +- +-&pcie1 { +- status = "okay"; +- perst-gpio = <&tlmm 130 GPIO_ACTIVE_LOW>; +- vdda-supply = <&vreg_l28a_0p925>; +-}; +- +-&pcie2 { +- status = "okay"; +- perst-gpio = <&tlmm 114 GPIO_ACTIVE_LOW>; +- vdda-supply = <&vreg_l28a_0p925>; +-}; +- +-&pcie_phy { +- status = "okay"; +- +- vdda-phy-supply = <&vreg_l28a_0p925>; +- vdda-pll-supply = <&vreg_l12a_1p8>; +-}; +- +-&pm8994_gpios { +- gpio-line-names = +- "NC", +- "KEY_VOLP_N", +- "NC", +- "BL1_PWM", +- "GPIO-F", /* BL0_PWM, LSEC pin 28 */ +- "BL1_EN", +- "NC", +- "WLAN_EN", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "DIVCLK1", +- "DIVCLK2", +- "DIVCLK3", +- "DIVCLK4", +- "BT_EN", +- "PMIC_SLB", +- "PMIC_BUA", +- "USB_VBUS_DET"; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&ls_exp_gpio_f &bt_en_gpios>; +- +- ls_exp_gpio_f: pm8994_gpio5 { +- pinconf { +- pins = "gpio5"; +- output-low; +- power-source = <2>; // PM8994_GPIO_S4, 1.8V +- }; +- }; +- +- bt_en_gpios: bt_en_gpios { +- pinconf { +- pins = "gpio19"; +- function = PMIC_GPIO_FUNC_NORMAL; +- output-low; +- power-source = ; // 1.8V +- qcom,drive-strength = ; +- bias-pull-down; +- }; +- }; +- +- wlan_en_gpios: wlan_en_gpios { +- pinconf { +- pins = "gpio8"; +- function = PMIC_GPIO_FUNC_NORMAL; +- output-low; +- power-source = ; // 1.8V +- qcom,drive-strength = ; +- bias-pull-down; +- }; +- }; +- +- audio_mclk: clk_div1 { +- pinconf { +- pins = "gpio15"; +- function = "func1"; +- power-source = ; // 1.8V +- }; +- }; +- +- volume_up_gpio: pm8996_gpio2 { +- pinconf { +- pins = "gpio2"; +- function = "normal"; +- input-enable; +- drive-push-pull; +- bias-pull-up; +- qcom,drive-strength = ; +- power-source = ; // 1.8V +- }; +- }; +- +- divclk4_pin_a: divclk4 { +- pinconf { +- pins = "gpio18"; +- function = PMIC_GPIO_FUNC_FUNC2; +- +- bias-disable; +- power-source = ; +- }; +- }; +- +- usb3_vbus_det_gpio: pm8996_gpio22 { +- pinconf { +- pins = "gpio22"; +- function = PMIC_GPIO_FUNC_NORMAL; +- input-enable; +- bias-pull-down; +- qcom,drive-strength = ; +- power-source = ; // 1.8V +- }; +- }; +-}; +- +-&pm8994_mpps { +- gpio-line-names = +- "VDDPX_BIAS", +- "WIFI_LED", +- "NC", +- "BT_LED", +- "PM_MPP05", +- "PM_MPP06", +- "PM_MPP07", +- "NC"; +-}; +- +-&pm8994_spmi_regulators { +- qcom,saw-reg = <&saw3>; +- s9 { +- qcom,saw-slave; +- }; +- s10 { +- qcom,saw-slave; +- }; +- s11 { +- qcom,saw-leader; +- regulator-always-on; +- regulator-min-microvolt = <980000>; +- regulator-max-microvolt = <980000>; +- }; +-}; +- +-&pmi8994_gpios { +- gpio-line-names = +- "NC", +- "SPKR_AMP_EN1", +- "SPKR_AMP_EN2", +- "TP61", +- "NC", +- "USB2_VBUS_DET", +- "NC", +- "NC", +- "NC", +- "NC"; +- +- usb2_vbus_det_gpio: pmi8996_gpio6 { +- pinconf { +- pins = "gpio6"; +- function = PMIC_GPIO_FUNC_NORMAL; +- input-enable; +- bias-pull-down; +- qcom,drive-strength = ; +- power-source = ; // 1.8V +- }; +- }; +-}; +- +-&pmi8994_spmi_regulators { +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; +- regulator-name = "VDD_GFX"; +- regulator-min-microvolt = <980000>; +- regulator-max-microvolt = <980000>; +- }; +-}; +- +-&rpm_requests { +- pm8994-regulators { +- compatible = "qcom,rpm-pm8994-regulators"; +- +- vdd_s1-supply = <&vph_pwr>; +- vdd_s2-supply = <&vph_pwr>; +- vdd_s3-supply = <&vph_pwr>; +- vdd_s4-supply = <&vph_pwr>; +- vdd_s5-supply = <&vph_pwr>; +- vdd_s6-supply = <&vph_pwr>; +- vdd_s7-supply = <&vph_pwr>; +- vdd_s8-supply = <&vph_pwr>; +- vdd_s9-supply = <&vph_pwr>; +- vdd_s10-supply = <&vph_pwr>; +- vdd_s11-supply = <&vph_pwr>; +- vdd_s12-supply = <&vph_pwr>; +- vdd_l1-supply = <&vreg_s1b_1p025>; +- vdd_l2_l26_l28-supply = <&vreg_s3a_1p3>; +- vdd_l3_l11-supply = <&vreg_s3a_1p3>; +- vdd_l4_l27_l31-supply = <&vreg_s3a_1p3>; +- vdd_l5_l7-supply = <&vreg_s5a_2p15>; +- vdd_l6_l12_l32-supply = <&vreg_s5a_2p15>; +- vdd_l8_l16_l30-supply = <&vph_pwr>; +- vdd_l9_l10_l18_l22-supply = <&vph_pwr_bbyp>; +- vdd_l13_l19_l23_l24-supply = <&vph_pwr_bbyp>; +- vdd_l14_l15-supply = <&vreg_s5a_2p15>; +- vdd_l17_l29-supply = <&vph_pwr_bbyp>; +- vdd_l20_l21-supply = <&vph_pwr_bbyp>; +- vdd_l25-supply = <&vreg_s3a_1p3>; +- vdd_lvs1_lvs2-supply = <&vreg_s4a_1p8>; +- +- vreg_s3a_1p3: s3 { +- regulator-name = "vreg_s3a_1p3"; +- regulator-min-microvolt = <1300000>; +- regulator-max-microvolt = <1300000>; +- }; +- +- /** +- * 1.8v required on LS expansion +- * for mezzanine boards +- */ +- vreg_s4a_1p8: s4 { +- regulator-name = "vreg_s4a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- regulator-always-on; +- }; +- vreg_s5a_2p15: s5 { +- regulator-name = "vreg_s5a_2p15"; +- regulator-min-microvolt = <2150000>; +- regulator-max-microvolt = <2150000>; +- }; +- vreg_s7a_1p0: s7 { +- regulator-name = "vreg_s7a_1p0"; +- regulator-min-microvolt = <800000>; +- regulator-max-microvolt = <800000>; +- }; +- +- vreg_l1a_1p0: l1 { +- regulator-name = "vreg_l1a_1p0"; +- regulator-min-microvolt = <1000000>; +- regulator-max-microvolt = <1000000>; +- }; +- vreg_l2a_1p25: l2 { +- regulator-name = "vreg_l2a_1p25"; +- regulator-min-microvolt = <1250000>; +- regulator-max-microvolt = <1250000>; +- }; +- vreg_l3a_0p875: l3 { +- regulator-name = "vreg_l3a_0p875"; +- regulator-min-microvolt = <850000>; +- regulator-max-microvolt = <850000>; +- }; +- vreg_l4a_1p225: l4 { +- regulator-name = "vreg_l4a_1p225"; +- regulator-min-microvolt = <1225000>; +- regulator-max-microvolt = <1225000>; +- }; +- vreg_l6a_1p2: l6 { +- regulator-name = "vreg_l6a_1p2"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <1200000>; +- }; +- vreg_l8a_1p8: l8 { +- regulator-name = "vreg_l8a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l9a_1p8: l9 { +- regulator-name = "vreg_l9a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l10a_1p8: l10 { +- regulator-name = "vreg_l10a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l11a_1p15: l11 { +- regulator-name = "vreg_l11a_1p15"; +- regulator-min-microvolt = <1150000>; +- regulator-max-microvolt = <1150000>; +- }; +- vreg_l12a_1p8: l12 { +- regulator-name = "vreg_l12a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l13a_2p95: l13 { +- regulator-name = "vreg_l13a_2p95"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <2950000>; +- }; +- vreg_l14a_1p8: l14 { +- regulator-name = "vreg_l14a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l15a_1p8: l15 { +- regulator-name = "vreg_l15a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l16a_2p7: l16 { +- regulator-name = "vreg_l16a_2p7"; +- regulator-min-microvolt = <2700000>; +- regulator-max-microvolt = <2700000>; +- }; +- vreg_l17a_2p8: l17 { +- regulator-name = "vreg_l17a_2p8"; +- regulator-min-microvolt = <2500000>; +- regulator-max-microvolt = <2500000>; +- }; +- vreg_l18a_2p85: l18 { +- regulator-name = "vreg_l18a_2p85"; +- regulator-min-microvolt = <2700000>; +- regulator-max-microvolt = <2900000>; +- }; +- vreg_l19a_2p8: l19 { +- regulator-name = "vreg_l19a_2p8"; +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; +- }; +- vreg_l20a_2p95: l20 { +- regulator-name = "vreg_l20a_2p95"; +- regulator-min-microvolt = <2950000>; +- regulator-max-microvolt = <2950000>; +- regulator-allow-set-load; +- }; +- vreg_l21a_2p95: l21 { +- regulator-name = "vreg_l21a_2p95"; +- regulator-min-microvolt = <2950000>; +- regulator-max-microvolt = <2950000>; +- regulator-allow-set-load; +- regulator-system-load = <200000>; +- }; +- vreg_l22a_3p0: l22 { +- regulator-name = "vreg_l22a_3p0"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- }; +- vreg_l23a_2p8: l23 { +- regulator-name = "vreg_l23a_2p8"; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; +- }; +- vreg_l24a_3p075: l24 { +- regulator-name = "vreg_l24a_3p075"; +- regulator-min-microvolt = <3075000>; +- regulator-max-microvolt = <3075000>; +- }; +- vreg_l25a_1p2: l25 { +- regulator-name = "vreg_l25a_1p2"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <1200000>; +- regulator-allow-set-load; +- }; +- vreg_l26a_0p8: l27 { +- regulator-name = "vreg_l26a_0p8"; +- regulator-min-microvolt = <1000000>; +- regulator-max-microvolt = <1000000>; +- }; +- vreg_l28a_0p925: l28 { +- regulator-name = "vreg_l28a_0p925"; +- regulator-min-microvolt = <925000>; +- regulator-max-microvolt = <925000>; +- regulator-allow-set-load; +- }; +- vreg_l29a_2p8: l29 { +- regulator-name = "vreg_l29a_2p8"; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; +- }; +- vreg_l30a_1p8: l30 { +- regulator-name = "vreg_l30a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l32a_1p8: l32 { +- regulator-name = "vreg_l32a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- +- vreg_lvs1a_1p8: lvs1 { +- regulator-name = "vreg_lvs1a_1p8"; +- }; +- +- vreg_lvs2a_1p8: lvs2 { +- regulator-name = "vreg_lvs2a_1p8"; +- }; +- }; +- +- pmi8994-regulators { +- compatible = "qcom,rpm-pmi8994-regulators"; +- +- vdd_s1-supply = <&vph_pwr>; +- vdd_s2-supply = <&vph_pwr>; +- vdd_s3-supply = <&vph_pwr>; +- vdd_bst_byp-supply = <&vph_pwr>; +- +- vph_pwr_bbyp: boost-bypass { +- regulator-name = "vph_pwr_bbyp"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- }; +- +- vreg_s1b_1p025: s1 { +- regulator-name = "vreg_s1b_1p025"; +- regulator-min-microvolt = <1025000>; +- regulator-max-microvolt = <1025000>; +- }; +- }; +-}; +- +-&sdhc2 { +- /* External SD card */ +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&sdc2_state_on &sdc2_cd_on>; +- pinctrl-1 = <&sdc2_state_off &sdc2_cd_off>; +- cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>; +- vmmc-supply = <&vreg_l21a_2p95>; +- vqmmc-supply = <&vreg_l13a_2p95>; +- status = "okay"; +-}; +- +-&q6asmdai { +- dai@0 { +- reg = <0>; +- }; +- +- dai@1 { +- reg = <1>; +- }; +- +- dai@2 { +- reg = <2>; +- }; +-}; +- +-&sound { +- compatible = "qcom,apq8096-sndcard"; +- model = "DB820c"; +- audio-routing = "RX_BIAS", "MCLK", +- "MM_DL1", "MultiMedia1 Playback", +- "MM_DL2", "MultiMedia2 Playback", +- "MultiMedia3 Capture", "MM_UL3"; +- +- mm1-dai-link { +- link-name = "MultiMedia1"; +- cpu { +- sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA1>; +- }; +- }; +- +- mm2-dai-link { +- link-name = "MultiMedia2"; +- cpu { +- sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA2>; +- }; +- }; +- +- mm3-dai-link { +- link-name = "MultiMedia3"; +- cpu { +- sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA3>; +- }; +- }; +- +- hdmi-dai-link { +- link-name = "HDMI"; +- cpu { +- sound-dai = <&q6afedai HDMI_RX>; +- }; +- +- platform { +- sound-dai = <&q6routing>; +- }; +- +- codec { +- sound-dai = <&hdmi 0>; +- }; +- }; +- +- slim-dai-link { +- link-name = "SLIM Playback"; +- cpu { +- sound-dai = <&q6afedai SLIMBUS_6_RX>; +- }; +- +- platform { +- sound-dai = <&q6routing>; +- }; +- +- codec { +- sound-dai = <&wcd9335 6>; +- }; +- }; +- +- slimcap-dai-link { +- link-name = "SLIM Capture"; +- cpu { +- sound-dai = <&q6afedai SLIMBUS_0_TX>; +- }; +- +- platform { +- sound-dai = <&q6routing>; +- }; +- +- codec { +- sound-dai = <&wcd9335 1>; +- }; +- }; +-}; +- +-&ufsphy { +- status = "okay"; +- +- vdda-phy-supply = <&vreg_l28a_0p925>; +- vdda-pll-supply = <&vreg_l12a_1p8>; +- vddp-ref-clk-supply = <&vreg_l25a_1p2>; +-}; +- +-&ufshc { +- status = "okay"; +- +- vcc-supply = <&vreg_l20a_2p95>; +- vccq-supply = <&vreg_l25a_1p2>; +- vccq2-supply = <&vreg_s4a_1p8>; +- +- vcc-max-microamp = <600000>; +- vccq-max-microamp = <450000>; +- vccq2-max-microamp = <450000>; +-}; +- +-&usb2 { +- status = "okay"; +- extcon = <&usb2_id>; +- +- dwc3@7600000 { +- extcon = <&usb2_id>; +- dr_mode = "otg"; +- maximum-speed = "high-speed"; +- }; +-}; +- +-&usb3 { +- status = "okay"; +- extcon = <&usb3_id>; +- +- dwc3@6a00000 { +- extcon = <&usb3_id>; +- dr_mode = "otg"; +- }; +-}; +- +-&usb3phy { +- status = "okay"; +- +- vdda-phy-supply = <&vreg_l28a_0p925>; +- vdda-pll-supply = <&vreg_l12a_1p8>; +- +-}; +- +-&venus { +- status = "okay"; +-}; +- +-&wcd9335 { +- clock-names = "mclk", "slimbus"; +- clocks = <&div1_mclk>, +- <&rpmcc RPM_SMD_BB_CLK1>; +- +- vdd-buck-supply = <&vreg_s4a_1p8>; +- vdd-buck-sido-supply = <&vreg_s4a_1p8>; +- vdd-tx-supply = <&vreg_s4a_1p8>; +- vdd-rx-supply = <&vreg_s4a_1p8>; +- vdd-io-supply = <&vreg_s4a_1p8>; +-}; +diff --git a/arch/arm64/boot/dts/qcom/msm8916-mtp.dts b/arch/arm64/boot/dts/qcom/msm8916-mtp.dts +index d66c155387850..7c0ceb3cff45e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/msm8916-mtp.dts +@@ -5,9 +5,22 @@ + + /dts-v1/; + +-#include "msm8916-mtp.dtsi" ++#include "msm8916-pm8916.dtsi" + + / { + model = "Qualcomm Technologies, Inc. MSM 8916 MTP"; + compatible = "qcom,msm8916-mtp", "qcom,msm8916-mtp/1", "qcom,msm8916"; ++ ++ aliases { ++ serial0 = &blsp1_uart2; ++ usid0 = &pm8916_0; ++ }; ++ ++ chosen { ++ stdout-path = "serial0"; ++ }; ++}; ++ ++&blsp1_uart2 { ++ status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi +deleted file mode 100644 +index 1bd05046cdeba..0000000000000 +--- a/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi ++++ /dev/null +@@ -1,21 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8916-pm8916.dtsi" +- +-/ { +- aliases { +- serial0 = &blsp1_uart2; +- usid0 = &pm8916_0; +- }; +- +- chosen { +- stdout-path = "serial0"; +- }; +-}; +- +-&blsp1_uart2 { +- status = "okay"; +-}; +diff --git a/arch/arm64/boot/dts/qcom/msm8996-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-mtp.dts +index 45ed594c1b9c2..7d9fc35bc7a06 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/msm8996-mtp.dts +@@ -5,9 +5,31 @@ + + /dts-v1/; + +-#include "msm8996-mtp.dtsi" ++#include "msm8996.dtsi" + + / { + model = "Qualcomm Technologies, Inc. MSM 8996 MTP"; + compatible = "qcom,msm8996-mtp"; ++ ++ aliases { ++ serial0 = &blsp2_uart2; ++ }; ++ ++ chosen { ++ stdout-path = "serial0"; ++ }; ++ ++ soc { ++ serial@75b0000 { ++ status = "okay"; ++ }; ++ }; ++}; ++ ++&hdmi { ++ status = "okay"; ++}; ++ ++&hdmi_phy { ++ status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi +deleted file mode 100644 +index ac43a91f11048..0000000000000 +--- a/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi ++++ /dev/null +@@ -1,30 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8996.dtsi" +- +-/ { +- aliases { +- serial0 = &blsp2_uart2; +- }; +- +- chosen { +- stdout-path = "serial0"; +- }; +- +- soc { +- serial@75b0000 { +- status = "okay"; +- }; +- }; +-}; +- +-&hdmi { +- status = "okay"; +-}; +- +-&hdmi_phy { +- status = "okay"; +-}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch b/queue-5.15/arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch new file mode 100644 index 00000000000..7eb82571b1e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch @@ -0,0 +1,103 @@ +From a2d17f6b47fa16a1e35b7b29b9504fed586c2ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 10:46:29 +0100 +Subject: arm64: dts: qcom: ipq6018: Add/remove some newlines + +From: Konrad Dybcio + +[ Upstream commit 6db9ed9a128cbae1423d043f3debd8bfa77783fd ] + +Some lines were broken very aggresively, presumably to fit under 80 chars +and some places could have used a newline, particularly between subsequent +nodes. Address all that and remove redundant comments near PCIe ranges +while at it so as not to exceed 100 chars needlessly. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230102094642.74254-5-konrad.dybcio@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 2c9bd06c5c3c6..e566dccfdcf50 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -96,26 +96,31 @@ + opp-microvolt = <725000>; + clock-latency-ns = <200000>; + }; ++ + opp-1056000000 { + opp-hz = /bits/ 64 <1056000000>; + opp-microvolt = <787500>; + clock-latency-ns = <200000>; + }; ++ + opp-1320000000 { + opp-hz = /bits/ 64 <1320000000>; + opp-microvolt = <862500>; + clock-latency-ns = <200000>; + }; ++ + opp-1440000000 { + opp-hz = /bits/ 64 <1440000000>; + opp-microvolt = <925000>; + clock-latency-ns = <200000>; + }; ++ + opp-1608000000 { + opp-hz = /bits/ 64 <1608000000>; + opp-microvolt = <987500>; + clock-latency-ns = <200000>; + }; ++ + opp-1800000000 { + opp-hz = /bits/ 64 <1800000000>; + opp-microvolt = <1062500>; +@@ -131,8 +136,7 @@ + + pmuv8: pmu { + compatible = "arm,cortex-a53-pmu"; +- interrupts = ; ++ interrupts = ; + }; + + psci: psci { +@@ -429,24 +433,18 @@ + phys = <&pcie_phy0>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x20200000 0 0x20200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x20220000 0 0x20220000 +- 0 0xfde0000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0 0x20200000 0 0x20200000 0 0x10000>, ++ <0x82000000 0 0x20220000 0 0x20220000 0 0xfde0000>; + + interrupts = ; + interrupt-names = "msi"; + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 +- IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 +- IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 +- IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 +- IRQ_TYPE_LEVEL_HIGH>; /* int_d */ ++ interrupt-map = <0 0 0 1 &intc 0 75 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 78 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 79 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 83 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..02994dbbee0 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,45 @@ +From b12c2c36626b940ccfdacd54f3d80ca381e44d13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:42 +0530 +Subject: arm64: dts: qcom: ipq6018: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 75a6e1fdb351189f55097741e8460ca3f9b2883f ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI address +(0x20200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 095bbdd9a5c3 ("arm64: dts: qcom: ipq6018: Add pcie support") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-7-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index e566dccfdcf50..e49b7cb405956 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -433,8 +433,8 @@ + phys = <&pcie_phy0>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x20200000 0 0x20200000 0 0x10000>, +- <0x82000000 0 0x20220000 0 0x20220000 0 0xfde0000>; ++ ranges = <0x81000000 0x0 0x00000000 0x0 0x20200000 0x0 0x10000>, ++ <0x82000000 0x0 0x20220000 0x0 0x20220000 0x0 0xfde0000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch b/queue-5.15/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch new file mode 100644 index 00000000000..3aaedbb4dca --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch @@ -0,0 +1,43 @@ +From 0da8bd2056261cbf6a1d80b2e948955e75219e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 22:21:25 +0100 +Subject: arm64: dts: qcom: ipq6018: improve pcie phy pcs reg table + +From: Christian Marangi + +[ Upstream commit 08f399a818b0eff552b1f23c3171950a58aea78f ] + +This is not a fix on its own but more a cleanup. Phy qmp pcie driver +currently have a workaround to handle pcs_misc not declared and add +0x400 offset to the pcs reg if pcs_misc is not declared. + +Correctly declare pcs_misc reg and reduce PCS size to the common value +of 0x1f0 as done for every other qmp based pcie phy device. + +Signed-off-by: Christian Marangi +Reviewed-by: Vinod Koul +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221103212125.17156-2-ansuelsmth@gmail.com +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 15ba7d215dde9..2c9bd06c5c3c6 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -399,7 +399,8 @@ + pcie_phy0: phy@84200 { + reg = <0x0 0x84200 0x0 0x16c>, /* Serdes Tx */ + <0x0 0x84400 0x0 0x200>, /* Serdes Rx */ +- <0x0 0x84800 0x0 0x4f4>; /* PCS: Lane0, COM, PCIE */ ++ <0x0 0x84800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */ ++ <0x0 0x84c00 0x0 0xf4>; /* pcs_misc */ + #phy-cells = <0>; + + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq6018-switch-tcsr-mutex-to-mmio.patch b/queue-5.15/arm64-dts-qcom-ipq6018-switch-tcsr-mutex-to-mmio.patch new file mode 100644 index 00000000000..d2f14e1b8ff --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq6018-switch-tcsr-mutex-to-mmio.patch @@ -0,0 +1,60 @@ +From f0d32902d997adbd150dc8abf558e2f7e948d29f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 11:20:31 +0200 +Subject: arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO + +From: Krzysztof Kozlowski + +[ Upstream commit f5e303aefc06b7508d7a490f9a2d80e4dc134c70 ] + +The TCSR mutex bindings allow device to be described only with address +space (so it uses MMIO, not syscon regmap). This seems reasonable as +TCSR mutex is actually a dedicated IO address space and it also fixes DT +schema checks: + + qcom/ipq6018-cp01-c1.dtb: hwlock: 'reg' is a required property + qcom/ipq6018-cp01-c1.dtb: hwlock: 'syscon' does not match any of the regexes: 'pinctrl-[0-9]+' + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220909092035.223915-12-krzysztof.kozlowski@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 30ac0b2e8c896..15ba7d215dde9 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -129,12 +129,6 @@ + }; + }; + +- tcsr_mutex: hwlock { +- compatible = "qcom,tcsr-mutex"; +- syscon = <&tcsr_mutex_regs 0 0x80>; +- #hwlock-cells = <1>; +- }; +- + pmuv8: pmu { + compatible = "arm,cortex-a53-pmu"; + interrupts = ; + }; + +- tcsr_mutex_regs: syscon@1905000 { +- compatible = "syscon"; +- reg = <0x0 0x01905000 0x0 0x8000>; ++ tcsr_mutex: hwlock@1905000 { ++ compatible = "qcom,ipq6018-tcsr-mutex", "qcom,tcsr-mutex"; ++ reg = <0x0 0x01905000 0x0 0x1000>; ++ #hwlock-cells = <1>; + }; + + tcsr: syscon@1937000 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..b611059e710 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,61 @@ +From f3d5b97f8a47ed5389b1d4a64eecdcea1c63850d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:41 +0530 +Subject: arm64: dts: qcom: ipq8074: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit e49eafefe5ab325e38dd074f2005076ffc271e54 ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses +(0x10200000, 0x20200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses and align +them in a single line. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-6-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 68e82c755986c..17eeff106bab7 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -661,10 +661,8 @@ + phys = <&pcie_phy1>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x10200000 0x10200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x10220000 0x10220000 +- 0 0xfde0000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x10200000 0x0 0x10000>, /* I/O */ ++ <0x82000000 0x0 0x10220000 0x10220000 0x0 0xfde0000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -725,10 +723,8 @@ + phys = <&pcie_phy0>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x20200000 0x20200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x20220000 0x20220000 +- 0 0xfde0000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x20200000 0x0 0x10000>, /* I/O */ ++ <0x82000000 0x0 0x20220000 0x20220000 0x0 0xfde0000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch b/queue-5.15/arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch new file mode 100644 index 00000000000..b719bd5470d --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch @@ -0,0 +1,39 @@ +From 98e4d1b8b3df422994fba93292149d7971b0bab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:20 +0100 +Subject: arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 + regulator + +From: Krzysztof Kozlowski + +[ Upstream commit 3555dd528ba9c08d6ccd56239c695dbeac3b63e3 ] + +The PMIC regulators are not supposed to have unit addresses. + +Fixes: e9783584c9b7 ("arm64: dts: qcom: msm8994-kitakami: Add VDD_GFX regulator") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-6-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi b/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi +index 48de66bf19c4c..55198190bbeaa 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi +@@ -183,8 +183,7 @@ + * power domain.. which still isn't enough and forces us to bind + * OXILI_CX and OXILI_GX together! + */ +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; ++ vdd_gfx: s2 { + regulator-name = "VDD_GFX"; + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch b/queue-5.15/arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch new file mode 100644 index 00000000000..0abd91807bf --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch @@ -0,0 +1,39 @@ +From 16032a55a3a8c49981533bd06aef0e6ee709f5f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:21 +0100 +Subject: arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from + PMI8994 regulator + +From: Krzysztof Kozlowski + +[ Upstream commit 7a202df0f3eed006e4a9e7c06d62cf67be56c14c ] + +The PMIC regulators are not supposed to have unit addresses. + +Fixes: 60b214effb80 ("arm64: dts: qcom: msm8994-octagon: Configure regulators") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-7-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi b/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi +index 3a3790a52a2ce..e2d08915ec426 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi +@@ -540,8 +540,7 @@ + }; + + &pmi8994_spmi_regulators { +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; ++ vdd_gfx: s2 { + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..edda88bcce2 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,68 @@ +From b167f44d401d7513407981e5a94922b0161efb1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:43 +0530 +Subject: arm64: dts: qcom: msm8996: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit cf0ac10feb17661987d0018eb9475dc03e2a2253 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x0c200000, 0x0d200000, 0x0e200000) specified in the ranges property for +I/O region. + +While at it, let's also align the entries. + +Fixes: ed965ef89227 ("arm64: dts: qcom: msm8996: add support to pcie") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-8-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 40174220e8e28..b22d3c8db3b39 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1555,8 +1555,8 @@ + + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x0c200000 0x0c200000 0x0 0x100000>, +- <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0c200000 0x0 0x100000>, ++ <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>; + + device_type = "pci"; + +@@ -1609,8 +1609,8 @@ + + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x0d200000 0x0d200000 0x0 0x100000>, +- <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0d200000 0x0 0x100000>, ++ <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>; + + device_type = "pci"; + +@@ -1660,8 +1660,8 @@ + + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x0e200000 0x0e200000 0x0 0x100000>, +- <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0e200000 0x0 0x100000>, ++ <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>; + + device_type = "pci"; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch b/queue-5.15/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch new file mode 100644 index 00000000000..b2aee7f783b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch @@ -0,0 +1,37 @@ +From 3889655c1e2786920d9199618f9b44cec4e2449b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 22:03:31 +0100 +Subject: arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name + +From: Konrad Dybcio + +[ Upstream commit b5d08f08377218b1d2ab4026e427a7788b271c8e ] + +The name stm-data-base comes from ancient (msm-3.10 or older) +downstream kernels. Upstream uses stm-stimulus-base instead. Fix it. + +Fixes: 783abfa2249a ("arm64: dts: qcom: msm8998: Add Coresight support") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230213210331.2106877-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 5350b911f4f6c..5ddf9fa904aba 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -1473,7 +1473,7 @@ + compatible = "arm,coresight-stm", "arm,primecell"; + reg = <0x06002000 0x1000>, + <0x16280000 0x180000>; +- reg-names = "stm-base", "stm-data-base"; ++ reg-names = "stm-base", "stm-stimulus-base"; + status = "disabled"; + + clocks = <&rpmcc RPM_SMD_QDSS_CLK>, <&rpmcc RPM_SMD_QDSS_A_CLK>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..9e68779e3b2 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,41 @@ +From 3049fbf9835ba10cdb20cc84006e895dd59e4477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:38 +0530 +Subject: arm64: dts: qcom: msm8998: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit c30a27dcfe4545edbda1578b3a63ed6147519cdd ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x1b200000) specified in the ranges property for I/O region. + +Fixes: b84dfd175c09 ("arm64: dts: qcom: msm8998: Add PCIe PHY and RC nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-3-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 5ddf9fa904aba..b7d72b0d579e4 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -951,7 +951,7 @@ + phy-names = "pciephy"; + status = "disabled"; + +- ranges = <0x01000000 0x0 0x1b200000 0x1b200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x1b200000 0x0 0x100000>, + <0x02000000 0x0 0x1b300000 0x1b300000 0x0 0xd00000>; + + #interrupt-cells = <1>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch b/queue-5.15/arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch new file mode 100644 index 00000000000..f78b82f0859 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch @@ -0,0 +1,42 @@ +From a6540373ab0b09b743b46dd4ccb8efcaf8b6943f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:17 +0100 +Subject: arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply + +From: Krzysztof Kozlowski + +[ Upstream commit 52e2996f253d82520011340d40dbc1c76ea79208 ] + +The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other +boards which use elan,ekth3000 with valid VCC: + + sc7180-trogdor-lazor-limozeen-nots-r4.dtb: trackpad@2c: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: 2c26adb8dbab ("arm64: dts: qcom: Add sc7180-lazor-limozeen skus") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + .../boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts +index 6ebde0828550c..8a98a6f849c4f 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts +@@ -26,7 +26,7 @@ + interrupt-parent = <&tlmm>; + interrupts = <58 IRQ_TYPE_EDGE_FALLING>; + +- vcc-supply = <&pp3300_fp_tp>; ++ vdd-supply = <&pp3300_fp_tp>; + hid-descr-addr = <0x20>; + + wakeup-source; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch b/queue-5.15/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch new file mode 100644 index 00000000000..cae372fc5ab --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch @@ -0,0 +1,130 @@ +From 6993de32b2bb76ba9029f179f2533650fabdb12c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 17:11:04 +0300 +Subject: arm64: dts: qcom: sdm845: correct dynamic power coefficients +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Baryshkov + +[ Upstream commit 0e0a8e35d72533b3eef3365e900baacd7cede8e2 ] + +Following sm8150/sm8250 update sdm845 capacity-dmips-mhz and +dynamic-power-coefficient based on the measurements [1], [2]. + +The energy model dynamic-power-coefficient values were calculated with + DPC = µW / MHz / V^2 +for each OPP, and averaged across all OPPs within each cluster for the +final coefficient. Voltages were obtained from the qcom-cpufreq-hw +driver that reads voltages from the OSM LUT programmed into the SoC. + +Normalized DMIPS/MHz capacity scale values for each CPU were calculated +from CoreMarks/MHz (CoreMark iterations per second per MHz), which +serves the same purpose. For each CPU, the final capacity-dmips-mhz +value is the C/MHz value of its maximum frequency normalized to +SCHED_CAPACITY_SCALE (1024) for the fastest CPU in the system. + +For more details on measurement process see the commit message for the +commit 6aabed5526ee ("arm64: dts: qcom: sm8250: Add CPU capacities and +energy model"). + +[1] https://github.com/kdrag0n/freqbench +[2] https://github.com/kdrag0n/freqbench/tree/master/results/sdm845/main + +Cc: Danny Lin +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220315141104.730235-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index ed293f635f145..26849cece1eb9 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -196,8 +196,8 @@ + cpu-idle-states = <&LITTLE_CPU_SLEEP_0 + &LITTLE_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- capacity-dmips-mhz = <607>; +- dynamic-power-coefficient = <100>; ++ capacity-dmips-mhz = <611>; ++ dynamic-power-coefficient = <290>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -221,8 +221,8 @@ + cpu-idle-states = <&LITTLE_CPU_SLEEP_0 + &LITTLE_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- capacity-dmips-mhz = <607>; +- dynamic-power-coefficient = <100>; ++ capacity-dmips-mhz = <611>; ++ dynamic-power-coefficient = <290>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -243,8 +243,8 @@ + cpu-idle-states = <&LITTLE_CPU_SLEEP_0 + &LITTLE_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- capacity-dmips-mhz = <607>; +- dynamic-power-coefficient = <100>; ++ capacity-dmips-mhz = <611>; ++ dynamic-power-coefficient = <290>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -265,8 +265,8 @@ + cpu-idle-states = <&LITTLE_CPU_SLEEP_0 + &LITTLE_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- capacity-dmips-mhz = <607>; +- dynamic-power-coefficient = <100>; ++ capacity-dmips-mhz = <611>; ++ dynamic-power-coefficient = <290>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -288,7 +288,7 @@ + cpu-idle-states = <&BIG_CPU_SLEEP_0 + &BIG_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- dynamic-power-coefficient = <396>; ++ dynamic-power-coefficient = <442>; + qcom,freq-domain = <&cpufreq_hw 1>; + operating-points-v2 = <&cpu4_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -310,7 +310,7 @@ + cpu-idle-states = <&BIG_CPU_SLEEP_0 + &BIG_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- dynamic-power-coefficient = <396>; ++ dynamic-power-coefficient = <442>; + qcom,freq-domain = <&cpufreq_hw 1>; + operating-points-v2 = <&cpu4_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -332,7 +332,7 @@ + cpu-idle-states = <&BIG_CPU_SLEEP_0 + &BIG_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- dynamic-power-coefficient = <396>; ++ dynamic-power-coefficient = <442>; + qcom,freq-domain = <&cpufreq_hw 1>; + operating-points-v2 = <&cpu4_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -354,7 +354,7 @@ + cpu-idle-states = <&BIG_CPU_SLEEP_0 + &BIG_CPU_SLEEP_1 + &CLUSTER_SLEEP_0>; +- dynamic-power-coefficient = <396>; ++ dynamic-power-coefficient = <442>; + qcom,freq-domain = <&cpufreq_hw 1>; + operating-points-v2 = <&cpu4_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..b74cd86fb83 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,55 @@ +From 9dc43c73ac12c252fa61270de941e4f3a8668412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:37 +0530 +Subject: arm64: dts: qcom: sdm845: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 67aa109eee654c76dcc100554e637fa64d5aa099 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x60200000, 0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 42ad231338c1 ("arm64: dts: qcom: sdm845: Add second PCIe PHY and controller") +Fixes: 5c538e09cb19 ("arm64: dts: qcom: sdm845: Add first PCIe controller and PHY") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-2-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 26849cece1eb9..a5c6b1635ff6d 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -1988,8 +1988,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>, +- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0xd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>, ++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0xd00000>; + + interrupts = ; + interrupt-names = "msi"; +@@ -2093,7 +2093,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch b/queue-5.15/arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..b750e55b817 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,64 @@ +From f6e08a8b79fe90e7fc2cdb9362f4016b866e5e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:44 +0530 +Subject: arm64: dts: qcom: sm8250: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit e115a4495db687898b8d91d4f16c2cf55bbf167c ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x60200000, 0x40200000, 0x64200000) specified in the ranges property for +I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: e53bdfc00977 ("arm64: dts: qcom: sm8250: Add PCIe support") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-9-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 4e3b772a8bded..181e32b8a2728 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -1393,8 +1393,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>, +- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>, ++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>; + + interrupts = ; + interrupt-names = "msi"; +@@ -1494,7 +1494,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; +@@ -1602,7 +1602,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x64200000 0x0 0x64200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x64200000 0x0 0x100000>, + <0x02000000 0x0 0x64300000 0x0 0x64300000 0x0 0x3d00000>; + + interrupts = ; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch b/queue-5.15/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch new file mode 100644 index 00000000000..53c4b662053 --- /dev/null +++ b/queue-5.15/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch @@ -0,0 +1,53 @@ +From 070df0b699b423f83c40dce096e5231ed7f85d1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:30:32 +0100 +Subject: arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 554edc3e9239bb81e61be9f0f5dbbeb528a69e72 ] + +According to the RZ/G Series, 2nd Generation Hardware User’s Manual +Rev. 1.11, the System CPU cores on RZ/G2E do not have their own power +supply, but use the common internal power supply (typical 1.03V). + +Hence remove the "opp-microvolt" properties from the Operating +Performance Points table. They are optional, and unused, when none of +the CPU nodes is tied to a regulator using the "cpu-supply" property. + +Fixes: 231d8908a66fa98f ("arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/8348e18a011ded94e35919cd8e17c0be1f9acf2f.1676560856.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +index 9eb08be3b98e2..50189209b6605 100644 +--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +@@ -49,17 +49,14 @@ + opp-shared; + opp-800000000 { + opp-hz = /bits/ 64 <800000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + opp-suspend; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch b/queue-5.15/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch new file mode 100644 index 00000000000..336e5289121 --- /dev/null +++ b/queue-5.15/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch @@ -0,0 +1,53 @@ +From f941522fbfed8ebd91d889eb57784dc177b540ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:30:31 +0100 +Subject: arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ] + +According to the R-Car Series, 3rd Generation Hardware User’s Manual +Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power +supply, but use the common internal power supply (typical 1.03V). + +Hence remove the "opp-microvolt" properties from the Operating +Performance Points table. They are optional, and unused, when none of +the CPU nodes is tied to a regulator using the "cpu-supply" property. + +Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.1676560856.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +index 9e616b0f04d46..adcb03fa23148 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +@@ -60,17 +60,14 @@ + opp-shared; + opp-800000000 { + opp-hz = /bits/ 64 <800000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + opp-suspend; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch b/queue-5.15/arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch new file mode 100644 index 00000000000..5458eeb981a --- /dev/null +++ b/queue-5.15/arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch @@ -0,0 +1,44 @@ +From b6571d3aac5ed10d77c653dad7599eed5f3a082e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 13:07:24 +0530 +Subject: arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property + +From: Bhavya Kapoor + +[ Upstream commit 4f4b30a777d3e61603119297965343a37be36435 ] + +According to latest errata of J721e [1], (i2024) 'MMCSD: Peripherals +Do Not Support HS400' which applies to MMCSD0 subsystem. Speed modes +supported has been already updated but missed dropping 'ti,strobe-sel' +property which is only required by HS400 speed mode. + +Thus, drop 'ti,strobe-sel' property from kernel dtsi for J721e SoC. + +[1] https://www.ti.com/lit/er/sprz455/sprz455.pdf + +Fixes: eb8f6194e807 ("arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems") +Signed-off-by: Bhavya Kapoor +Signed-off-by: Nishanth Menon +Reviewed-by: Diwakar Dhyani +Reviewed-by: Nitin Yadav +Link: https://lore.kernel.org/r/20230203073724.29529-1-b-kapoor@ti.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi +index ad21bb1417aa6..d662eeb7d80a7 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi +@@ -1051,7 +1051,6 @@ + ti,itap-del-sel-mmc-hs = <0xa>; + ti,itap-del-sel-ddr52 = <0x3>; + ti,trm-icp = <0x8>; +- ti,strobe-sel = <0x77>; + dma-coherent; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch b/queue-5.15/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch new file mode 100644 index 00000000000..7f2ce92b640 --- /dev/null +++ b/queue-5.15/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch @@ -0,0 +1,128 @@ +From 920fec80e0bc6d8fdd80eea9bf5836d23cb216d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 13:01:48 +0530 +Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step + +From: Sumit Garg + +[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ] + +Currently only the first attempt to single-step has any effect. After +that all further stepping remains "stuck" at the same program counter +value. + +Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12, +PSTATE.SS=1 should be set at each step before transferring the PE to the +'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set +since the second single-step. + +After the first single-step, the PE transferes to the 'Inactive' state, +with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to +kernel_active_single_step()=true. Then the PE transferes to the +'Active-pending' state when ERET and returns to the debugger by step +exception. + +Before this patch: +================== +Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> + +[0]kdb> +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger) + is enabled addr at ffffa45c13d09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> + +After this patch: +================= +Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger) + is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c +[1]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Co-developed-by: Wei Li +Signed-off-by: Wei Li +Signed-off-by: Sumit Garg +Tested-by: Douglas Anderson +Acked-by: Daniel Thompson +Tested-by: Daniel Thompson +Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/debug-monitors.h | 1 + + arch/arm64/kernel/debug-monitors.c | 5 +++++ + arch/arm64/kernel/kgdb.c | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h +index e1e10a24519b2..8de1a840ad974 100644 +--- a/arch/arm64/include/asm/debug-monitors.h ++++ b/arch/arm64/include/asm/debug-monitors.h +@@ -116,6 +116,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs, + void kernel_enable_single_step(struct pt_regs *regs); + void kernel_disable_single_step(void); + int kernel_active_single_step(void); ++void kernel_rewind_single_step(struct pt_regs *regs); + + #ifdef CONFIG_HAVE_HW_BREAKPOINT + int reinstall_suspended_bps(struct pt_regs *regs); +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index bf9fe71589bca..732f0890416de 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -438,6 +438,11 @@ int kernel_active_single_step(void) + } + NOKPROBE_SYMBOL(kernel_active_single_step); + ++void kernel_rewind_single_step(struct pt_regs *regs) ++{ ++ set_regs_spsr_ss(regs); ++} ++ + /* ptrace API */ + void user_enable_single_step(struct task_struct *task) + { +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index cda9c1e9864f7..4e1f983df3d1c 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -224,6 +224,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo, + */ + if (!kernel_active_single_step()) + kernel_enable_single_step(linux_regs); ++ else ++ kernel_rewind_single_step(linux_regs); + err = 0; + break; + default: +-- +2.39.2 + diff --git a/queue-5.15/asoc-es8316-handle-optional-irq-assignment.patch b/queue-5.15/asoc-es8316-handle-optional-irq-assignment.patch new file mode 100644 index 00000000000..17ed5b535d3 --- /dev/null +++ b/queue-5.15/asoc-es8316-handle-optional-irq-assignment.patch @@ -0,0 +1,62 @@ +From f2d03ba6faa23ee85bcb49b4e66103c70267d78e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 12:49:01 +0300 +Subject: ASoC: es8316: Handle optional IRQ assignment + +From: Cristian Ciocaltea + +[ Upstream commit 39db65a0a17b54915b269d3685f253a4731f344c ] + +The driver is able to work fine without relying on a mandatory interrupt +being assigned to the I2C device. This is only needed when making use of +the jack-detect support. + +However, the following warning message is always emitted when there is +no such interrupt available: + + es8316 0-0011: Failed to get IRQ 0: -22 + +Do not attempt to request an IRQ if it is not available/valid. This also +ensures the rather misleading message is not displayed anymore. + +Also note the IRQ validation relies on commit dab472eb931bc291 ("i2c / +ACPI: Use 0 to indicate that device does not have interrupt assigned"). + +Fixes: 822257661031 ("ASoC: es8316: Add jack-detect support") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230328094901.50763-1-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 5fb02635c1406..afd6d401e3d09 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -810,12 +810,14 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client, + es8316->irq = i2c_client->irq; + mutex_init(&es8316->lock); + +- ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, +- "es8316", es8316); +- if (ret) { +- dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); +- es8316->irq = -ENXIO; ++ if (es8316->irq > 0) { ++ ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, ++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, ++ "es8316", es8316); ++ if (ret) { ++ dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); ++ es8316->irq = -ENXIO; ++ } + } + + return devm_snd_soc_register_component(&i2c_client->dev, +-- +2.39.2 + diff --git a/queue-5.15/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch b/queue-5.15/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch new file mode 100644 index 00000000000..cb69827e1f7 --- /dev/null +++ b/queue-5.15/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch @@ -0,0 +1,72 @@ +From 686f84f6092230e2eb4f2be588e65f76ae416eec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 23:26:47 +0800 +Subject: ASoC: fsl_mqs: move of_node_put() to the correct location + +From: Liliang Ye + +[ Upstream commit 1c34890273a020d61d6127ade3f68ed1cb21c16a ] + +of_node_put() should have been done directly after +mqs_priv->regmap = syscon_node_to_regmap(gpr_np); +otherwise it creates a reference leak on the success path. + +To fix this, of_node_put() is moved to the correct location, and change +all the gotos to direct returns. + +Fixes: a9d273671440 ("ASoC: fsl_mqs: Fix error handling in probe") +Signed-off-by: Liliang Ye +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20230403152647.17638-1-yll@hust.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_mqs.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/fsl/fsl_mqs.c b/sound/soc/fsl/fsl_mqs.c +index 0d4efbed41dab..c33439650823b 100644 +--- a/sound/soc/fsl/fsl_mqs.c ++++ b/sound/soc/fsl/fsl_mqs.c +@@ -204,10 +204,10 @@ static int fsl_mqs_probe(struct platform_device *pdev) + } + + mqs_priv->regmap = syscon_node_to_regmap(gpr_np); ++ of_node_put(gpr_np); + if (IS_ERR(mqs_priv->regmap)) { + dev_err(&pdev->dev, "failed to get gpr regmap\n"); +- ret = PTR_ERR(mqs_priv->regmap); +- goto err_free_gpr_np; ++ return PTR_ERR(mqs_priv->regmap); + } + } else { + regs = devm_platform_ioremap_resource(pdev, 0); +@@ -236,8 +236,7 @@ static int fsl_mqs_probe(struct platform_device *pdev) + if (IS_ERR(mqs_priv->mclk)) { + dev_err(&pdev->dev, "failed to get the clock: %ld\n", + PTR_ERR(mqs_priv->mclk)); +- ret = PTR_ERR(mqs_priv->mclk); +- goto err_free_gpr_np; ++ return PTR_ERR(mqs_priv->mclk); + } + + dev_set_drvdata(&pdev->dev, mqs_priv); +@@ -246,13 +245,9 @@ static int fsl_mqs_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_component(&pdev->dev, &soc_codec_fsl_mqs, + &fsl_mqs_dai, 1); + if (ret) +- goto err_free_gpr_np; +- return 0; +- +-err_free_gpr_np: +- of_node_put(gpr_np); ++ return ret; + +- return ret; ++ return 0; + } + + static int fsl_mqs_remove(struct platform_device *pdev) +-- +2.39.2 + diff --git a/queue-5.15/bpf-don-t-efault-for-getsockopt-with-optval-null.patch b/queue-5.15/bpf-don-t-efault-for-getsockopt-with-optval-null.patch new file mode 100644 index 00000000000..001e9c6ec03 --- /dev/null +++ b/queue-5.15/bpf-don-t-efault-for-getsockopt-with-optval-null.patch @@ -0,0 +1,55 @@ +From f4404bdf1706add0c3e97874f029c5dedae75efd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 15:53:38 -0700 +Subject: bpf: Don't EFAULT for getsockopt with optval=NULL + +From: Stanislav Fomichev + +[ Upstream commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 ] + +Some socket options do getsockopt with optval=NULL to estimate the size +of the final buffer (which is returned via optlen). This breaks BPF +getsockopt assumptions about permitted optval buffer size. Let's enforce +these assumptions only when non-NULL optval is provided. + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Reported-by: Martin KaFai Lau +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7 +Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/cgroup.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index eb3e787a3a977..87174832aa86d 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -1586,7 +1586,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + goto out; + } + +- if (ctx.optlen > max_optlen || ctx.optlen < 0) { ++ if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) { + ret = -EFAULT; + goto out; + } +@@ -1600,8 +1600,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + } + + if (ctx.optlen != 0) { +- if (copy_to_user(optval, ctx.optval, ctx.optlen) || +- put_user(ctx.optlen, optlen)) { ++ if (optval && copy_to_user(optval, ctx.optval, ctx.optlen)) { ++ ret = -EFAULT; ++ goto out; ++ } ++ if (put_user(ctx.optlen, optlen)) { + ret = -EFAULT; + goto out; + } +-- +2.39.2 + diff --git a/queue-5.15/bpf-fix-precision-propagation-verbose-logging.patch b/queue-5.15/bpf-fix-precision-propagation-verbose-logging.patch new file mode 100644 index 00000000000..c16fe6cd3b5 --- /dev/null +++ b/queue-5.15/bpf-fix-precision-propagation-verbose-logging.patch @@ -0,0 +1,46 @@ +From 9a28a7a4ecf0b10b1655e51db2ca5490aac06adc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 11:40:17 -0700 +Subject: bpf: fix precision propagation verbose logging + +From: Andrii Nakryiko + +[ Upstream commit 34f0677e7afd3a292bc1aadda7ce8e35faedb204 ] + +Fix wrong order of frame index vs register/slot index in precision +propagation verbose (level 2) output. It's wrong and very confusing as is. + +Fixes: 529409ea92d5 ("bpf: propagate precision across all frames, not just the last one") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20230313184017.4083374-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 8e6f868d6cb9b..41601299f8b4a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -10620,7 +10620,7 @@ static int propagate_precision(struct bpf_verifier_env *env, + !(state_reg->live & REG_LIVE_READ)) + continue; + if (env->log.level & BPF_LOG_LEVEL2) +- verbose(env, "frame %d: propagating r%d\n", i, fr); ++ verbose(env, "frame %d: propagating r%d\n", fr, i); + err = mark_chain_precision_frame(env, fr, i); + if (err < 0) + return err; +@@ -10636,7 +10636,7 @@ static int propagate_precision(struct bpf_verifier_env *env, + continue; + if (env->log.level & BPF_LOG_LEVEL2) + verbose(env, "frame %d: propagating fp%d\n", +- (-i - 1) * BPF_REG_SIZE, fr); ++ fr, (-i - 1) * BPF_REG_SIZE); + err = mark_chain_precision_stack_frame(env, fr, i); + if (err < 0) + return err; +-- +2.39.2 + diff --git a/queue-5.15/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch b/queue-5.15/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch new file mode 100644 index 00000000000..c2ae42577c8 --- /dev/null +++ b/queue-5.15/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch @@ -0,0 +1,93 @@ +From 302256a6f189f4f65597caca500d244dee766400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 17:54:00 +0100 +Subject: bpf: Remove misleading spec_v1 check on var-offset stack read + +From: Luis Gerhorst + +[ Upstream commit 082cdc69a4651dd2a77539d69416a359ed1214f5 ] + +For every BPF_ADD/SUB involving a pointer, adjust_ptr_min_max_vals() +ensures that the resulting pointer has a constant offset if +bypass_spec_v1 is false. This is ensured by calling sanitize_check_bounds() +which in turn calls check_stack_access_for_ptr_arithmetic(). There, +-EACCESS is returned if the register's offset is not constant, thereby +rejecting the program. + +In summary, an unprivileged user must never be able to create stack +pointers with a variable offset. That is also the case, because a +respective check in check_stack_write() is missing. If they were able +to create a variable-offset pointer, users could still use it in a +stack-write operation to trigger unsafe speculative behavior [1]. + +Because unprivileged users must already be prevented from creating +variable-offset stack pointers, viable options are to either remove +this check (replacing it with a clarifying comment), or to turn it +into a "verifier BUG"-message, also adding a similar check in +check_stack_write() (for consistency, as a second-level defense). +This patch implements the first option to reduce verifier bloat. + +This check was introduced by commit 01f810ace9ed ("bpf: Allow +variable-offset stack access") which correctly notes that +"variable-offset reads and writes are disallowed (they were already +disallowed for the indirect access case) because the speculative +execution checking code doesn't support them". However, it does not +further discuss why the check in check_stack_read() is necessary. +The code which made this check obsolete was also introduced in this +commit. + +I have compiled ~650 programs from the Linux selftests, Linux samples, +Cilium, and libbpf/examples projects and confirmed that none of these +trigger the check in check_stack_read() [2]. Instead, all of these +programs are, as expected, already rejected when constructing the +variable-offset pointers. Note that the check in +check_stack_access_for_ptr_arithmetic() also prints "off=%d" while the +code removed by this patch does not (the error removed does not appear +in the "verification_error" values). For reproducibility, the +repository linked includes the raw data and scripts used to create +the plot. + + [1] https://arxiv.org/pdf/1807.03757.pdf + [2] https://gitlab.cs.fau.de/un65esoq/bpf-spectre/-/raw/53dc19fcf459c186613b1156a81504b39c8d49db/data/plots/23-02-26_23-56_bpftool/bpftool/0004-errors.pdf?inline=false + +Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access") +Signed-off-by: Luis Gerhorst +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230315165358.23701-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 41601299f8b4a..261c2ed3adb17 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3114,17 +3114,13 @@ static int check_stack_read(struct bpf_verifier_env *env, + } + /* Variable offset is prohibited for unprivileged mode for simplicity + * since it requires corresponding support in Spectre masking for stack +- * ALU. See also retrieve_ptr_limit(). ++ * ALU. See also retrieve_ptr_limit(). The check in ++ * check_stack_access_for_ptr_arithmetic() called by ++ * adjust_ptr_min_max_vals() prevents users from creating stack pointers ++ * with variable offsets, therefore no check is required here. Further, ++ * just checking it here would be insufficient as speculative stack ++ * writes could still lead to unsafe speculative behaviour. + */ +- if (!env->bypass_spec_v1 && var_off) { +- char tn_buf[48]; +- +- tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off); +- verbose(env, "R%d variable offset stack access prohibited for !root, var_off=%s\n", +- ptr_regno, tn_buf); +- return -EACCES; +- } +- + if (!var_off) { + off += reg->var_off.value; + err = check_stack_read_fixed_off(env, state, off, size, +-- +2.39.2 + diff --git a/queue-5.15/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch b/queue-5.15/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch new file mode 100644 index 00000000000..4b5618fa77f --- /dev/null +++ b/queue-5.15/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch @@ -0,0 +1,83 @@ +From 29f0407839b1ca45aa5afbeae3c515a45c41d5f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 20:26:22 +0800 +Subject: bpf, sockmap: fix deadlocks in the sockhash and sockmap + +From: Xin Liu + +[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ] + +When huang uses sched_switch tracepoint, the tracepoint +does only one thing in the mounted ebpf program, which +deletes the fixed elements in sockhash ([0]) + +It seems that elements in sockhash are rarely actively +deleted by users or ebpf program. Therefore, we do not +pay much attention to their deletion. Compared with hash +maps, sockhash only provides spin_lock_bh protection. +This causes it to appear to have self-locking behavior +in the interrupt context. + + [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/ + +Reported-by: Hsin-Wei Hung +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Xin Liu +Acked-by: John Fastabend +Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 86b4e8909ad1e..36afe39dd2df9 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -414,8 +414,9 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + { + struct sock *sk; + int err = 0; ++ unsigned long flags; + +- raw_spin_lock_bh(&stab->lock); ++ raw_spin_lock_irqsave(&stab->lock, flags); + sk = *psk; + if (!sk_test || sk_test == sk) + sk = xchg(psk, NULL); +@@ -425,7 +426,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + else + err = -EINVAL; + +- raw_spin_unlock_bh(&stab->lock); ++ raw_spin_unlock_irqrestore(&stab->lock, flags); + return err; + } + +@@ -930,11 +931,12 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + struct bpf_shtab_bucket *bucket; + struct bpf_shtab_elem *elem; + int ret = -ENOENT; ++ unsigned long flags; + + hash = sock_hash_bucket_hash(key, key_size); + bucket = sock_hash_select_bucket(htab, hash); + +- raw_spin_lock_bh(&bucket->lock); ++ raw_spin_lock_irqsave(&bucket->lock, flags); + elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); + if (elem) { + hlist_del_rcu(&elem->node); +@@ -942,7 +944,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + sock_hash_free_elem(htab, elem); + ret = 0; + } +- raw_spin_unlock_bh(&bucket->lock); ++ raw_spin_unlock_irqrestore(&bucket->lock, flags); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch b/queue-5.15/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch new file mode 100644 index 00000000000..d8aedbd2e94 --- /dev/null +++ b/queue-5.15/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch @@ -0,0 +1,101 @@ +From 361d81232e4e6841d76dcd26421aff62f28fd6ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 20:28:42 +0200 +Subject: bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap + +From: Daniel Borkmann + +[ Upstream commit 8c5c2a4898e3d6bad86e29d471e023c8a19ba799 ] + +syzbot reported a splat and bisected it to recent commit ed17aa92dc56 ("bpf, +sockmap: fix deadlocks in the sockhash and sockmap"): + + [...] + WARNING: CPU: 1 PID: 9280 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 + Modules linked in: + CPU: 1 PID: 9280 Comm: syz-executor.1 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 + RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 + [...] + Call Trace: + + spin_unlock_bh include/linux/spinlock.h:395 [inline] + sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165 + sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184 + sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945 + map_delete_elem kernel/bpf/syscall.c:1536 [inline] + __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053 + __do_sys_bpf kernel/bpf/syscall.c:5166 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5164 [inline] + __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + RIP: 0033:0x7fe8f7c8c169 + + [...] + +Revert for now until we have a proper solution. + +Fixes: ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap") +Reported-by: syzbot+49f6cef45247ff249498@syzkaller.appspotmail.com +Cc: Hsin-Wei Hung +Cc: Xin Liu +Cc: John Fastabend +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/000000000000f1db9605f939720e@google.com/ +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 36afe39dd2df9..86b4e8909ad1e 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -414,9 +414,8 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + { + struct sock *sk; + int err = 0; +- unsigned long flags; + +- raw_spin_lock_irqsave(&stab->lock, flags); ++ raw_spin_lock_bh(&stab->lock); + sk = *psk; + if (!sk_test || sk_test == sk) + sk = xchg(psk, NULL); +@@ -426,7 +425,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + else + err = -EINVAL; + +- raw_spin_unlock_irqrestore(&stab->lock, flags); ++ raw_spin_unlock_bh(&stab->lock); + return err; + } + +@@ -931,12 +930,11 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + struct bpf_shtab_bucket *bucket; + struct bpf_shtab_elem *elem; + int ret = -ENOENT; +- unsigned long flags; + + hash = sock_hash_bucket_hash(key, key_size); + bucket = sock_hash_select_bucket(htab, hash); + +- raw_spin_lock_irqsave(&bucket->lock, flags); ++ raw_spin_lock_bh(&bucket->lock); + elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); + if (elem) { + hlist_del_rcu(&elem->node); +@@ -944,7 +942,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + sock_hash_free_elem(htab, elem); + ret = 0; + } +- raw_spin_unlock_irqrestore(&bucket->lock, flags); ++ raw_spin_unlock_bh(&bucket->lock); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/bpf-take-into-account-liveness-when-propagating-prec.patch b/queue-5.15/bpf-take-into-account-liveness-when-propagating-prec.patch new file mode 100644 index 00000000000..91fa1193aa1 --- /dev/null +++ b/queue-5.15/bpf-take-into-account-liveness-when-propagating-prec.patch @@ -0,0 +1,61 @@ +From 249dab06d0e28e82767d05453e7a6decbacb814e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 14:41:31 -0800 +Subject: bpf: take into account liveness when propagating precision + +From: Andrii Nakryiko + +[ Upstream commit 52c2b005a3c18c565fc70cfd0ca49375f301e952 ] + +When doing state comparison, if old state has register that is not +marked as REG_LIVE_READ, then we just skip comparison, regardless what's +the state of corresponing register in current state. This is because not +REG_LIVE_READ register is irrelevant for further program execution and +correctness. All good here. + +But when we get to precision propagation, after two states were declared +equivalent, we don't take into account old register's liveness, and thus +attempt to propagate precision for register in current state even if +that register in old state was not REG_LIVE_READ anymore. This is bad, +because register in current state could be anything at all and this +could cause -EFAULT due to internal logic bugs. + +Fix by taking into account REG_LIVE_READ liveness mark to keep the logic +in state comparison in sync with precision propagation. + +Fixes: a3ce685dd01a ("bpf: fix precision tracking") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20230309224131.57449-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 37d4b5f5ec0c3..8e6f868d6cb9b 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -10616,7 +10616,8 @@ static int propagate_precision(struct bpf_verifier_env *env, + state_reg = state->regs; + for (i = 0; i < BPF_REG_FP; i++, state_reg++) { + if (state_reg->type != SCALAR_VALUE || +- !state_reg->precise) ++ !state_reg->precise || ++ !(state_reg->live & REG_LIVE_READ)) + continue; + if (env->log.level & BPF_LOG_LEVEL2) + verbose(env, "frame %d: propagating r%d\n", i, fr); +@@ -10630,7 +10631,8 @@ static int propagate_precision(struct bpf_verifier_env *env, + continue; + state_reg = &state->stack[i].spilled_ptr; + if (state_reg->type != SCALAR_VALUE || +- !state_reg->precise) ++ !state_reg->precise || ++ !(state_reg->live & REG_LIVE_READ)) + continue; + if (env->log.level & BPF_LOG_LEVEL2) + verbose(env, "frame %d: propagating fp%d\n", +-- +2.39.2 + diff --git a/queue-5.15/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch b/queue-5.15/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch new file mode 100644 index 00000000000..6cc556bc06f --- /dev/null +++ b/queue-5.15/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch @@ -0,0 +1,46 @@ +From ac143bf133b271ba82a04134d62bf067230e0d1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:21:15 +0100 +Subject: bpftool: Fix bug for long instructions in program CFG dumps + +From: Quentin Monnet + +[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ] + +When dumping the control flow graphs for programs using the 16-byte long +load instruction, we need to skip the second part of this instruction +when looking for the next instruction to process. Otherwise, we end up +printing "BUG_ld_00" from the kernel disassembler in the CFG. + +Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information") +Signed-off-by: Quentin Monnet +Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/xlated_dumper.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index f1f32e21d5cd0..b91c62d0a7d62 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -369,8 +369,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end, + struct bpf_insn *insn_start = buf_start; + struct bpf_insn *insn_end = buf_end; + struct bpf_insn *cur = insn_start; ++ bool double_insn = false; + + for (; cur <= insn_end; cur++) { ++ if (double_insn) { ++ double_insn = false; ++ continue; ++ } ++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW); ++ + printf("% 4d: ", (int)(cur - insn_start + start_idx)); + print_bpf_insn(&cbs, cur, true); + if (cur != insn_end) +-- +2.39.2 + diff --git a/queue-5.15/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch b/queue-5.15/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch new file mode 100644 index 00000000000..bc900d8dfcb --- /dev/null +++ b/queue-5.15/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch @@ -0,0 +1,74 @@ +From d35d366cef918a22d45647dfaf358df710be8a36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:32:27 +0100 +Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ] + +When returning from of_parse_phandle_with_args(), the np member of the +of_phandle_args structure should be put after usage. Add missing +of_node_put() calls in both __set_clk_parents() and __set_clk_rates(). + +Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree") +Signed-off-by: Clément Léger +Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-conf.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c +index 2ef819606c417..1a4e6340f95ce 100644 +--- a/drivers/clk/clk-conf.c ++++ b/drivers/clk/clk-conf.c +@@ -33,9 +33,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + pclk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(pclk)) { + if (PTR_ERR(pclk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get parent clock %d for %pOF\n", +@@ -48,10 +51,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + if (rc < 0) + goto err; + if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + rc = 0; + goto err; + } + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get assigned clock %d for %pOF\n", +@@ -93,10 +98,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get clock %d for %pOF\n", +-- +2.39.2 + diff --git a/queue-5.15/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch b/queue-5.15/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch new file mode 100644 index 00000000000..c02a2a30ef0 --- /dev/null +++ b/queue-5.15/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch @@ -0,0 +1,38 @@ +From b611ab0ea19d21f435cf8d5dbcc8367cbbbaf38b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 12:59:31 +0200 +Subject: clk: at91: clk-sam9x60-pll: fix return value check + +From: Claudiu Beznea + +[ Upstream commit 1bd8e27fd0db0fe7f489213836dcbab92934f8fa ] + +sam9x60_frac_pll_compute_mul_frac() can't return zero. Remove the check +against zero to reflect this. + +Fixes: 43b1bb4a9b3e ("clk: at91: clk-sam9x60-pll: re-factor to support plls with multiple outputs") +Reported-by: Dan Carpenter +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230227105931.2812412-1-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-sam9x60-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c +index 1f52409475e9c..a6600afa21454 100644 +--- a/drivers/clk/at91/clk-sam9x60-pll.c ++++ b/drivers/clk/at91/clk-sam9x60-pll.c +@@ -561,7 +561,7 @@ sam9x60_clk_register_frac_pll(struct regmap *regmap, spinlock_t *lock, + + ret = sam9x60_frac_pll_compute_mul_frac(&frac->core, FCORE_MIN, + parent_rate, true); +- if (ret <= 0) { ++ if (ret < 0) { + hw = ERR_PTR(ret); + goto free; + } +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch b/queue-5.15/clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch new file mode 100644 index 00000000000..b4392d56226 --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch @@ -0,0 +1,252 @@ +From 0d2df5e9d5f97e9e3e1e2017b9aecd943a0bd594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 00:47:19 +0200 +Subject: clk: qcom: gcc-sm6115: Mark RCGs shared where applicable + +From: Konrad Dybcio + +[ Upstream commit 996c32b745a15a637e8244a25f06b74acce98976 ] + +The vast majority of shared RCGs were not marked as such. Fix it. + +Fixes: cbe63bfdc54f ("clk: qcom: Add Global Clock controller (GCC) driver for SM6115") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230404224719.909746-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm6115.c | 50 +++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm6115.c b/drivers/clk/qcom/gcc-sm6115.c +index e24a977c25806..1c3be4e07d5bc 100644 +--- a/drivers/clk/qcom/gcc-sm6115.c ++++ b/drivers/clk/qcom/gcc-sm6115.c +@@ -720,7 +720,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = { + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -741,7 +741,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = { + .parent_data = gcc_parents_9, + .num_parents = ARRAY_SIZE(gcc_parents_9), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -764,7 +764,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = { + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -779,7 +779,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = { + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -794,7 +794,7 @@ static struct clk_rcg2 gcc_camss_csi2phytimer_clk_src = { + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -816,7 +816,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -831,7 +831,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -846,7 +846,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -861,7 +861,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -883,7 +883,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = { + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -907,7 +907,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = { + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -942,7 +942,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = { + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -967,7 +967,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -982,7 +982,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = { + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -997,7 +997,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1012,7 +1012,7 @@ static struct clk_rcg2 gcc_camss_tfe_2_clk_src = { + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1027,7 +1027,7 @@ static struct clk_rcg2 gcc_camss_tfe_2_csid_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1050,7 +1050,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = { + .parent_data = gcc_parents_10, + .num_parents = ARRAY_SIZE(gcc_parents_10), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1072,7 +1072,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = { + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1142,7 +1142,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = { + .name = "gcc_pdm2_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1355,7 +1355,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = { + .name = "gcc_ufs_phy_axi_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1377,7 +1377,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = { + .name = "gcc_ufs_phy_ice_core_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1418,7 +1418,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = { + .name = "gcc_ufs_phy_unipro_core_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1440,7 +1440,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = { + .name = "gcc_usb30_prim_master_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1509,7 +1509,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = { + .parent_data = gcc_parents_13, + .num_parents = ARRAY_SIZE(gcc_parents_13), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch b/queue-5.15/clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch new file mode 100644 index 00000000000..093333d329b --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch @@ -0,0 +1,111 @@ +From 8e8f2a344abc5e4ab4664b9bab40794e2eb52e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 16:48:29 +0300 +Subject: clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling + +From: Dmitry Baryshkov + +[ Upstream commit 1a500e0bc97b6cb3c0d9859e81973b8dd07d1b7b ] + +On SM8350 platform the PCIe PIPE clocks require additional handling to +function correctly. They are to be switched to the tcxo source before +turning PCIe GDSCs off and should be switched to PHY PIPE source once +they are working. Switch PCIe PHY clocks to use clk_regmap_phy_mux_ops, +which provide support for this dance. + +Fixes: 44c20c9ed37f ("clk: qcom: gcc: Add clock driver for SM8350") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412134829.3686467-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8350.c | 47 ++++++++++------------------------- + 1 file changed, 13 insertions(+), 34 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm8350.c b/drivers/clk/qcom/gcc-sm8350.c +index 6d0a9e2d51041..87d03b1684ed0 100644 +--- a/drivers/clk/qcom/gcc-sm8350.c ++++ b/drivers/clk/qcom/gcc-sm8350.c +@@ -16,6 +16,7 @@ + #include "clk-regmap.h" + #include "clk-regmap-divider.h" + #include "clk-regmap-mux.h" ++#include "clk-regmap-phy-mux.h" + #include "gdsc.h" + #include "reset.h" + +@@ -166,26 +167,6 @@ static const struct clk_parent_data gcc_parent_data_3[] = { + { .fw_name = "core_bi_pll_test_se" }, + }; + +-static const struct parent_map gcc_parent_map_4[] = { +- { P_PCIE_0_PIPE_CLK, 0 }, +- { P_BI_TCXO, 2 }, +-}; +- +-static const struct clk_parent_data gcc_parent_data_4[] = { +- { .fw_name = "pcie_0_pipe_clk", }, +- { .fw_name = "bi_tcxo" }, +-}; +- +-static const struct parent_map gcc_parent_map_5[] = { +- { P_PCIE_1_PIPE_CLK, 0 }, +- { P_BI_TCXO, 2 }, +-}; +- +-static const struct clk_parent_data gcc_parent_data_5[] = { +- { .fw_name = "pcie_1_pipe_clk" }, +- { .fw_name = "bi_tcxo" }, +-}; +- + static const struct parent_map gcc_parent_map_6[] = { + { P_BI_TCXO, 0 }, + { P_GCC_GPLL0_OUT_MAIN, 1 }, +@@ -288,32 +269,30 @@ static const struct clk_parent_data gcc_parent_data_14[] = { + { .fw_name = "bi_tcxo" }, + }; + +-static struct clk_regmap_mux gcc_pcie_0_pipe_clk_src = { ++static struct clk_regmap_phy_mux gcc_pcie_0_pipe_clk_src = { + .reg = 0x6b054, +- .shift = 0, +- .width = 2, +- .parent_map = gcc_parent_map_4, + .clkr = { + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_0_pipe_clk_src", +- .parent_data = gcc_parent_data_4, +- .num_parents = ARRAY_SIZE(gcc_parent_data_4), +- .ops = &clk_regmap_mux_closest_ops, ++ .parent_data = &(const struct clk_parent_data){ ++ .fw_name = "pcie_0_pipe_clk", ++ }, ++ .num_parents = 1, ++ .ops = &clk_regmap_phy_mux_ops, + }, + }, + }; + +-static struct clk_regmap_mux gcc_pcie_1_pipe_clk_src = { ++static struct clk_regmap_phy_mux gcc_pcie_1_pipe_clk_src = { + .reg = 0x8d054, +- .shift = 0, +- .width = 2, +- .parent_map = gcc_parent_map_5, + .clkr = { + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_1_pipe_clk_src", +- .parent_data = gcc_parent_data_5, +- .num_parents = ARRAY_SIZE(gcc_parent_data_5), +- .ops = &clk_regmap_mux_closest_ops, ++ .parent_data = &(const struct clk_parent_data){ ++ .fw_name = "pcie_1_pipe_clk", ++ }, ++ .num_parents = 1, ++ .ops = &clk_regmap_phy_mux_ops, + }, + }, + }; +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-regmap-add-phy-clock-source-implementation.patch b/queue-5.15/clk-qcom-regmap-add-phy-clock-source-implementation.patch new file mode 100644 index 00000000000..a03b8c840ff --- /dev/null +++ b/queue-5.15/clk-qcom-regmap-add-phy-clock-source-implementation.patch @@ -0,0 +1,173 @@ +From 1dc00e8025081841216e587ea4c4825edd48dce6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 13:52:34 +0300 +Subject: clk: qcom: regmap: add PHY clock source implementation + +From: Dmitry Baryshkov + +[ Upstream commit 74e4190cdebe5a4aa099185edb4db418fc9883e3 ] + +On recent Qualcomm platforms the QMP PIPE clocks feed into a set of +muxes which must be parked to the "safe" source (bi_tcxo) when +corresponding GDSC is turned off and on again. Currently this is +handcoded in the PCIe driver by reparenting the gcc_pipe_N_clk_src +clock. However the same code sequence should be applied in the +pcie-qcom endpoint, USB3 and UFS drivers. + +Rather than copying this sequence over and over again, follow the +example of clk_rcg2_shared_ops and implement this parking in the +enable() and disable() clock operations. Supplement the regmap-mux with +the new clk_regmap_phy_mux type, which implements such multiplexers +as a simple gate clocks. + +This is possible since each of these multiplexers has just two clock +sources: one coming from the PHY and a reference (XO) one. If the clock +is running off the from-PHY source, report it as enabled. Report it as +disabled otherwise (if it uses reference source). + +This way the PHY will disable the pipe clock before turning off the +GDSC, which in turn would lead to disabling corresponding pipe_clk_src +(and thus it being parked to a safe, reference clock source). And vice +versa, after enabling the GDSC the PHY will enable the pipe clock, which +would cause pipe_clk_src to be switched from a safe source to the +working one. + +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Reported-by: kernel test robot +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220608105238.2973600-2-dmitry.baryshkov@linaro.org +Stable-dep-of: 1a500e0bc97b ("clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/Makefile | 1 + + drivers/clk/qcom/clk-regmap-phy-mux.c | 62 +++++++++++++++++++++++++++ + drivers/clk/qcom/clk-regmap-phy-mux.h | 33 ++++++++++++++ + 3 files changed, 96 insertions(+) + create mode 100644 drivers/clk/qcom/clk-regmap-phy-mux.c + create mode 100644 drivers/clk/qcom/clk-regmap-phy-mux.h + +diff --git a/drivers/clk/qcom/Makefile b/drivers/clk/qcom/Makefile +index 9825ef843f4a0..63c356ae32f23 100644 +--- a/drivers/clk/qcom/Makefile ++++ b/drivers/clk/qcom/Makefile +@@ -11,6 +11,7 @@ clk-qcom-y += clk-branch.o + clk-qcom-y += clk-regmap-divider.o + clk-qcom-y += clk-regmap-mux.o + clk-qcom-y += clk-regmap-mux-div.o ++clk-qcom-y += clk-regmap-phy-mux.o + clk-qcom-$(CONFIG_KRAIT_CLOCKS) += clk-krait.o + clk-qcom-y += clk-hfpll.o + clk-qcom-y += reset.o +diff --git a/drivers/clk/qcom/clk-regmap-phy-mux.c b/drivers/clk/qcom/clk-regmap-phy-mux.c +new file mode 100644 +index 0000000000000..7b7243b7107dc +--- /dev/null ++++ b/drivers/clk/qcom/clk-regmap-phy-mux.c +@@ -0,0 +1,62 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* ++ * Copyright (c) 2022, Linaro Ltd. ++ */ ++ ++#include ++#include ++#include ++#include ++ ++#include "clk-regmap.h" ++#include "clk-regmap-phy-mux.h" ++ ++#define PHY_MUX_MASK GENMASK(1, 0) ++#define PHY_MUX_PHY_SRC 0 ++#define PHY_MUX_REF_SRC 2 ++ ++static inline struct clk_regmap_phy_mux *to_clk_regmap_phy_mux(struct clk_regmap *clkr) ++{ ++ return container_of(clkr, struct clk_regmap_phy_mux, clkr); ++} ++ ++static int phy_mux_is_enabled(struct clk_hw *hw) ++{ ++ struct clk_regmap *clkr = to_clk_regmap(hw); ++ struct clk_regmap_phy_mux *phy_mux = to_clk_regmap_phy_mux(clkr); ++ unsigned int val; ++ ++ regmap_read(clkr->regmap, phy_mux->reg, &val); ++ val = FIELD_GET(PHY_MUX_MASK, val); ++ ++ WARN_ON(val != PHY_MUX_PHY_SRC && val != PHY_MUX_REF_SRC); ++ ++ return val == PHY_MUX_PHY_SRC; ++} ++ ++static int phy_mux_enable(struct clk_hw *hw) ++{ ++ struct clk_regmap *clkr = to_clk_regmap(hw); ++ struct clk_regmap_phy_mux *phy_mux = to_clk_regmap_phy_mux(clkr); ++ ++ return regmap_update_bits(clkr->regmap, phy_mux->reg, ++ PHY_MUX_MASK, ++ FIELD_PREP(PHY_MUX_MASK, PHY_MUX_PHY_SRC)); ++} ++ ++static void phy_mux_disable(struct clk_hw *hw) ++{ ++ struct clk_regmap *clkr = to_clk_regmap(hw); ++ struct clk_regmap_phy_mux *phy_mux = to_clk_regmap_phy_mux(clkr); ++ ++ regmap_update_bits(clkr->regmap, phy_mux->reg, ++ PHY_MUX_MASK, ++ FIELD_PREP(PHY_MUX_MASK, PHY_MUX_REF_SRC)); ++} ++ ++const struct clk_ops clk_regmap_phy_mux_ops = { ++ .enable = phy_mux_enable, ++ .disable = phy_mux_disable, ++ .is_enabled = phy_mux_is_enabled, ++}; ++EXPORT_SYMBOL_GPL(clk_regmap_phy_mux_ops); +diff --git a/drivers/clk/qcom/clk-regmap-phy-mux.h b/drivers/clk/qcom/clk-regmap-phy-mux.h +new file mode 100644 +index 0000000000000..614dd384695ca +--- /dev/null ++++ b/drivers/clk/qcom/clk-regmap-phy-mux.h +@@ -0,0 +1,33 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++/* ++ * Copyright (c) 2022, Linaro Ltd. ++ */ ++ ++#ifndef __QCOM_CLK_REGMAP_PHY_MUX_H__ ++#define __QCOM_CLK_REGMAP_PHY_MUX_H__ ++ ++#include "clk-regmap.h" ++ ++/* ++ * A clock implementation for PHY pipe and symbols clock muxes. ++ * ++ * If the clock is running off the from-PHY source, report it as enabled. ++ * Report it as disabled otherwise (if it uses reference source). ++ * ++ * This way the PHY will disable the pipe clock before turning off the GDSC, ++ * which in turn would lead to disabling corresponding pipe_clk_src (and thus ++ * it being parked to a safe, reference clock source). And vice versa, after ++ * enabling the GDSC the PHY will enable the pipe clock, which would cause ++ * pipe_clk_src to be switched from a safe source to the working one. ++ * ++ * For some platforms this should be used for the UFS symbol_clk_src clocks ++ * too. ++ */ ++struct clk_regmap_phy_mux { ++ u32 reg; ++ struct clk_regmap clkr; ++}; ++ ++extern const struct clk_ops clk_regmap_phy_mux_ops; ++ ++#endif +-- +2.39.2 + diff --git a/queue-5.15/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch b/queue-5.15/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch new file mode 100644 index 00000000000..caf2536ca81 --- /dev/null +++ b/queue-5.15/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch @@ -0,0 +1,101 @@ +From 11f9a3cf1193cf285caaa9659bc67eb10fa6a77e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 13:50:37 +0000 +Subject: clocksource/drivers/davinci: Fix memory leak in + davinci_timer_register when init fails + +From: Qinrun Dai + +[ Upstream commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 ] + +Smatch reports: +drivers/clocksource/timer-davinci.c:332 davinci_timer_register() +warn: 'base' from ioremap() not released on lines: 274. + +Fix this and other potential memory leak problems +by adding a set of corresponding exit lables. + +Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents") +Signed-off-by: Qinrun Dai +Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-davinci.c | 30 +++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c +index 9996c05425200..b1c248498be46 100644 +--- a/drivers/clocksource/timer-davinci.c ++++ b/drivers/clocksource/timer-davinci.c +@@ -257,21 +257,25 @@ int __init davinci_timer_register(struct clk *clk, + resource_size(&timer_cfg->reg), + "davinci-timer")) { + pr_err("Unable to request memory region\n"); +- return -EBUSY; ++ rv = -EBUSY; ++ goto exit_clk_disable; + } + + base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg)); + if (!base) { + pr_err("Unable to map the register range\n"); +- return -ENOMEM; ++ rv = -ENOMEM; ++ goto exit_mem_region; + } + + davinci_timer_init(base); + tick_rate = clk_get_rate(clk); + + clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL); +- if (!clockevent) +- return -ENOMEM; ++ if (!clockevent) { ++ rv = -ENOMEM; ++ goto exit_iounmap_base; ++ } + + clockevent->dev.name = "tim12"; + clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT; +@@ -296,7 +300,7 @@ int __init davinci_timer_register(struct clk *clk, + "clockevent/tim12", clockevent); + if (rv) { + pr_err("Unable to request the clockevent interrupt\n"); +- return rv; ++ goto exit_free_clockevent; + } + + davinci_clocksource.dev.rating = 300; +@@ -323,13 +327,27 @@ int __init davinci_timer_register(struct clk *clk, + rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate); + if (rv) { + pr_err("Unable to register clocksource\n"); +- return rv; ++ goto exit_free_irq; + } + + sched_clock_register(davinci_timer_read_sched_clock, + DAVINCI_TIMER_CLKSRC_BITS, tick_rate); + + return 0; ++ ++exit_free_irq: ++ free_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start, ++ clockevent); ++exit_free_clockevent: ++ kfree(clockevent); ++exit_iounmap_base: ++ iounmap(base); ++exit_mem_region: ++ release_mem_region(timer_cfg->reg.start, ++ resource_size(&timer_cfg->reg)); ++exit_clk_disable: ++ clk_disable_unprepare(clk); ++ return rv; + } + + static int __init of_davinci_timer_register(struct device_node *np) +-- +2.39.2 + diff --git a/queue-5.15/coresight-etm_pmu-set-the-module-field.patch b/queue-5.15/coresight-etm_pmu-set-the-module-field.patch new file mode 100644 index 00000000000..8b8067ea30a --- /dev/null +++ b/queue-5.15/coresight-etm_pmu-set-the-module-field.patch @@ -0,0 +1,35 @@ +From d1d11df44ecb1ca877077e17cf081655bdcb93d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 10:49:22 +0100 +Subject: coresight: etm_pmu: Set the module field + +From: Suzuki K Poulose + +[ Upstream commit 18996a113f2567aef3057e300e3193ce2df1684c ] + +struct pmu::module must be set to the module owning the PMU driver. +Set this for the coresight etm_pmu. + +Fixes: 8e264c52e1dab ("coresight: core: Allow the coresight core driver to be built as a module") +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230405094922.667834-1-suzuki.poulose@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm-perf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c +index 8ebd728d3a800..1feb8f0e6556a 100644 +--- a/drivers/hwtracing/coresight/coresight-etm-perf.c ++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c +@@ -830,6 +830,7 @@ int __init etm_perf_init(void) + etm_pmu.addr_filters_sync = etm_addr_filters_sync; + etm_pmu.addr_filters_validate = etm_addr_filters_validate; + etm_pmu.nr_addr_filters = ETM_ADDR_CMP_MAX; ++ etm_pmu.module = THIS_MODULE; + + ret = perf_pmu_register(&etm_pmu, CORESIGHT_ETM_PMU_NAME, -1); + if (ret == 0) +-- +2.39.2 + diff --git a/queue-5.15/cpufreq-use-correct-unit-when-verify-cur-freq.patch b/queue-5.15/cpufreq-use-correct-unit-when-verify-cur-freq.patch new file mode 100644 index 00000000000..00ebd511f91 --- /dev/null +++ b/queue-5.15/cpufreq-use-correct-unit-when-verify-cur-freq.patch @@ -0,0 +1,43 @@ +From ba3233b212bf1aa63e92c9abd8f5372cbf793426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 17:04:54 +0530 +Subject: cpufreq: use correct unit when verify cur freq + +From: Sanjay Chandrashekara + +[ Upstream commit 44295af5019f1997d038ad2611086a2d1e2af167 ] + +cpufreq_verify_current_freq checks() if the frequency returned by +the hardware has a slight delta with the valid frequency value +last set and returns "policy->cur" if the delta is within "1 MHz". +In the comparison, "policy->cur" is in "kHz" but it's compared +against HZ_PER_MHZ. So, the comparison range becomes "1 GHz". + +Fix this by comparing against KHZ_PER_MHZ instead of HZ_PER_MHZ. + +Fixes: f55ae08c8987 ("cpufreq: Avoid unnecessary frequency updates due to mismatch") +Signed-off-by: Sanjay Chandrashekara +[ sumit gupta: Commit message update ] +Signed-off-by: Sumit Gupta +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index b998b50839534..ae7b95e15ac7e 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1709,7 +1709,7 @@ static unsigned int cpufreq_verify_current_freq(struct cpufreq_policy *policy, b + * MHz. In such cases it is better to avoid getting into + * unnecessary frequency updates. + */ +- if (abs(policy->cur - new_freq) < HZ_PER_MHZ) ++ if (abs(policy->cur - new_freq) < KHZ_PER_MHZ) + return policy->cur; + + cpufreq_out_of_sync(policy, new_freq); +-- +2.39.2 + diff --git a/queue-5.15/crypto-caam-clear-some-memory-in-instantiate_rng.patch b/queue-5.15/crypto-caam-clear-some-memory-in-instantiate_rng.patch new file mode 100644 index 00000000000..da3f21188f6 --- /dev/null +++ b/queue-5.15/crypto-caam-clear-some-memory-in-instantiate_rng.patch @@ -0,0 +1,52 @@ +From d681dab3039ecfd6a3b3546d9febd5bc8c179986 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 07:59:30 +0100 +Subject: crypto: caam - Clear some memory in instantiate_rng + +From: Christophe JAILLET + +[ Upstream commit 9c19fb86a8cb2ee82a832c95e139f29ea05c4d08 ] + +According to the comment at the end of the 'for' loop just a few lines +below, it looks needed to clear 'desc'. + +So it should also be cleared for the first iteration. + +Move the memset() to the beginning of the loop to be safe. + +Fixes: 281922a1d4f5 ("crypto: caam - add support for SEC v5.x RNG4") +Signed-off-by: Christophe JAILLET +Reviewed-by: Gaurav Jain +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/ctrl.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c +index f87aa2169e5f5..f9a1ec3c84851 100644 +--- a/drivers/crypto/caam/ctrl.c ++++ b/drivers/crypto/caam/ctrl.c +@@ -284,6 +284,10 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask, + const u32 rdsta_if = RDSTA_IF0 << sh_idx; + const u32 rdsta_pr = RDSTA_PR0 << sh_idx; + const u32 rdsta_mask = rdsta_if | rdsta_pr; ++ ++ /* Clear the contents before using the descriptor */ ++ memset(desc, 0x00, CAAM_CMD_SZ * 7); ++ + /* + * If the corresponding bit is set, this state handle + * was initialized by somebody else, so it's left alone. +@@ -327,8 +331,6 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask, + } + + dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx); +- /* Clear the contents before recreating the descriptor */ +- memset(desc, 0x00, CAAM_CMD_SZ * 7); + } + + kfree(desc); +-- +2.39.2 + diff --git a/queue-5.15/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch b/queue-5.15/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch new file mode 100644 index 00000000000..c1ed7bbd066 --- /dev/null +++ b/queue-5.15/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch @@ -0,0 +1,68 @@ +From 174a5f79d0ede1f66878575cc1ea30ffbd536fd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 15:18:08 +0100 +Subject: crypto: drbg - make drbg_prepare_hrng() handle jent instantiation + errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nicolai Stange + +[ Upstream commit 559edd47cce4cc407d606b4d7f376822816fd4b8 ] + +Now that drbg_prepare_hrng() doesn't do anything but to instantiate a +jitterentropy crypto_rng instance, it looks a little odd to have the +related error handling at its only caller, drbg_instantiate(). + +Move the handling of jitterentropy allocation failures from +drbg_instantiate() close to the allocation itself in drbg_prepare_hrng(). + +There is no change in behaviour. + +Signed-off-by: Nicolai Stange +Reviewed-by: Stephan Müller +Signed-off-by: Herbert Xu +Stable-dep-of: 686cd976b6dd ("crypto: drbg - Only fail when jent is unavailable in FIPS mode") +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index 761104e93d44a..c89e26e677404 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1516,6 +1516,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + return 0; + + drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); ++ if (IS_ERR(drbg->jent)) { ++ const int err = PTR_ERR(drbg->jent); ++ ++ drbg->jent = NULL; ++ if (fips_enabled || err != -ENOENT) ++ return err; ++ pr_info("DRBG: Continuing without Jitter RNG\n"); ++ } + + return 0; + } +@@ -1571,14 +1579,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, + if (ret) + goto free_everything; + +- if (IS_ERR(drbg->jent)) { +- ret = PTR_ERR(drbg->jent); +- drbg->jent = NULL; +- if (fips_enabled || ret != -ENOENT) +- goto free_everything; +- pr_info("DRBG: Continuing without Jitter RNG\n"); +- } +- + reseed = false; + } + +-- +2.39.2 + diff --git a/queue-5.15/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch b/queue-5.15/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch new file mode 100644 index 00000000000..f23590585e2 --- /dev/null +++ b/queue-5.15/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch @@ -0,0 +1,41 @@ +From e7e2b8502a962053fe4b709a54dc223aabd12171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 11:35:23 +0800 +Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode + +From: Herbert Xu + +[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] + +When jent initialisation fails for any reason other than ENOENT, +the entire drbg fails to initialise, even when we're not in FIPS +mode. This is wrong because we can still use the kernel RNG when +we're not in FIPS mode. + +Change it so that it only fails when we are in FIPS mode. + +Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") +Signed-off-by: Herbert Xu +Reviewed-by: Stephan Mueller +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index c89e26e677404..44b0a7f624021 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1520,7 +1520,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + const int err = PTR_ERR(drbg->jent); + + drbg->jent = NULL; +- if (fips_enabled || err != -ENOENT) ++ if (fips_enabled) + return err; + pr_info("DRBG: Continuing without Jitter RNG\n"); + } +-- +2.39.2 + diff --git a/queue-5.15/crypto-sa2ul-select-crypto_des.patch b/queue-5.15/crypto-sa2ul-select-crypto_des.patch new file mode 100644 index 00000000000..10f2a6d7f80 --- /dev/null +++ b/queue-5.15/crypto-sa2ul-select-crypto_des.patch @@ -0,0 +1,45 @@ +From b288a96ab178ed92acac42d481b1ee9b4ceb67d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 20:28:12 +0530 +Subject: crypto: sa2ul - Select CRYPTO_DES + +From: Suman Anna + +[ Upstream commit 8832023efd20966e29944dac92118dfbf1fa1bc0 ] + +The SA2UL Crypto driver provides support for couple of +DES3 algos "cbc(des3_ede)" and "ecb(des3_ede)", and enabling +the crypto selftest throws the following errors (as seen on +K3 J721E SoCs): + saul-crypto 4e00000.crypto: Error allocating fallback algo cbc(des3_ede) + alg: skcipher: failed to allocate transform for cbc-des3-sa2ul: -2 + saul-crypto 4e00000.crypto: Error allocating fallback algo ecb(des3_ede) + alg: skcipher: failed to allocate transform for ecb-des3-sa2ul: -2 + +Fix this by selecting CRYPTO_DES which was missed while +adding base driver support. + +Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver") +Signed-off-by: Suman Anna +Signed-off-by: Jayesh Choudhary +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig +index b46343b5c26b4..a40883e118424 100644 +--- a/drivers/crypto/Kconfig ++++ b/drivers/crypto/Kconfig +@@ -905,6 +905,7 @@ config CRYPTO_DEV_SA2UL + select CRYPTO_AES_ARM64 + select CRYPTO_ALGAPI + select CRYPTO_AUTHENC ++ select CRYPTO_DES + select CRYPTO_SHA1 + select CRYPTO_SHA256 + select CRYPTO_SHA512 +-- +2.39.2 + diff --git a/queue-5.15/debugobject-prevent-init-race-with-static-objects.patch b/queue-5.15/debugobject-prevent-init-race-with-static-objects.patch new file mode 100644 index 00000000000..9ef767a21bb --- /dev/null +++ b/queue-5.15/debugobject-prevent-init-race-with-static-objects.patch @@ -0,0 +1,283 @@ +From 91f8f2645e0882c24a24c0a6680a92b99b7d22a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 09:54:39 +0200 +Subject: debugobject: Prevent init race with static objects + +From: Thomas Gleixner + +[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ] + +Statically initialized objects are usually not initialized via the init() +function of the subsystem. They are special cased and the subsystem +provides a function to validate whether an object which is not yet tracked +by debugobjects is statically initialized. This means the object is started +to be tracked on first use, e.g. activation. + +This works perfectly fine, unless there are two concurrent operations on +that object. Schspa decoded the problem: + +T0 T1 + +debug_object_assert_init(addr) + lock_hash_bucket() + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + - > preemption + lock_subsytem_object(addr); + activate_object(addr) + lock_hash_bucket(); + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + if (is_static_object(addr)) + init_and_track(addr); + lock_hash_bucket(); + obj = lookup_object(addr); + obj->state = ACTIVATED; + unlock_hash_bucket(); + + subsys function modifies content of addr, + so static object detection does + not longer work. + + unlock_subsytem_object(addr); + + if (is_static_object(addr)) <- Fails + + debugobject emits a warning and invokes the fixup function which + reinitializes the already active object in the worst case. + +This race exists forever, but was never observed until mod_timer() got a +debug_object_assert_init() added which is outside of the timer base lock +held section right at the beginning of the function to cover the lockless +early exit points too. + +Rework the code so that the lookup, the static object check and the +tracking object association happens atomically under the hash bucket +lock. This prevents the issue completely as all callers are serialized on +the hash bucket lock and therefore cannot observe inconsistent state. + +Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects") +Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com +Debugged-by: Schspa Shi +Signed-off-by: Thomas Gleixner +Reviewed-by: Stephen Boyd +Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462 +Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com +Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx +Signed-off-by: Sasha Levin +--- + lib/debugobjects.c | 125 ++++++++++++++++++++++++--------------------- + 1 file changed, 66 insertions(+), 59 deletions(-) + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 793c31b7e417d..097071b5a11d9 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -219,10 +219,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list) + return obj; + } + +-/* +- * Allocate a new object. If the pool is empty, switch off the debugger. +- * Must be called with interrupts disabled. +- */ + static struct debug_obj * + alloc_object(void *addr, struct debug_bucket *b, const struct debug_obj_descr *descr) + { +@@ -555,11 +551,49 @@ static void debug_object_is_on_stack(void *addr, int onstack) + WARN_ON(1); + } + ++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b, ++ const struct debug_obj_descr *descr, ++ bool onstack, bool alloc_ifstatic) ++{ ++ struct debug_obj *obj = lookup_object(addr, b); ++ enum debug_obj_state state = ODEBUG_STATE_NONE; ++ ++ if (likely(obj)) ++ return obj; ++ ++ /* ++ * debug_object_init() unconditionally allocates untracked ++ * objects. It does not matter whether it is a static object or ++ * not. ++ * ++ * debug_object_assert_init() and debug_object_activate() allow ++ * allocation only if the descriptor callback confirms that the ++ * object is static and considered initialized. For non-static ++ * objects the allocation needs to be done from the fixup callback. ++ */ ++ if (unlikely(alloc_ifstatic)) { ++ if (!descr->is_static_object || !descr->is_static_object(addr)) ++ return ERR_PTR(-ENOENT); ++ /* Statically allocated objects are considered initialized */ ++ state = ODEBUG_STATE_INIT; ++ } ++ ++ obj = alloc_object(addr, b, descr); ++ if (likely(obj)) { ++ obj->state = state; ++ debug_object_is_on_stack(addr, onstack); ++ return obj; ++ } ++ ++ /* Out of memory. Do the cleanup outside of the locked region */ ++ debug_objects_enabled = 0; ++ return NULL; ++} ++ + static void + __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack) + { + enum debug_obj_state state; +- bool check_stack = false; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -575,16 +609,11 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (!obj) { +- obj = alloc_object(addr, db, descr); +- if (!obj) { +- debug_objects_enabled = 0; +- raw_spin_unlock_irqrestore(&db->lock, flags); +- debug_objects_oom(); +- return; +- } +- check_stack = true; ++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false); ++ if (unlikely(!obj)) { ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_objects_oom(); ++ return; + } + + switch (obj->state) { +@@ -610,8 +639,6 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack + } + + raw_spin_unlock_irqrestore(&db->lock, flags); +- if (check_stack) +- debug_object_is_on_stack(addr, onstack); + } + + /** +@@ -651,14 +678,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack); + */ + int debug_object_activate(void *addr, const struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + enum debug_obj_state state; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; + int ret; +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; + + if (!debug_objects_enabled) + return 0; +@@ -667,8 +692,8 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (obj) { ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ if (likely(!IS_ERR_OR_NULL(obj))) { + bool print_object = false; + + switch (obj->state) { +@@ -701,24 +726,16 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) + + raw_spin_unlock_irqrestore(&db->lock, flags); + +- /* +- * We are here when a static object is activated. We +- * let the type specific code confirm whether this is +- * true or not. if true, we just make sure that the +- * static object is tracked in the object tracker. If +- * not, this must be a bug, so we try to fix it up. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* track this static object */ +- debug_object_init(addr, descr); +- debug_object_activate(addr, descr); +- } else { +- debug_print_object(&o, "activate"); +- ret = debug_object_fixup(descr->fixup_activate, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- return ret ? 0 : -EINVAL; ++ /* If NULL the allocation has hit OOM */ ++ if (!obj) { ++ debug_objects_oom(); ++ return 0; + } +- return 0; ++ ++ /* Object is neither static nor tracked. It's not initialized */ ++ debug_print_object(&o, "activate"); ++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE); ++ return ret ? 0 : -EINVAL; + } + EXPORT_SYMBOL_GPL(debug_object_activate); + +@@ -872,6 +889,7 @@ EXPORT_SYMBOL_GPL(debug_object_free); + */ + void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -882,31 +900,20 @@ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr) + db = get_bucket((unsigned long) addr); + + raw_spin_lock_irqsave(&db->lock, flags); ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (likely(!IS_ERR_OR_NULL(obj))) ++ return; + +- obj = lookup_object(addr, db); ++ /* If NULL the allocation has hit OOM */ + if (!obj) { +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; +- +- raw_spin_unlock_irqrestore(&db->lock, flags); +- /* +- * Maybe the object is static, and we let the type specific +- * code confirm. Track this static object if true, else invoke +- * fixup. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* Track this static object */ +- debug_object_init(addr, descr); +- } else { +- debug_print_object(&o, "assert_init"); +- debug_object_fixup(descr->fixup_assert_init, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- } ++ debug_objects_oom(); + return; + } + +- raw_spin_unlock_irqrestore(&db->lock, flags); ++ /* Object is neither tracked nor static. It's not initialized. */ ++ debug_print_object(&o, "assert_init"); ++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE); + } + EXPORT_SYMBOL_GPL(debug_object_assert_init); + +-- +2.39.2 + diff --git a/queue-5.15/dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch b/queue-5.15/dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch new file mode 100644 index 00000000000..ff511b9dc61 --- /dev/null +++ b/queue-5.15/dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch @@ -0,0 +1,105 @@ +From 8a7b0a8b2eb7602662c2f1e4bc772b288e6f0995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 02:33:55 +0300 +Subject: dma: gpi: remove spurious unlock in gpi_ch_init + +From: Dmitry Baryshkov + +[ Upstream commit 91d6a468e335571f1e67e046050dea9af5fa4ebe ] + +gpi_ch_init() doesn't lock the ctrl_lock mutex, so there is no need to +unlock it too. Instead the mutex is handled by the function +gpi_alloc_chan_resources(), which properly locks and unlocks the mutex. + +===================================== +WARNING: bad unlock balance detected! +6.3.0-rc5-00253-g99792582ded1-dirty #15 Not tainted +------------------------------------- +kworker/u16:0/9 is trying to release lock (&gpii->ctrl_lock) at: +[] gpi_alloc_chan_resources+0x108/0x5bc +but there are no more locks to release! + +other info that might help us debug this: +6 locks held by kworker/u16:0/9: + #0: ffff575740010938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x220/0x594 + #1: ffff80000809bdd0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x220/0x594 + #2: ffff575740f2a0f8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x38/0x188 + #3: ffff57574b5570f8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x38/0x188 + #4: ffffb99d06a2f180 (of_dma_lock){+.+.}-{3:3}, at: of_dma_request_slave_channel+0x138/0x280 + #5: ffffb99d06a2ee20 (dma_list_mutex){+.+.}-{3:3}, at: dma_get_slave_channel+0x28/0x10c + +stack backtrace: +CPU: 7 PID: 9 Comm: kworker/u16:0 Not tainted 6.3.0-rc5-00253-g99792582ded1-dirty #15 +Hardware name: Google Pixel 3 (DT) +Workqueue: events_unbound deferred_probe_work_func +Call trace: + dump_backtrace+0xa0/0xfc + show_stack+0x18/0x24 + dump_stack_lvl+0x60/0xac + dump_stack+0x18/0x24 + print_unlock_imbalance_bug+0x130/0x148 + lock_release+0x270/0x300 + __mutex_unlock_slowpath+0x48/0x2cc + mutex_unlock+0x20/0x2c + gpi_alloc_chan_resources+0x108/0x5bc + dma_chan_get+0x84/0x188 + dma_get_slave_channel+0x5c/0x10c + gpi_of_dma_xlate+0x110/0x1a0 + of_dma_request_slave_channel+0x174/0x280 + dma_request_chan+0x3c/0x2d4 + geni_i2c_probe+0x544/0x63c + platform_probe+0x68/0xc4 + really_probe+0x148/0x2ac + __driver_probe_device+0x78/0xe0 + driver_probe_device+0x3c/0x160 + __device_attach_driver+0xb8/0x138 + bus_for_each_drv+0x84/0xe0 + __device_attach+0x9c/0x188 + device_initial_probe+0x14/0x20 + bus_probe_device+0xac/0xb0 + device_add+0x60c/0x7d8 + of_device_add+0x44/0x60 + of_platform_device_create_pdata+0x90/0x124 + of_platform_bus_create+0x15c/0x3c8 + of_platform_populate+0x58/0xf8 + devm_of_platform_populate+0x58/0xbc + geni_se_probe+0xf0/0x164 + platform_probe+0x68/0xc4 + really_probe+0x148/0x2ac + __driver_probe_device+0x78/0xe0 + driver_probe_device+0x3c/0x160 + __device_attach_driver+0xb8/0x138 + bus_for_each_drv+0x84/0xe0 + __device_attach+0x9c/0x188 + device_initial_probe+0x14/0x20 + bus_probe_device+0xac/0xb0 + deferred_probe_work_func+0x8c/0xc8 + process_one_work+0x2bc/0x594 + worker_thread+0x228/0x438 + kthread+0x108/0x10c + ret_from_fork+0x10/0x20 + +Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230409233355.453741-1-dmitry.baryshkov@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/gpi.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c +index 1a1b7d8458c93..1e87fe6c62af2 100644 +--- a/drivers/dma/qcom/gpi.c ++++ b/drivers/dma/qcom/gpi.c +@@ -1961,7 +1961,6 @@ static int gpi_ch_init(struct gchan *gchan) + error_config_int: + gpi_free_ring(&gpii->ev_ring, gpii); + exit_gpi_init: +- mutex_unlock(&gpii->ctrl_lock); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch b/queue-5.15/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch new file mode 100644 index 00000000000..e6879a692bb --- /dev/null +++ b/queue-5.15/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch @@ -0,0 +1,55 @@ +From 9f87e4fef7f93681b152cb45004293954dd3a8bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 17:18:25 +0200 +Subject: dmaengine: at_xdmac: do not enable all cyclic channels + +From: Claudiu Beznea + +[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ] + +Do not global enable all the cyclic channels in at_xdmac_resume(). Instead +save the global status in at_xdmac_suspend() and re-enable the cyclic +channel only if it was active before suspend. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_xdmac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index f7b0de4f4667d..80c609aa2a91c 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -243,6 +243,7 @@ struct at_xdmac { + int irq; + struct clk *clk; + u32 save_gim; ++ u32 save_gs; + struct dma_pool *at_xdmac_desc_pool; + const struct at_xdmac_layout *layout; + struct at_xdmac_chan chan[]; +@@ -1984,6 +1985,7 @@ static int atmel_xdmac_suspend(struct device *dev) + } + } + atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM); ++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS); + + at_xdmac_off(atxdmac); + clk_disable_unprepare(atxdmac->clk); +@@ -2023,7 +2025,8 @@ static int atmel_xdmac_resume(struct device *dev) + at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc); + at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim); + wmb(); +- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); ++ if (atxdmac->save_gs & atchan->mask) ++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); + } + } + return 0; +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-at_xdmac-fix-concurrency-over-chan-s-compl.patch b/queue-5.15/dmaengine-at_xdmac-fix-concurrency-over-chan-s-compl.patch new file mode 100644 index 00000000000..c379bbd8971 --- /dev/null +++ b/queue-5.15/dmaengine-at_xdmac-fix-concurrency-over-chan-s-compl.patch @@ -0,0 +1,42 @@ +From a679b2f1bd061d4a36bd58fe56cd5c23f968f495 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 13:01:07 +0200 +Subject: dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie + +From: Tudor Ambarus + +[ Upstream commit 506875c30fc5bf92246060bc3b4c38799646266b ] + +Caller of dma_cookie_complete is expected to hold a lock to prevent +concurrency over the channel's completed cookie marker. Call +dma_cookie_complete() with the lock held. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-5-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_xdmac.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index c5638afe94368..c6b200f0145ba 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1710,11 +1710,10 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) + } + + txd = &desc->tx_dma_desc; +- ++ dma_cookie_complete(txd); + at_xdmac_remove_xfer(atchan, desc); + spin_unlock_irq(&atchan->lock); + +- dma_cookie_complete(txd); + if (txd->flags & DMA_PREP_INTERRUPT) + dmaengine_desc_get_callback_invoke(txd, NULL); + +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-at_xdmac-fix-race-for-the-tx-desc-callback.patch b/queue-5.15/dmaengine-at_xdmac-fix-race-for-the-tx-desc-callback.patch new file mode 100644 index 00000000000..8a0caeb159c --- /dev/null +++ b/queue-5.15/dmaengine-at_xdmac-fix-race-for-the-tx-desc-callback.patch @@ -0,0 +1,85 @@ +From 70dea6dc22938a62825d23b4a7ebbf82129e3f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 13:01:08 +0200 +Subject: dmaengine: at_xdmac: Fix race for the tx desc callback + +From: Tudor Ambarus + +[ Upstream commit b63e5cb94ad6947ab5fe38b5a9417dcfd0bc6122 ] + +The transfer descriptors were wrongly moved to the free descriptors list +before calling the tx desc callback. As the DMA engine drivers drop any +locks before calling the callback function, txd could be taken again, +resulting in its callback called prematurely. Fix the race for the tx desc +callback by moving the xfer desc into the free desc list after the +callback is invoked. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-6-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_xdmac.c | 25 ++++++++----------------- + 1 file changed, 8 insertions(+), 17 deletions(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index c6b200f0145ba..f7b0de4f4667d 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1586,20 +1586,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + return ret; + } + +-/* Call must be protected by lock. */ +-static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, +- struct at_xdmac_desc *desc) +-{ +- dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); +- +- /* +- * Remove the transfer from the transfer list then move the transfer +- * descriptors into the free descriptors list. +- */ +- list_del(&desc->xfer_node); +- list_splice_init(&desc->descs_list, &atchan->free_descs_list); +-} +- + static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) + { + struct at_xdmac_desc *desc; +@@ -1711,7 +1697,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) + + txd = &desc->tx_dma_desc; + dma_cookie_complete(txd); +- at_xdmac_remove_xfer(atchan, desc); ++ /* Remove the transfer from the transfer list. */ ++ list_del(&desc->xfer_node); + spin_unlock_irq(&atchan->lock); + + if (txd->flags & DMA_PREP_INTERRUPT) +@@ -1720,6 +1707,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) + dma_run_dependencies(txd); + + spin_lock_irq(&atchan->lock); ++ /* Move the xfer descriptors into the free descriptors list. */ ++ list_splice_init(&desc->descs_list, &atchan->free_descs_list); + at_xdmac_advance_work(atchan); + spin_unlock_irq(&atchan->lock); + } +@@ -1866,8 +1855,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) + cpu_relax(); + + /* Cancel all pending transfers. */ +- list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) +- at_xdmac_remove_xfer(atchan, desc); ++ list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { ++ list_del(&desc->xfer_node); ++ list_splice_init(&desc->descs_list, &atchan->free_descs_list); ++ } + + clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); + clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status); +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch b/queue-5.15/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch new file mode 100644 index 00000000000..bb4c42c42e6 --- /dev/null +++ b/queue-5.15/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch @@ -0,0 +1,90 @@ +From f424ab31e479a8f17ad7a2ec985d254d5d943d53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 19:17:57 +0900 +Subject: dmaengine: dw-edma: Fix to change for continuous transfer + +From: Shunsuke Mie + +[ Upstream commit a251994a441ee0a69ba7062c8cd2d08ead3db379 ] + +The dw-edma driver stops after processing a DMA request even if a request +remains in the issued queue, which is not the expected behavior. The DMA +engine API requires continuous processing. + +Add a trigger to start after one processing finished if there are requests +remain. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Shunsuke Mie +Link: https://lore.kernel.org/r/20230411101758.438472-1-mie@igel.co.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 97f5e4e93cfc6..2a434c255b4a2 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -171,7 +171,7 @@ static void vchan_free_desc(struct virt_dma_desc *vdesc) + dw_edma_free_desc(vd2dw_edma_desc(vdesc)); + } + +-static void dw_edma_start_transfer(struct dw_edma_chan *chan) ++static int dw_edma_start_transfer(struct dw_edma_chan *chan) + { + struct dw_edma_chunk *child; + struct dw_edma_desc *desc; +@@ -179,16 +179,16 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan) + + vd = vchan_next_desc(&chan->vc); + if (!vd) +- return; ++ return 0; + + desc = vd2dw_edma_desc(vd); + if (!desc) +- return; ++ return 0; + + child = list_first_entry_or_null(&desc->chunk->list, + struct dw_edma_chunk, list); + if (!child) +- return; ++ return 0; + + dw_edma_v0_core_start(child, !desc->xfer_sz); + desc->xfer_sz += child->ll_region.sz; +@@ -196,6 +196,8 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan) + list_del(&child->list); + kfree(child); + desc->chunks_alloc--; ++ ++ return 1; + } + + static int dw_edma_device_config(struct dma_chan *dchan, +@@ -555,14 +557,14 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan) + switch (chan->request) { + case EDMA_REQ_NONE: + desc = vd2dw_edma_desc(vd); +- if (desc->chunks_alloc) { +- chan->status = EDMA_ST_BUSY; +- dw_edma_start_transfer(chan); +- } else { ++ if (!desc->chunks_alloc) { + list_del(&vd->node); + vchan_cookie_complete(vd); +- chan->status = EDMA_ST_IDLE; + } ++ ++ /* Continue transferring if there are remaining chunks or issued requests. ++ */ ++ chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE; + break; + + case EDMA_REQ_STOP: +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch b/queue-5.15/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch new file mode 100644 index 00000000000..b2b20af1ae5 --- /dev/null +++ b/queue-5.15/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch @@ -0,0 +1,44 @@ +From efd7228bdd0203bc9db7824e1af602527f3e64a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 19:17:58 +0900 +Subject: dmaengine: dw-edma: Fix to enable to issue dma request on DMA + processing + +From: Shunsuke Mie + +[ Upstream commit 970b17dfe264a9085ba4e593730ecfd496b950ab ] + +The issue_pending request is ignored while driver is processing a DMA +request. Fix to issue the pending requests on any dma channel status. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Shunsuke Mie +Link: https://lore.kernel.org/r/20230411101758.438472-2-mie@igel.co.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 2a434c255b4a2..799ebbaf35be5 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -281,9 +281,12 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan) + struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan); + unsigned long flags; + ++ if (!chan->configured) ++ return; ++ + spin_lock_irqsave(&chan->vc.lock, flags); +- if (chan->configured && chan->request == EDMA_REQ_NONE && +- chan->status == EDMA_ST_IDLE && vchan_issue_pending(&chan->vc)) { ++ if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE && ++ chan->status == EDMA_ST_IDLE) { + chan->status = EDMA_ST_BUSY; + dw_edma_start_transfer(chan); + } +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-mv_xor_v2-fix-an-error-code.patch b/queue-5.15/dmaengine-mv_xor_v2-fix-an-error-code.patch new file mode 100644 index 00000000000..36a129ccd78 --- /dev/null +++ b/queue-5.15/dmaengine-mv_xor_v2-fix-an-error-code.patch @@ -0,0 +1,37 @@ +From 8d3bf8253be9b863be6b70b608361f20e80593d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 09:06:37 +0200 +Subject: dmaengine: mv_xor_v2: Fix an error code. + +From: Christophe JAILLET + +[ Upstream commit 827026ae2e56ec05ef1155661079badbbfc0b038 ] + +If the probe is deferred, -EPROBE_DEFER should be returned, not ++EPROBE_DEFER. + +Fixes: 3cd2c313f1d6 ("dmaengine: mv_xor_v2: Fix clock resource by adding a register clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/201170dff832a3c496d125772e10070cd834ebf2.1679814350.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mv_xor_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index 4800c596433ad..9f3e011fbd914 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -756,7 +756,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + + xor_dev->clk = devm_clk_get(&pdev->dev, NULL); + if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) { +- ret = EPROBE_DEFER; ++ ret = -EPROBE_DEFER; + goto disable_reg_clk; + } + if (!IS_ERR(xor_dev->clk)) { +-- +2.39.2 + diff --git a/queue-5.15/drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch b/queue-5.15/drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch new file mode 100644 index 00000000000..47df6d02f0b --- /dev/null +++ b/queue-5.15/drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch @@ -0,0 +1,73 @@ +From 00b5e95c9e77b4ab58a5684ea0167844b1133ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 15:53:23 +0100 +Subject: drivers: staging: rtl8723bs: Fix locking in + _rtw_join_timeout_handler() + +From: Hans de Goede + +[ Upstream commit 215792eda008f6a1e7ed9d77fa20d582d22bb114 ] + +Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in +rtw_joinbss_event_prehandle()") besides fixing the deadlock also +modified _rtw_join_timeout_handler() to use spin_[un]lock_irq() +instead of spin_[un]lock_bh(). + +_rtw_join_timeout_handler() calls rtw_do_join() which takes +pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This +spin_unlock_bh() call re-enables softirqs which triggers an oops in +kernel/softirq.c: __local_bh_enable_ip() when it calls +lockdep_assert_irqs_enabled(): + +[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100 +... +[ 244.509022] Call Trace: +[ 244.509048] +[ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs] +[ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] +[ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] +[ 244.510076] call_timer_fn+0x95/0x2a0 +[ 244.510200] __run_timers.part.0+0x1da/0x2d0 + +This oops is causd by the switch to spin_[un]lock_irq() which disables +the IRQs for the entire duration of _rtw_join_timeout_handler(). + +Disabling the IRQs is not necessary since all code taking this lock +runs from either user contexts or from softirqs, switch back to +spin_[un]lock_bh() to fix this. + +Fixes: 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()") +Cc: Duoming Zhou +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230221145326.7808-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/core/rtw_mlme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c +index 26c40042d2bed..f85ef7dd61b24 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c ++++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c +@@ -1547,7 +1547,7 @@ void _rtw_join_timeout_handler(struct timer_list *t) + if (adapter->bDriverStopped || adapter->bSurpriseRemoved) + return; + +- spin_lock_irq(&pmlmepriv->lock); ++ spin_lock_bh(&pmlmepriv->lock); + + if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */ + while (1) { +@@ -1575,7 +1575,7 @@ void _rtw_join_timeout_handler(struct timer_list *t) + + } + +- spin_unlock_irq(&pmlmepriv->lock); ++ spin_unlock_bh(&pmlmepriv->lock); + } + + /* +-- +2.39.2 + diff --git a/queue-5.15/drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch b/queue-5.15/drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch new file mode 100644 index 00000000000..486f2797220 --- /dev/null +++ b/queue-5.15/drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch @@ -0,0 +1,53 @@ +From 6225da53a7bef29c11511edeeb9bbac070fc1062 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 15:53:24 +0100 +Subject: drivers: staging: rtl8723bs: Fix locking in + rtw_scan_timeout_handler() + +From: Hans de Goede + +[ Upstream commit 3f467036093fedd7e231924327455fc609b5ef02 ] + +Commit cc7ad0d77b51 ("drivers: staging: rtl8723bs: Fix deadlock in +rtw_surveydone_event_callback()") besides fixing the deadlock also +modified rtw_scan_timeout_handler() to use spin_[un]lock_irq() +instead of spin_[un]lock_bh(). + +Disabling the IRQs is not necessary since all code taking this lock +runs from either user contexts or from softirqs + +rtw_scan_timeout_handler() is the only function taking pmlmepriv->lock +which uses spin_[un]lock_irq() for this. Switch back to +spin_[un]lock_bh() to make it consistent with the rest of the code. + +Fixes: cc7ad0d77b51 ("drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()") +Cc: Duoming Zhou +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230221145326.7808-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/core/rtw_mlme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c +index f85ef7dd61b24..5b64980e8522f 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c ++++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c +@@ -1588,11 +1588,11 @@ void rtw_scan_timeout_handler(struct timer_list *t) + mlmepriv.scan_to_timer); + struct mlme_priv *pmlmepriv = &adapter->mlmepriv; + +- spin_lock_irq(&pmlmepriv->lock); ++ spin_lock_bh(&pmlmepriv->lock); + + _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY); + +- spin_unlock_irq(&pmlmepriv->lock); ++ spin_unlock_bh(&pmlmepriv->lock); + + rtw_indicate_scan_done(adapter, true); + } +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch b/queue-5.15/drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch new file mode 100644 index 00000000000..16c27657c19 --- /dev/null +++ b/queue-5.15/drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch @@ -0,0 +1,63 @@ +From 249cc40c00cb98efe18b70efdc80ae8c561280ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 08:17:16 +0000 +Subject: drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence + known override-init warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lee Jones + +[ Upstream commit 4082b9f5ead4966797dddcfef0905d59e5a83873 ] + +Fixes the following W=1 kernel build warning(s): + + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:157:21: note: in expansion of macro ‘mmCRTC1_DCFE_MEM_LIGHT_SLEEP_CNTL’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_transform.h:170:9: note: in expansion of macro ‘SRI’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:183:17: note: in expansion of macro ‘XFM_COMMON_REG_LIST_DCE60’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:188:17: note: in expansion of macro ‘transform_regs’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_6_0_d.h:722:43: warning: initialized field overwritten [-Woverride-init] + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:157:21: note: in expansion of macro ‘mmCRTC2_DCFE_MEM_LIGHT_SLEEP_CNTL’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_transform.h:170:9: note: in expansion of macro ‘SRI’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:183:17: note: in expansion of macro ‘XFM_COMMON_REG_LIST_DCE60’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:189:17: note: in expansion of macro ‘transform_regs’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_6_0_d.h:722:43: note: (near initialization for ‘xfm_regs[2].DCFE_MEM_LIGHT_SLEEP_CN + +[100 lines snipped for brevity] + +Fixes: ceb3cf476a441 ("drm/amd/display/dc/dce60/Makefile: Ignore -Woverride-init warning") +Cc: Harry Wentland +Cc: Leo Li +Cc: Rodrigo Siqueira +Cc: Alex Deucher +Cc: "Christian König" +Cc: "Pan, Xinhui" +Cc: David Airlie +Cc: Daniel Vetter +Cc: Mauro Rossi +Cc: amd-gfx@lists.freedesktop.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Lee Jones +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce60/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce60/Makefile b/drivers/gpu/drm/amd/display/dc/dce60/Makefile +index dda596fa1cd76..fee331accc0e7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce60/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce60/Makefile +@@ -23,7 +23,7 @@ + # Makefile for the 'controller' sub-component of DAL. + # It provides the control and status of HW CRTC block. + +-CFLAGS_AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init) + + DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \ + dce60_resource.o +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-fix-potential-null-dereference.patch b/queue-5.15/drm-amd-display-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..fecadaca841 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-potential-null-dereference.patch @@ -0,0 +1,42 @@ +From bf4050ed170769adc333319125e67f1317e057c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 16:10:37 +0300 +Subject: drm/amd/display: Fix potential null dereference + +From: Igor Artemiev + +[ Upstream commit 52f1783ff4146344342422c1cd94fcb4ce39b6fe ] + +The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() +without checking. + +Add a NULL pointer check before calling dc_dmub_srv_destroy(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC") +Signed-off-by: Igor Artemiev +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 68c98e30fee71..1e0ddf7722cd4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1707,7 +1707,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) + dc_deinit_callbacks(adev->dm.dc); + #endif + +- dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); ++ if (adev->dm.dc) ++ dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); + + if (dc_enable_dmub_notifications(adev->dm.dc)) { + kfree(adev->dm.dmub_notify); +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch b/queue-5.15/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch new file mode 100644 index 00000000000..205b21e4ea1 --- /dev/null +++ b/queue-5.15/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch @@ -0,0 +1,70 @@ +From 358ad4ec8078636ac9f091c16a2f6a45773e31e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 07:55:24 -0500 +Subject: drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 + +From: Adam Ford + +[ Upstream commit ee0285e13455fdbce5de315bdbe91b5f198a2a06 ] + +When dynamically switching lanes was removed, the intent of the code +was to check to make sure that higher speed items used 4 lanes, but +it had the unintended consequence of removing the slower speeds for +4-lane users. + +This attempts to remedy this by doing a check to see that the +max frequency doesn't exceed the chip limit, and a second +check to make sure that the max bit-rate doesn't exceed the +number of lanes * max bit rate / lane. + +Fixes: 9a0cdcd6649b ("drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge") +Reviewed-by: Robert Foss +Signed-off-by: Adam Ford +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230319125524.58803-1-aford173@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7533.c | 25 +++++++++++------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c +index 7eda12f338a1d..babc0be0bbb56 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c +@@ -103,22 +103,19 @@ void adv7533_dsi_power_off(struct adv7511 *adv) + enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv, + const struct drm_display_mode *mode) + { +- int lanes; ++ unsigned long max_lane_freq; + struct mipi_dsi_device *dsi = adv->dsi; ++ u8 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format); + +- if (mode->clock > 80000) +- lanes = 4; +- else +- lanes = 3; +- +- /* +- * TODO: add support for dynamic switching of lanes +- * by using the bridge pre_enable() op . Till then filter +- * out the modes which shall need different number of lanes +- * than what was configured in the device tree. +- */ +- if (lanes != dsi->lanes) +- return MODE_BAD; ++ /* Check max clock for either 7533 or 7535 */ ++ if (mode->clock > (adv->type == ADV7533 ? 80000 : 148500)) ++ return MODE_CLOCK_HIGH; ++ ++ /* Check max clock for each lane */ ++ max_lane_freq = (adv->type == ADV7533 ? 800000 : 891000); ++ ++ if (mode->clock * bpp > max_lane_freq * adv->num_dsi_lanes) ++ return MODE_CLOCK_HIGH; + + return MODE_OK; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch b/queue-5.15/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch new file mode 100644 index 00000000000..71dee8993ee --- /dev/null +++ b/queue-5.15/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch @@ -0,0 +1,45 @@ +From b0918271366d10aba60eb9fe696f7f344740e907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 23:06:02 +0300 +Subject: drm/i915: Make intel_get_crtc_new_encoder() less oopsy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 631420b06597a33c72b6dcef78d1c2dea17f452d ] + +The point of the WARN was to print something, not oops +straight up. Currently that is precisely what happens +if we can't find the connector for the crtc in the atomic +state. Get the dev pointer from the atomic state instead +of the potentially NULL encoder to avoid that. + +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230413200602.6037-2-ville.syrjala@linux.intel.com +Fixes: 3a47ae201e07 ("drm/i915/display: Make WARN* drm specific where encoder ptr is available") +Reviewed-by: Jani Nikula +(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 566b34ba57e18..26811176846dc 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -2303,7 +2303,7 @@ intel_get_crtc_new_encoder(const struct intel_atomic_state *state, + num_encoders++; + } + +- drm_WARN(encoder->base.dev, num_encoders != 1, ++ drm_WARN(state->base.dev, num_encoders != 1, + "%d encoders for pipe %c\n", + num_encoders, pipe_name(crtc->pipe)); + +-- +2.39.2 + diff --git a/queue-5.15/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch b/queue-5.15/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch new file mode 100644 index 00000000000..446ae13074d --- /dev/null +++ b/queue-5.15/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch @@ -0,0 +1,45 @@ +From ea403f87d6b666e35d62036bd83e2e39512caa7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 22:27:11 -0700 +Subject: drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() + +From: Harshit Mogalapalli + +[ Upstream commit c5647cae2704e58d1c4e5fedbf63f11bca6376c9 ] + +Smatch reports: +drivers/gpu/drm/lima/lima_drv.c:396 lima_pdev_probe() warn: + missing unwind goto? + +Store return value in err and goto 'err_out0' which has +lima_sched_slab_fini() before returning. + +Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs") +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20230314052711.4061652-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_drv.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/lima/lima_drv.c b/drivers/gpu/drm/lima/lima_drv.c +index 7b8d7178d09aa..39cab4a55f572 100644 +--- a/drivers/gpu/drm/lima/lima_drv.c ++++ b/drivers/gpu/drm/lima/lima_drv.c +@@ -392,8 +392,10 @@ static int lima_pdev_probe(struct platform_device *pdev) + + /* Allocate and initialize the DRM device. */ + ddev = drm_dev_alloc(&lima_drm_driver, &pdev->dev); +- if (IS_ERR(ddev)) +- return PTR_ERR(ddev); ++ if (IS_ERR(ddev)) { ++ err = PTR_ERR(ddev); ++ goto err_out0; ++ } + + ddev->dev_private = ldev; + ldev->ddev = ddev; +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch b/queue-5.15/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch new file mode 100644 index 00000000000..6fc2d484fed --- /dev/null +++ b/queue-5.15/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch @@ -0,0 +1,62 @@ +From b14cd8b2b33065406b2a68be430921b876c84cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 11:20:30 -0700 +Subject: drm/msm/adreno: Defer enabling runpm until hw_init() + +From: Rob Clark + +[ Upstream commit 4b18299b33655fa9672b774b6df774dc03d6aee8 ] + +To avoid preventing the display from coming up before the rootfs is +mounted, without resorting to packing fw in the initrd, the GPU has +this limbo state where the device is probed, but we aren't ready to +start sending commands to it. This is particularly problematic for +a6xx, since the GMU (which requires fw to be loaded) is the one that +is controlling the power/clk/icc votes. + +So defer enabling runpm until we are ready to call gpu->hw_init(), +as that is a point where we know we have all the needed fw and are +ready to start sending commands to the coproc's. + +Signed-off-by: Rob Clark +Patchwork: https://patchwork.freedesktop.org/patch/489337/ +Link: https://lore.kernel.org/r/20220613182036.2567963-1-robdclark@gmail.com +Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 6 ++++++ + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 - + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index 2a6ce76656aa2..32207bc42b281 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -398,6 +398,12 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + if (ret) + return NULL; + ++ /* ++ * Now that we have firmware loaded, and are ready to begin ++ * booting the gpu, go ahead and enable runpm: ++ */ ++ pm_runtime_enable(&pdev->dev); ++ + /* Make sure pm runtime is active and reset any previous errors */ + pm_runtime_set_active(&pdev->dev); + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 3fa01938f4b29..47a260715a89c 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -943,7 +943,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + pm_runtime_set_autosuspend_delay(dev, + adreno_gpu->info->inactive_period); + pm_runtime_use_autosuspend(dev); +- pm_runtime_enable(dev); + + return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base, + adreno_gpu->info->name, &adreno_gpu_config); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-adreno-disable-preemption-on-adreno-510.patch b/queue-5.15/drm-msm-adreno-disable-preemption-on-adreno-510.patch new file mode 100644 index 00000000000..f8ff86761e1 --- /dev/null +++ b/queue-5.15/drm-msm-adreno-disable-preemption-on-adreno-510.patch @@ -0,0 +1,54 @@ +From 20146e06041bf9a2e5b3d39f47b9e82d6f65e65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 23:17:17 +0100 +Subject: drm: msm: adreno: Disable preemption on Adreno 510 + +From: Adam Skladowski + +[ Upstream commit 010c8bbad2cb8c33c47963e29f051f1e917e45a5 ] + +Downstream driver appears to not support preemption on A510 target, +trying to use one make device slow and fill log with rings related errors. +Set num_rings to 1 to disable preemption. + +Suggested-by: Dmitry Baryshkov +Fixes: e20c9284c8f2 ("drm/msm/adreno: Add support for Adreno 510 GPU") +Signed-off-by: Adam Skladowski +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/526898/ +Link: https://lore.kernel.org/r/20230314221757.13096-1-a39.skl@gmail.com +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index b8c49ba65254c..d92416d526286 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -1749,6 +1749,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + struct a5xx_gpu *a5xx_gpu = NULL; + struct adreno_gpu *adreno_gpu; + struct msm_gpu *gpu; ++ unsigned int nr_rings; + int ret; + + if (!pdev) { +@@ -1769,7 +1770,12 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + + check_speed_bin(&pdev->dev); + +- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4); ++ nr_rings = 4; ++ ++ if (adreno_is_a510(adreno_gpu)) ++ nr_rings = 1; ++ ++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings); + if (ret) { + a5xx_destroy(&(a5xx_gpu->base.base)); + return ERR_PTR(ret); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch b/queue-5.15/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch new file mode 100644 index 00000000000..c0ae9df84e0 --- /dev/null +++ b/queue-5.15/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch @@ -0,0 +1,42 @@ +From b7813aa3b40426c32efb8459774bedf4852343c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 17:48:06 +0100 +Subject: drm/msm/adreno: drop bogus pm_runtime_set_active() + +From: Johan Hovold + +[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ] + +The runtime PM status can only be updated while runtime PM is disabled. + +Drop the bogus pm_runtime_set_active() call that was made after enabling +runtime PM and which (incidentally but correctly) left the runtime PM +status set to 'suspended'. + +Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware") +Signed-off-by: Johan Hovold +Patchwork: https://patchwork.freedesktop.org/patch/524972/ +Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index 32207bc42b281..3eb9146653444 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -404,9 +404,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + */ + pm_runtime_enable(&pdev->dev); + +- /* Make sure pm runtime is active and reset any previous errors */ +- pm_runtime_set_active(&pdev->dev); +- + ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) { + pm_runtime_put_sync(&pdev->dev); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch b/queue-5.15/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch new file mode 100644 index 00000000000..707450a82da --- /dev/null +++ b/queue-5.15/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch @@ -0,0 +1,40 @@ +From 8cee8b91b5ceaf2ae8459fef840801b7668acf3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 22:03:07 +0530 +Subject: drm/msm/disp/dpu: check for crtc enable rather than crtc active to + release shared resources + +From: Vinod Polimera + +[ Upstream commit b6975693846b562c4d3e0e60cc884affc5bdac00 ] + +According to KMS documentation, The driver must not release any shared +resources if active is set to false but enable still true. + +Fixes: ccc862b957c6 ("drm/msm/dpu: Fix reservation failures in modeset") +Signed-off-by: Vinod Polimera +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/524726/ +Link: https://lore.kernel.org/r/1677774797-31063-5-git-send-email-quic_vpolimer@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 5f236395677e6..03bddd904d1a1 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -637,7 +637,7 @@ static int dpu_encoder_virt_atomic_check( + if (drm_atomic_crtc_needs_modeset(crtc_state)) { + dpu_rm_release(global_state, drm_enc); + +- if (!crtc_state->active_changed || crtc_state->active) ++ if (!crtc_state->active_changed || crtc_state->enable) + ret = dpu_rm_reserve(&dpu_kms->rm, global_state, + drm_enc, crtc_state, topology); + } +-- +2.39.2 + diff --git a/queue-5.15/drm-probe-helper-cancel-previous-job-before-starting.patch b/queue-5.15/drm-probe-helper-cancel-previous-job-before-starting.patch new file mode 100644 index 00000000000..bd6368a0eb5 --- /dev/null +++ b/queue-5.15/drm-probe-helper-cancel-previous-job-before-starting.patch @@ -0,0 +1,52 @@ +From 7bab75ed5bfa1e2c7708ea63391e4f10e264dcc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 16:40:52 +0100 +Subject: drm/probe-helper: Cancel previous job before starting new one + +From: Dom Cobley + +[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ] + +Currently we schedule a call to output_poll_execute from +drm_kms_helper_poll_enable for 10s in future. Later we try to replace +that in drm_helper_probe_single_connector_modes with a 0s schedule with +delayed_event set. + +But as there is already a job in the queue this fails, and the immediate +job we wanted with delayed_event set doesn't occur until 10s later. + +And that call acts as if connector state has changed, reprobing modes. +This has a side effect of waking up a display that has been blanked. + +Make sure we cancel the old job before submitting the immediate one. + +Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event") +Acked-by: Daniel Vetter +Signed-off-by: Dom Cobley +[Maxime: Switched to mod_delayed_work] +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_probe_helper.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index 5606bca3caa83..f6b72e03688d4 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -488,8 +488,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector, + */ + dev->mode_config.delayed_event = true; + if (dev->mode_config.poll_enabled) +- schedule_delayed_work(&dev->mode_config.output_poll_work, +- 0); ++ mod_delayed_work(system_wq, ++ &dev->mode_config.output_poll_work, ++ 0); + } + + /* Re-enable polling in case the global poll config changed. */ +-- +2.39.2 + diff --git a/queue-5.15/drm-rcar-du-fix-a-null-vs-is_err-bug.patch b/queue-5.15/drm-rcar-du-fix-a-null-vs-is_err-bug.patch new file mode 100644 index 00000000000..404e2d70468 --- /dev/null +++ b/queue-5.15/drm-rcar-du-fix-a-null-vs-is_err-bug.patch @@ -0,0 +1,40 @@ +From 7be56ab0b30f4bb1bbe03f70650280e2bdb450c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 13:06:59 +0300 +Subject: drm: rcar-du: Fix a NULL vs IS_ERR() bug + +From: Dan Carpenter + +[ Upstream commit 40f43730f43699ce8557e4fe59622d4f4b69f44a ] + +The drmm_encoder_alloc() function returns error pointers. It never +returns NULL. Fix the check accordingly. + +Fixes: 7a1adbd23990 ("drm: rcar-du: Use drmm_encoder_alloc() to manage encoder") +Signed-off-by: Dan Carpenter +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rcar-du/rcar_du_encoder.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c +index 4bf4e25d7f011..6bc0c4e6cd965 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c +@@ -109,8 +109,8 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu, + renc = drmm_encoder_alloc(&rcdu->ddev, struct rcar_du_encoder, base, + &rcar_du_encoder_funcs, DRM_MODE_ENCODER_NONE, + NULL); +- if (!renc) +- return -ENOMEM; ++ if (IS_ERR(renc)) ++ return PTR_ERR(renc); + + renc->output = output; + +-- +2.39.2 + diff --git a/queue-5.15/drm-rockchip-drop-unbalanced-obj-unref.patch b/queue-5.15/drm-rockchip-drop-unbalanced-obj-unref.patch new file mode 100644 index 00000000000..b85dcb07766 --- /dev/null +++ b/queue-5.15/drm-rockchip-drop-unbalanced-obj-unref.patch @@ -0,0 +1,38 @@ +From 39b2313e5c80243cf235db8045e59afbd7bd133f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:17:34 -0800 +Subject: drm/rockchip: Drop unbalanced obj unref + +From: Rob Clark + +[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ] + +In the error path, rockchip_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers") +Signed-off-by: Rob Clark +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index 7971f57436dd7..3b18b6a7acd3e 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -251,9 +251,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj, + else + ret = rockchip_drm_gem_object_mmap_dma(obj, vma); + +- if (ret) +- drm_gem_vm_close(vma); +- + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/drm-ttm-optimize-pool-allocations-a-bit-v2.patch b/queue-5.15/drm-ttm-optimize-pool-allocations-a-bit-v2.patch new file mode 100644 index 00000000000..64c9755ef0d --- /dev/null +++ b/queue-5.15/drm-ttm-optimize-pool-allocations-a-bit-v2.patch @@ -0,0 +1,147 @@ +From d399968fa2d762d77dfd8c545a519dfa8a60e22f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 20:40:11 +0100 +Subject: drm/ttm: optimize pool allocations a bit v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 735c466465eba51deaee3012d8403c10fc7c8c03 ] + +If we got a page pool use it as much as possible. + +If we can't get more pages from the pool allocate as much as possible. + +Only if that still doesn't work reduce the order and try again. + +v2: minor cleanups + +Signed-off-by: Christian König +Reviewed-by: Felix Kuehling +Link: https://patchwork.freedesktop.org/patch/msgid/20221107195808.1873-1-christian.koenig@amd.com +Stable-dep-of: 379989e7cbdc ("drm/ttm/pool: Fix ttm_pool_alloc error path") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_pool.c | 82 ++++++++++++++++++++++++---------- + 1 file changed, 58 insertions(+), 24 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c +index 82cbb29a05aa3..603b044833048 100644 +--- a/drivers/gpu/drm/ttm/ttm_pool.c ++++ b/drivers/gpu/drm/ttm/ttm_pool.c +@@ -345,6 +345,28 @@ static unsigned int ttm_pool_page_order(struct ttm_pool *pool, struct page *p) + return p->private; + } + ++/* Called when we got a page, either from a pool or newly allocated */ ++static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order, ++ struct page *p, dma_addr_t **dma_addr, ++ unsigned long *num_pages, ++ struct page ***pages) ++{ ++ unsigned int i; ++ int r; ++ ++ if (*dma_addr) { ++ r = ttm_pool_map(pool, order, p, dma_addr); ++ if (r) ++ return r; ++ } ++ ++ *num_pages -= 1 << order; ++ for (i = 1 << order; i; --i, ++(*pages), ++p) ++ **pages = p; ++ ++ return 0; ++} ++ + /** + * ttm_pool_alloc - Fill a ttm_tt object + * +@@ -386,45 +408,57 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + for (order = min_t(unsigned int, MAX_ORDER - 1, __fls(num_pages)); + num_pages; + order = min_t(unsigned int, order, __fls(num_pages))) { +- bool apply_caching = false; + struct ttm_pool_type *pt; + + pt = ttm_pool_select_type(pool, tt->caching, order); + p = pt ? ttm_pool_type_take(pt) : NULL; + if (p) { +- apply_caching = true; +- } else { +- p = ttm_pool_alloc_page(pool, gfp_flags, order); +- if (p && PageHighMem(p)) +- apply_caching = true; +- } +- +- if (!p) { +- if (order) { +- --order; +- continue; +- } +- r = -ENOMEM; +- goto error_free_all; +- } +- +- if (apply_caching) { + r = ttm_pool_apply_caching(caching, pages, + tt->caching); + if (r) + goto error_free_page; +- caching = pages + (1 << order); ++ ++ do { ++ r = ttm_pool_page_allocated(pool, order, p, ++ &dma_addr, ++ &num_pages, ++ &pages); ++ if (r) ++ goto error_free_page; ++ ++ if (num_pages < (1 << order)) ++ break; ++ ++ p = ttm_pool_type_take(pt); ++ } while (p); ++ caching = pages; + } + +- if (dma_addr) { +- r = ttm_pool_map(pool, order, p, &dma_addr); ++ while (num_pages >= (1 << order) && ++ (p = ttm_pool_alloc_page(pool, gfp_flags, order))) { ++ ++ if (PageHighMem(p)) { ++ r = ttm_pool_apply_caching(caching, pages, ++ tt->caching); ++ if (r) ++ goto error_free_page; ++ } ++ r = ttm_pool_page_allocated(pool, order, p, &dma_addr, ++ &num_pages, &pages); + if (r) + goto error_free_page; ++ if (PageHighMem(p)) ++ caching = pages; + } + +- num_pages -= 1 << order; +- for (i = 1 << order; i; --i) +- *(pages++) = p++; ++ if (!p) { ++ if (order) { ++ --order; ++ continue; ++ } ++ r = -ENOMEM; ++ goto error_free_all; ++ } + } + + r = ttm_pool_apply_caching(caching, pages, tt->caching); +-- +2.39.2 + diff --git a/queue-5.15/drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch b/queue-5.15/drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch new file mode 100644 index 00000000000..cea52a28e81 --- /dev/null +++ b/queue-5.15/drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch @@ -0,0 +1,195 @@ +From 66fd250317227644372bf322091dfd87a1cbf7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 22:06:48 +0200 +Subject: drm/ttm/pool: Fix ttm_pool_alloc error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Hellström + +[ Upstream commit 379989e7cbdc7aa7496a00ee286ec146c7599cf0 ] + +When hitting an error, the error path forgot to unmap dma mappings and +could call set_pages_wb() on already uncached pages. + +Fix this by introducing a common ttm_pool_free_range() function that +does the right thing. + +v2: +- Simplify that common function (Christian König) +v3: +- Rename that common function to ttm_pool_free_range() (Christian König) + +Fixes: d099fc8f540a ("drm/ttm: new TT backend allocation pool v3") +Cc: Christian König +Cc: Dave Airlie +Cc: Christian Koenig +Cc: Huang Rui +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Thomas Hellström +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20230404200650.11043-2-thomas.hellstrom@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_pool.c | 81 +++++++++++++++++++++------------- + 1 file changed, 51 insertions(+), 30 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c +index 603b044833048..aa3512af051ad 100644 +--- a/drivers/gpu/drm/ttm/ttm_pool.c ++++ b/drivers/gpu/drm/ttm/ttm_pool.c +@@ -367,6 +367,43 @@ static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order, + return 0; + } + ++/** ++ * ttm_pool_free_range() - Free a range of TTM pages ++ * @pool: The pool used for allocating. ++ * @tt: The struct ttm_tt holding the page pointers. ++ * @caching: The page caching mode used by the range. ++ * @start_page: index for first page to free. ++ * @end_page: index for last page to free + 1. ++ * ++ * During allocation the ttm_tt page-vector may be populated with ranges of ++ * pages with different attributes if allocation hit an error without being ++ * able to completely fulfill the allocation. This function can be used ++ * to free these individual ranges. ++ */ ++static void ttm_pool_free_range(struct ttm_pool *pool, struct ttm_tt *tt, ++ enum ttm_caching caching, ++ pgoff_t start_page, pgoff_t end_page) ++{ ++ struct page **pages = tt->pages; ++ unsigned int order; ++ pgoff_t i, nr; ++ ++ for (i = start_page; i < end_page; i += nr, pages += nr) { ++ struct ttm_pool_type *pt = NULL; ++ ++ order = ttm_pool_page_order(pool, *pages); ++ nr = (1UL << order); ++ if (tt->dma_address) ++ ttm_pool_unmap(pool, tt->dma_address[i], nr); ++ ++ pt = ttm_pool_select_type(pool, caching, order); ++ if (pt) ++ ttm_pool_type_give(pt, *pages); ++ else ++ ttm_pool_free_page(pool, caching, order, *pages); ++ } ++} ++ + /** + * ttm_pool_alloc - Fill a ttm_tt object + * +@@ -382,12 +419,14 @@ static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order, + int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + struct ttm_operation_ctx *ctx) + { +- unsigned long num_pages = tt->num_pages; ++ pgoff_t num_pages = tt->num_pages; + dma_addr_t *dma_addr = tt->dma_address; + struct page **caching = tt->pages; + struct page **pages = tt->pages; ++ enum ttm_caching page_caching; + gfp_t gfp_flags = GFP_USER; +- unsigned int i, order; ++ pgoff_t caching_divide; ++ unsigned int order; + struct page *p; + int r; + +@@ -410,6 +449,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + order = min_t(unsigned int, order, __fls(num_pages))) { + struct ttm_pool_type *pt; + ++ page_caching = tt->caching; + pt = ttm_pool_select_type(pool, tt->caching, order); + p = pt ? ttm_pool_type_take(pt) : NULL; + if (p) { +@@ -418,6 +458,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + if (r) + goto error_free_page; + ++ caching = pages; + do { + r = ttm_pool_page_allocated(pool, order, p, + &dma_addr, +@@ -426,14 +467,15 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + if (r) + goto error_free_page; + ++ caching = pages; + if (num_pages < (1 << order)) + break; + + p = ttm_pool_type_take(pt); + } while (p); +- caching = pages; + } + ++ page_caching = ttm_cached; + while (num_pages >= (1 << order) && + (p = ttm_pool_alloc_page(pool, gfp_flags, order))) { + +@@ -442,6 +484,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + tt->caching); + if (r) + goto error_free_page; ++ caching = pages; + } + r = ttm_pool_page_allocated(pool, order, p, &dma_addr, + &num_pages, &pages); +@@ -468,15 +511,13 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + return 0; + + error_free_page: +- ttm_pool_free_page(pool, tt->caching, order, p); ++ ttm_pool_free_page(pool, page_caching, order, p); + + error_free_all: + num_pages = tt->num_pages - num_pages; +- for (i = 0; i < num_pages; ) { +- order = ttm_pool_page_order(pool, tt->pages[i]); +- ttm_pool_free_page(pool, tt->caching, order, tt->pages[i]); +- i += 1 << order; +- } ++ caching_divide = caching - tt->pages; ++ ttm_pool_free_range(pool, tt, tt->caching, 0, caching_divide); ++ ttm_pool_free_range(pool, tt, ttm_cached, caching_divide, num_pages); + + return r; + } +@@ -492,27 +533,7 @@ EXPORT_SYMBOL(ttm_pool_alloc); + */ + void ttm_pool_free(struct ttm_pool *pool, struct ttm_tt *tt) + { +- unsigned int i; +- +- for (i = 0; i < tt->num_pages; ) { +- struct page *p = tt->pages[i]; +- unsigned int order, num_pages; +- struct ttm_pool_type *pt; +- +- order = ttm_pool_page_order(pool, p); +- num_pages = 1ULL << order; +- if (tt->dma_address) +- ttm_pool_unmap(pool, tt->dma_address[i], num_pages); +- +- pt = ttm_pool_select_type(pool, tt->caching, order); +- if (pt) +- ttm_pool_type_give(pt, tt->pages[i]); +- else +- ttm_pool_free_page(pool, tt->caching, order, +- tt->pages[i]); +- +- i += num_pages; +- } ++ ttm_pool_free_range(pool, tt, tt->caching, 0, tt->num_pages); + + while (atomic_long_read(&allocated_pages) > page_pool_size) + ttm_pool_shrink(); +-- +2.39.2 + diff --git a/queue-5.15/drm-vgem-add-missing-mutex_destroy.patch b/queue-5.15/drm-vgem-add-missing-mutex_destroy.patch new file mode 100644 index 00000000000..77e5de501c8 --- /dev/null +++ b/queue-5.15/drm-vgem-add-missing-mutex_destroy.patch @@ -0,0 +1,42 @@ +From 5e53ab9ab8227811e6dfb1d18b0e00863266c332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 09:55:17 -0300 +Subject: drm/vgem: add missing mutex_destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ] + +vgem_fence_open() instantiates a mutex for a particular fence +instance, but never destroys it by calling mutex_destroy() in +vgem_fence_close(). + +So, add the missing mutex_destroy() to guarantee proper resource +destruction. + +Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)") +Signed-off-by: Maíra Canal +Reviewed-by: Stanislaw Gruszka +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_fence.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c +index bd6f75285fd95..43fc56d0c4a06 100644 +--- a/drivers/gpu/drm/vgem/vgem_fence.c ++++ b/drivers/gpu/drm/vgem/vgem_fence.c +@@ -248,4 +248,5 @@ void vgem_fence_close(struct vgem_file *vfile) + { + idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile); + idr_destroy(&vfile->fence_idr); ++ mutex_destroy(&vfile->fence_mutex); + } +-- +2.39.2 + diff --git a/queue-5.15/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch b/queue-5.15/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch new file mode 100644 index 00000000000..58124126bad --- /dev/null +++ b/queue-5.15/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch @@ -0,0 +1,55 @@ +From dada2043246a5327ec133ced9b2798fc15a5dd12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 09:17:28 +0800 +Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays + +From: Qiuxu Zhuo + +[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ] + +The current DRAM row address mapping arrays skx_{open,close}_row[] +only support ranks with sizes up to 16G. Decoding a rank address +to a DRAM row address for a 32G rank by using either one of the +above arrays by the skx_edac driver, will result in an overflow on +the array. + +For a 32G rank, the most significant DRAM row address bit (the +bit17) is mapped from the bit34 of the rank address. Add this new +mapping item to both arrays to fix the overflow issue. + +Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake") +Reported-by: Feng Xu +Tested-by: Feng Xu +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/skx_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c +index 1abc020d49ab6..984c93c8825f0 100644 +--- a/drivers/edac/skx_base.c ++++ b/drivers/edac/skx_base.c +@@ -510,7 +510,7 @@ static bool skx_rir_decode(struct decoded_addr *res) + } + + static u8 skx_close_row[] = { +- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33 ++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34 + }; + + static u8 skx_close_column[] = { +@@ -518,7 +518,7 @@ static u8 skx_close_column[] = { + }; + + static u8 skx_open_row[] = { +- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33 ++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34 + }; + + static u8 skx_open_column[] = { +-- +2.39.2 + diff --git a/queue-5.15/erofs-fix-potential-overflow-calculating-xattr_isize.patch b/queue-5.15/erofs-fix-potential-overflow-calculating-xattr_isize.patch new file mode 100644 index 00000000000..cf55390c1f1 --- /dev/null +++ b/queue-5.15/erofs-fix-potential-overflow-calculating-xattr_isize.patch @@ -0,0 +1,42 @@ +From 5ff8d30d1c8ba0946f9f82ecdbb4f102d5477050 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 14:18:10 +0800 +Subject: erofs: fix potential overflow calculating xattr_isize + +From: Jingbo Xu + +[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ] + +Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated +from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum +of 256K (64K * 4). + +Thus declare xattr_isize as unsigned int to avoid the potential overflow. + +Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs") +Signed-off-by: Jingbo Xu +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index b77acf09726c6..beadb06d8feb9 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -226,7 +226,7 @@ struct erofs_inode { + + unsigned char datalayout; + unsigned char inode_isize; +- unsigned short xattr_isize; ++ unsigned int xattr_isize; + + unsigned int xattr_shared_count; + unsigned int *xattr_shared_xattrs; +-- +2.39.2 + diff --git a/queue-5.15/erofs-stop-parsing-non-compact-head-index-if-cluster.patch b/queue-5.15/erofs-stop-parsing-non-compact-head-index-if-cluster.patch new file mode 100644 index 00000000000..b93f744713c --- /dev/null +++ b/queue-5.15/erofs-stop-parsing-non-compact-head-index-if-cluster.patch @@ -0,0 +1,65 @@ +From cad83a427d1aff6951292a0c8311b6e81b72a258 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 01:37:14 +0800 +Subject: erofs: stop parsing non-compact HEAD index if clusterofs is invalid + +From: Gao Xiang + +[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ] + +Syzbot generated a crafted image [1] with a non-compact HEAD index of +clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, +which causes the following unexpected behavior as below: + + BUG: unable to handle page fault for address: fffff52101a3fff9 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 23ffed067 P4D 23ffed067 PUD 0 + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 + Workqueue: erofs_worker z_erofs_decompressqueue_work + RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 + ... + Call Trace: + + z_erofs_decompressqueue_work+0x99/0xe0 + process_one_work+0x8f6/0x1170 + worker_thread+0xa63/0x1210 + kthread+0x270/0x300 + ret_from_fork+0x1f/0x30 + +Note that normal images or images using compact indexes are not +impacted. Let's fix this now. + +[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com + +Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com +Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") +Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") +Signed-off-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zmap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index 73b86b5c1a75b..2c8575a8f6dae 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -191,6 +191,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, + case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN: + case Z_EROFS_VLE_CLUSTER_TYPE_HEAD: + m->clusterofs = le16_to_cpu(di->di_clusterofs); ++ if (m->clusterofs >= 1 << vi->z_logical_clusterbits) { ++ DBG_BUGON(1); ++ return -EFSCORRUPTED; ++ } + m->pblk = le32_to_cpu(di->di_u.blkaddr); + break; + default: +-- +2.39.2 + diff --git a/queue-5.15/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch b/queue-5.15/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch new file mode 100644 index 00000000000..6a29a391f01 --- /dev/null +++ b/queue-5.15/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch @@ -0,0 +1,81 @@ +From 1233b0a6e5f0ff3727ec60199f2a7a477f7bc66a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 09:37:21 +0800 +Subject: ext4: fix i_disksize exceeding i_size problem in paritally written + case + +From: Zhihao Cheng + +[ Upstream commit 1dedde690303c05ef732b7c5c8356fdf60a4ade3 ] + +It is possible for i_disksize can exceed i_size, triggering a warning. + +generic_perform_write + copied = iov_iter_copy_from_user_atomic(len) // copied < len + ext4_da_write_end + | ext4_update_i_disksize + | new_i_size = pos + copied; + | WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize + | generic_write_end + | copied = block_write_end(copied, len) // copied = 0 + | if (unlikely(copied < len)) + | if (!PageUptodate(page)) + | copied = 0; + | if (pos + copied > inode->i_size) // return false + if (unlikely(copied == 0)) + goto again; + if (unlikely(iov_iter_fault_in_readable(i, bytes))) { + status = -EFAULT; + break; + } + +We get i_disksize greater than i_size here, which could trigger WARNING +check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: + +ext4_dio_write_iter + iomap_dio_rw + __iomap_dio_rw // return err, length is not aligned to 512 + ext4_handle_inode_extension + WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops + + WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 + CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 + RIP: 0010:ext4_file_write_iter+0xbc7 + Call Trace: + vfs_write+0x3b1 + ksys_write+0x77 + do_syscall_64+0x39 + +Fix it by updating 'copied' value before updating i_disksize just like +ext4_write_inline_data_end() does. + +A reproducer can be found in the buganizer link below. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217209 +Fixes: 64769240bd07 ("ext4: Add delayed allocation support in data=writeback mode") +Signed-off-by: Zhihao Cheng +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230321013721.89818-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 0426f88ba907c..20b446a23e239 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3065,6 +3065,9 @@ static int ext4_da_write_end(struct file *file, + ext4_has_inline_data(inode)) + return ext4_write_inline_data_end(inode, pos, len, copied, page); + ++ if (unlikely(copied < len) && !PageUptodate(page)) ++ copied = 0; ++ + start = pos & (PAGE_SIZE - 1); + end = start + copied - 1; + +-- +2.39.2 + diff --git a/queue-5.15/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch b/queue-5.15/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch new file mode 100644 index 00000000000..15635fcca72 --- /dev/null +++ b/queue-5.15/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch @@ -0,0 +1,94 @@ +From 44c2d7e2529dc569d576411ba36176bcc92d0705 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 11:16:27 +0000 +Subject: ext4: fix use-after-free read in ext4_find_extent for bigalloc + + inline + +From: Ye Bin + +[ Upstream commit 835659598c67907b98cd2aa57bb951dfaf675c69 ] + +Syzbot found the following issue: +loop0: detected capacity change from 0 to 2048 +EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. +================================================================== +BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] +BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 +Read of size 4 at addr ffff888073644750 by task syz-executor420/5067 + +CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 + print_address_description+0x74/0x340 mm/kasan/report.c:306 + print_report+0x107/0x1f0 mm/kasan/report.c:417 + kasan_report+0xcd/0x100 mm/kasan/report.c:517 + ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] + ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 + ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809 + ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline] + ext4_da_map_blocks fs/ext4/inode.c:1806 [inline] + ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870 + ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098 + ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082 + generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 + ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 + ext4_file_write_iter+0x1d0/0x18f0 + call_write_iter include/linux/fs.h:2186 [inline] + new_sync_write fs/read_write.c:491 [inline] + vfs_write+0x7dc/0xc50 fs/read_write.c:584 + ksys_write+0x177/0x2a0 fs/read_write.c:637 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f4b7a9737b9 +RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9 +RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004 +RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000 +R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Above issue is happens when enable bigalloc and inline data feature. As +commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for +bigalloc + inline. But it only resolved issue when has inline data, if +inline data has been converted to extent(ext4_da_convert_inline_data_to_extent) +before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However +i_data is still store inline data in this scene. Then will trigger UAF +when find extent. +To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)" +in ext4_clu_mapped(). + +Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline") +Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com +Reviewed-by: Jan Kara +Reviewed-by: Ye Bin +Reviewed-by: Tudor Ambarus +Tested-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 82bcf718b1e61..13497bd4e14bb 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5812,7 +5812,8 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu) + * mapped - no physical clusters have been allocated, and the + * file has no extents + */ +- if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) ++ if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) || ++ ext4_has_inline_data(inode)) + return 0; + + /* search for the extent closest to the first block in the cluster */ +-- +2.39.2 + diff --git a/queue-5.15/f2fs-apply-zone-capacity-to-all-zone-type.patch b/queue-5.15/f2fs-apply-zone-capacity-to-all-zone-type.patch new file mode 100644 index 00000000000..f0662ed1798 --- /dev/null +++ b/queue-5.15/f2fs-apply-zone-capacity-to-all-zone-type.patch @@ -0,0 +1,140 @@ +From 84f67eb6521055c389f7584406345de5ec810b8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 15:58:04 -0700 +Subject: f2fs: apply zone capacity to all zone type + +From: Jaegeuk Kim + +[ Upstream commit 0b37ed21e3367539b79284e0b0af2246ffcf0dca ] + +If we manage the zone capacity per zone type, it'll break the GC assumption. +And, the current logic complains valid block count mismatch. +Let's apply zone capacity to all zone type, if specified. + +Fixes: de881df97768 ("f2fs: support zone capacity less than zone size") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 65 +++-------------------------------------------- + fs/f2fs/segment.h | 3 +++ + 2 files changed, 7 insertions(+), 61 deletions(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 880447750caf4..79ad696cddec0 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -5053,48 +5053,6 @@ int f2fs_check_write_pointer(struct f2fs_sb_info *sbi) + return 0; + } + +-static bool is_conv_zone(struct f2fs_sb_info *sbi, unsigned int zone_idx, +- unsigned int dev_idx) +-{ +- if (!bdev_is_zoned(FDEV(dev_idx).bdev)) +- return true; +- return !test_bit(zone_idx, FDEV(dev_idx).blkz_seq); +-} +- +-/* Return the zone index in the given device */ +-static unsigned int get_zone_idx(struct f2fs_sb_info *sbi, unsigned int secno, +- int dev_idx) +-{ +- block_t sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno)); +- +- return (sec_start_blkaddr - FDEV(dev_idx).start_blk) >> +- sbi->log_blocks_per_blkz; +-} +- +-/* +- * Return the usable segments in a section based on the zone's +- * corresponding zone capacity. Zone is equal to a section. +- */ +-static inline unsigned int f2fs_usable_zone_segs_in_sec( +- struct f2fs_sb_info *sbi, unsigned int segno) +-{ +- unsigned int dev_idx, zone_idx; +- +- dev_idx = f2fs_target_device_index(sbi, START_BLOCK(sbi, segno)); +- zone_idx = get_zone_idx(sbi, GET_SEC_FROM_SEG(sbi, segno), dev_idx); +- +- /* Conventional zone's capacity is always equal to zone size */ +- if (is_conv_zone(sbi, zone_idx, dev_idx)) +- return sbi->segs_per_sec; +- +- if (!sbi->unusable_blocks_per_sec) +- return sbi->segs_per_sec; +- +- /* Get the segment count beyond zone capacity block */ +- return sbi->segs_per_sec - (sbi->unusable_blocks_per_sec >> +- sbi->log_blocks_per_seg); +-} +- + /* + * Return the number of usable blocks in a segment. The number of blocks + * returned is always equal to the number of blocks in a segment for +@@ -5107,23 +5065,13 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg( + struct f2fs_sb_info *sbi, unsigned int segno) + { + block_t seg_start, sec_start_blkaddr, sec_cap_blkaddr; +- unsigned int zone_idx, dev_idx, secno; +- +- secno = GET_SEC_FROM_SEG(sbi, segno); +- seg_start = START_BLOCK(sbi, segno); +- dev_idx = f2fs_target_device_index(sbi, seg_start); +- zone_idx = get_zone_idx(sbi, secno, dev_idx); +- +- /* +- * Conventional zone's capacity is always equal to zone size, +- * so, blocks per segment is unchanged. +- */ +- if (is_conv_zone(sbi, zone_idx, dev_idx)) +- return sbi->blocks_per_seg; ++ unsigned int secno; + + if (!sbi->unusable_blocks_per_sec) + return sbi->blocks_per_seg; + ++ secno = GET_SEC_FROM_SEG(sbi, segno); ++ seg_start = START_BLOCK(sbi, segno); + sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno)); + sec_cap_blkaddr = sec_start_blkaddr + CAP_BLKS_PER_SEC(sbi); + +@@ -5157,11 +5105,6 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(struct f2fs_sb_info *sbi + return 0; + } + +-static inline unsigned int f2fs_usable_zone_segs_in_sec(struct f2fs_sb_info *sbi, +- unsigned int segno) +-{ +- return 0; +-} + #endif + unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi, + unsigned int segno) +@@ -5176,7 +5119,7 @@ unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi, + unsigned int segno) + { + if (f2fs_sb_has_blkzoned(sbi)) +- return f2fs_usable_zone_segs_in_sec(sbi, segno); ++ return CAP_SEGS_PER_SEC(sbi); + + return sbi->segs_per_sec; + } +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index 9eb8364ac38c7..04f448ddf49ea 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -104,6 +104,9 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi, + #define CAP_BLKS_PER_SEC(sbi) \ + ((sbi)->segs_per_sec * (sbi)->blocks_per_seg - \ + (sbi)->unusable_blocks_per_sec) ++#define CAP_SEGS_PER_SEC(sbi) \ ++ ((sbi)->segs_per_sec - ((sbi)->unusable_blocks_per_sec >>\ ++ (sbi)->log_blocks_per_seg)) + #define GET_SEC_FROM_SEG(sbi, segno) \ + (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec) + #define GET_SEG_FROM_SEC(sbi, secno) \ +-- +2.39.2 + diff --git a/queue-5.15/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch b/queue-5.15/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch new file mode 100644 index 00000000000..ba6e7e64b5b --- /dev/null +++ b/queue-5.15/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch @@ -0,0 +1,99 @@ +From 1e8b92f6fed544531a221c6889ef3a59a4f43cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 01:22:18 +0800 +Subject: f2fs: compress: fix to call f2fs_wait_on_page_writeback() in + f2fs_write_raw_pages() + +From: Yangtao Li + +[ Upstream commit babedcbac164cec970872b8097401ca913a80e61 ] + +BUG_ON() will be triggered when writing files concurrently, +because the same page is writtenback multiple times. + +1597 void folio_end_writeback(struct folio *folio) +1598 { + ...... +1618 if (!__folio_end_writeback(folio)) +1619 BUG(); + ...... +1625 } + +kernel BUG at mm/filemap.c:1619! +Call Trace: + + f2fs_write_end_io+0x1a0/0x370 + blk_update_request+0x6c/0x410 + blk_mq_end_request+0x15/0x130 + blk_complete_reqs+0x3c/0x50 + __do_softirq+0xb8/0x29b + ? sort_range+0x20/0x20 + run_ksoftirqd+0x19/0x20 + smpboot_thread_fn+0x10b/0x1d0 + kthread+0xde/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + + +Below is the concurrency scenario: + +[Process A] [Process B] [Process C] +f2fs_write_raw_pages() + - redirty_page_for_writepage() + - unlock page() + f2fs_do_write_data_page() + - lock_page() + - clear_page_dirty_for_io() + - set_page_writeback() [1st writeback] + ..... + - unlock page() + + generic_perform_write() + - f2fs_write_begin() + - wait_for_stable_page() + + - f2fs_write_end() + - set_page_dirty() + + - lock_page() + - f2fs_do_write_data_page() + - set_page_writeback() [2st writeback] + +This problem was introduced by the previous commit 7377e853967b ("f2fs: +compress: fix potential deadlock of compress file"). All pagelocks were +released in f2fs_write_raw_pages(), but whether the page was +in the writeback state was ignored in the subsequent writing process. +Let's fix it by waiting for the page to writeback before writing. + +Cc: Christoph Hellwig +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Fixes: 7377e853967b ("f2fs: compress: fix potential deadlock of compress file") +Signed-off-by: Qi Han +Signed-off-by: Yangtao Li +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 4fa62f98cb515..455fac164fda0 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1477,6 +1477,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc, + if (!PageDirty(cc->rpages[i])) + goto continue_unlock; + ++ if (PageWriteback(cc->rpages[i])) { ++ if (wbc->sync_mode == WB_SYNC_NONE) ++ goto continue_unlock; ++ f2fs_wait_on_page_writeback(cc->rpages[i], DATA, true, true); ++ } ++ + if (!clear_page_dirty_for_io(cc->rpages[i])) + goto continue_unlock; + +-- +2.39.2 + diff --git a/queue-5.15/f2fs-enforce-single-zone-capacity.patch b/queue-5.15/f2fs-enforce-single-zone-capacity.patch new file mode 100644 index 00000000000..3e79ceaa3fc --- /dev/null +++ b/queue-5.15/f2fs-enforce-single-zone-capacity.patch @@ -0,0 +1,186 @@ +From b775b6cda924e54e58b081324f583ca41805faec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jun 2022 10:57:24 -0700 +Subject: f2fs: enforce single zone capacity + +From: Jaegeuk Kim + +[ Upstream commit b771aadc6e4c221a468fe4a2dfcfffec01a06722 ] + +In order to simplify the complicated per-zone capacity, let's support +only one capacity for entire zoned device. + +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Stable-dep-of: 0b37ed21e336 ("f2fs: apply zone capacity to all zone type") +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 2 +- + fs/f2fs/segment.c | 19 ++++++------------- + fs/f2fs/segment.h | 3 +++ + fs/f2fs/super.c | 33 ++++++++++++--------------------- + 4 files changed, 22 insertions(+), 35 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 80e4f9afe86f7..7424470c68cbe 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1211,7 +1211,6 @@ struct f2fs_dev_info { + #ifdef CONFIG_BLK_DEV_ZONED + unsigned int nr_blkz; /* Total number of zones */ + unsigned long *blkz_seq; /* Bitmap indicating sequential zones */ +- block_t *zone_capacity_blocks; /* Array of zone capacity in blks */ + #endif + }; + +@@ -1632,6 +1631,7 @@ struct f2fs_sb_info { + unsigned int meta_ino_num; /* meta inode number*/ + unsigned int log_blocks_per_seg; /* log2 blocks per segment */ + unsigned int blocks_per_seg; /* blocks per segment */ ++ unsigned int unusable_blocks_per_sec; /* unusable blocks per section */ + unsigned int segs_per_sec; /* segments per section */ + unsigned int secs_per_zone; /* sections per zone */ + unsigned int total_sections; /* total section count */ +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 58dd4de41986e..880447750caf4 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -5078,7 +5078,7 @@ static unsigned int get_zone_idx(struct f2fs_sb_info *sbi, unsigned int secno, + static inline unsigned int f2fs_usable_zone_segs_in_sec( + struct f2fs_sb_info *sbi, unsigned int segno) + { +- unsigned int dev_idx, zone_idx, unusable_segs_in_sec; ++ unsigned int dev_idx, zone_idx; + + dev_idx = f2fs_target_device_index(sbi, START_BLOCK(sbi, segno)); + zone_idx = get_zone_idx(sbi, GET_SEC_FROM_SEG(sbi, segno), dev_idx); +@@ -5087,18 +5087,12 @@ static inline unsigned int f2fs_usable_zone_segs_in_sec( + if (is_conv_zone(sbi, zone_idx, dev_idx)) + return sbi->segs_per_sec; + +- /* +- * If the zone_capacity_blocks array is NULL, then zone capacity +- * is equal to the zone size for all zones +- */ +- if (!FDEV(dev_idx).zone_capacity_blocks) ++ if (!sbi->unusable_blocks_per_sec) + return sbi->segs_per_sec; + + /* Get the segment count beyond zone capacity block */ +- unusable_segs_in_sec = (sbi->blocks_per_blkz - +- FDEV(dev_idx).zone_capacity_blocks[zone_idx]) >> +- sbi->log_blocks_per_seg; +- return sbi->segs_per_sec - unusable_segs_in_sec; ++ return sbi->segs_per_sec - (sbi->unusable_blocks_per_sec >> ++ sbi->log_blocks_per_seg); + } + + /* +@@ -5127,12 +5121,11 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg( + if (is_conv_zone(sbi, zone_idx, dev_idx)) + return sbi->blocks_per_seg; + +- if (!FDEV(dev_idx).zone_capacity_blocks) ++ if (!sbi->unusable_blocks_per_sec) + return sbi->blocks_per_seg; + + sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno)); +- sec_cap_blkaddr = sec_start_blkaddr + +- FDEV(dev_idx).zone_capacity_blocks[zone_idx]; ++ sec_cap_blkaddr = sec_start_blkaddr + CAP_BLKS_PER_SEC(sbi); + + /* + * If segment starts before zone capacity and spans beyond +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index 957edb6d70d7b..9eb8364ac38c7 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -101,6 +101,9 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi, + GET_SEGNO_FROM_SEG0(sbi, blk_addr))) + #define BLKS_PER_SEC(sbi) \ + ((sbi)->segs_per_sec * (sbi)->blocks_per_seg) ++#define CAP_BLKS_PER_SEC(sbi) \ ++ ((sbi)->segs_per_sec * (sbi)->blocks_per_seg - \ ++ (sbi)->unusable_blocks_per_sec) + #define GET_SEC_FROM_SEG(sbi, segno) \ + (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec) + #define GET_SEG_FROM_SEC(sbi, secno) \ +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index ae72211e422e7..4cc9b948139ad 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1515,7 +1515,6 @@ static void destroy_device_list(struct f2fs_sb_info *sbi) + blkdev_put(FDEV(i).bdev, FMODE_EXCL); + #ifdef CONFIG_BLK_DEV_ZONED + kvfree(FDEV(i).blkz_seq); +- kfree(FDEV(i).zone_capacity_blocks); + #endif + } + kvfree(sbi->devs); +@@ -3631,24 +3630,29 @@ static int init_percpu_info(struct f2fs_sb_info *sbi) + #ifdef CONFIG_BLK_DEV_ZONED + + struct f2fs_report_zones_args { ++ struct f2fs_sb_info *sbi; + struct f2fs_dev_info *dev; +- bool zone_cap_mismatch; + }; + + static int f2fs_report_zone_cb(struct blk_zone *zone, unsigned int idx, + void *data) + { + struct f2fs_report_zones_args *rz_args = data; ++ block_t unusable_blocks = (zone->len - zone->capacity) >> ++ F2FS_LOG_SECTORS_PER_BLOCK; + + if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL) + return 0; + + set_bit(idx, rz_args->dev->blkz_seq); +- rz_args->dev->zone_capacity_blocks[idx] = zone->capacity >> +- F2FS_LOG_SECTORS_PER_BLOCK; +- if (zone->len != zone->capacity && !rz_args->zone_cap_mismatch) +- rz_args->zone_cap_mismatch = true; +- ++ if (!rz_args->sbi->unusable_blocks_per_sec) { ++ rz_args->sbi->unusable_blocks_per_sec = unusable_blocks; ++ return 0; ++ } ++ if (rz_args->sbi->unusable_blocks_per_sec != unusable_blocks) { ++ f2fs_err(rz_args->sbi, "F2FS supports single zone capacity\n"); ++ return -EINVAL; ++ } + return 0; + } + +@@ -3682,26 +3686,13 @@ static int init_blkz_info(struct f2fs_sb_info *sbi, int devi) + if (!FDEV(devi).blkz_seq) + return -ENOMEM; + +- /* Get block zones type and zone-capacity */ +- FDEV(devi).zone_capacity_blocks = f2fs_kzalloc(sbi, +- FDEV(devi).nr_blkz * sizeof(block_t), +- GFP_KERNEL); +- if (!FDEV(devi).zone_capacity_blocks) +- return -ENOMEM; +- ++ rep_zone_arg.sbi = sbi; + rep_zone_arg.dev = &FDEV(devi); +- rep_zone_arg.zone_cap_mismatch = false; + + ret = blkdev_report_zones(bdev, 0, BLK_ALL_ZONES, f2fs_report_zone_cb, + &rep_zone_arg); + if (ret < 0) + return ret; +- +- if (!rep_zone_arg.zone_cap_mismatch) { +- kfree(FDEV(devi).zone_capacity_blocks); +- FDEV(devi).zone_capacity_blocks = NULL; +- } +- + return 0; + } + #endif +-- +2.39.2 + diff --git a/queue-5.15/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch b/queue-5.15/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch new file mode 100644 index 00000000000..8122edbbb45 --- /dev/null +++ b/queue-5.15/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch @@ -0,0 +1,76 @@ +From 4e1e541ab1fbb58cfbe0af15039dc6c8a238af11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 10:14:02 +0800 +Subject: f2fs: fix to avoid use-after-free for cached IPU bio + +From: Chao Yu + +[ Upstream commit 5cdb422c839134273866208dad5360835ddb9794 ] + +xfstest generic/019 reports a bug: + +kernel BUG at mm/filemap.c:1619! +RIP: 0010:folio_end_writeback+0x8a/0x90 +Call Trace: + end_page_writeback+0x1c/0x60 + f2fs_write_end_io+0x199/0x420 + bio_endio+0x104/0x180 + submit_bio_noacct+0xa5/0x510 + submit_bio+0x48/0x80 + f2fs_submit_write_bio+0x35/0x300 + f2fs_submit_merged_ipu_write+0x2a0/0x2b0 + f2fs_write_single_data_page+0x838/0x8b0 + f2fs_write_cache_pages+0x379/0xa30 + f2fs_write_data_pages+0x30c/0x340 + do_writepages+0xd8/0x1b0 + __writeback_single_inode+0x44/0x370 + writeback_sb_inodes+0x233/0x4d0 + __writeback_inodes_wb+0x56/0xf0 + wb_writeback+0x1dd/0x2d0 + wb_workfn+0x367/0x4a0 + process_one_work+0x21d/0x430 + worker_thread+0x4e/0x3c0 + kthread+0x103/0x130 + ret_from_fork+0x2c/0x50 + +The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write() +in f2fs_write_single_data_page() tries to flush IPU bio in cache, however +f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter, +result in submitting random cached bio which belong to other IO context, +then it will cause use-after-free issue, fix it by adding additional +validity check. + +Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 524d4b49a5209..d38bffe28b034 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -808,6 +808,8 @@ void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi, + bool found = false; + struct bio *target = bio ? *bio : NULL; + ++ f2fs_bug_on(sbi, !target && !page); ++ + for (temp = HOT; temp < NR_TEMP_TYPE && !found; temp++) { + struct f2fs_bio_info *io = sbi->write_io[DATA] + temp; + struct list_head *head = &io->bio_list; +@@ -2867,7 +2869,8 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_submit_merged_write(sbi, DATA); +- f2fs_submit_merged_ipu_write(sbi, bio, NULL); ++ if (bio && *bio) ++ f2fs_submit_merged_ipu_write(sbi, bio, NULL); + submitted = NULL; + } + +-- +2.39.2 + diff --git a/queue-5.15/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch b/queue-5.15/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch new file mode 100644 index 00000000000..c51450d1877 --- /dev/null +++ b/queue-5.15/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch @@ -0,0 +1,50 @@ +From b0264c98b65f4899ad15074c05bd75642b29f432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 22:45:50 +0800 +Subject: f2fs: handle dqget error in f2fs_transfer_project_quota() + +From: Yangtao Li + +[ Upstream commit 8051692f5f23260215bfe9a72e712d93606acc5f ] + +We should set the error code when dqget() failed. + +Fixes: 2c1d03056991 ("f2fs: support F2FS_IOC_FS{GET,SET}XATTR") +Signed-off-by: Yangtao Li +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 3be34ea4e2998..2c24162f72f0c 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2977,15 +2977,16 @@ int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid) + struct dquot *transfer_to[MAXQUOTAS] = {}; + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct super_block *sb = sbi->sb; +- int err = 0; ++ int err; + + transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); +- if (!IS_ERR(transfer_to[PRJQUOTA])) { +- err = __dquot_transfer(inode, transfer_to); +- if (err) +- set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); +- dqput(transfer_to[PRJQUOTA]); +- } ++ if (IS_ERR(transfer_to[PRJQUOTA])) ++ return PTR_ERR(transfer_to[PRJQUOTA]); ++ ++ err = __dquot_transfer(inode, transfer_to); ++ if (err) ++ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); ++ dqput(transfer_to[PRJQUOTA]); + return err; + } + +-- +2.39.2 + diff --git a/queue-5.15/firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch b/queue-5.15/firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch new file mode 100644 index 00000000000..991116f9184 --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch @@ -0,0 +1,48 @@ +From de0f44fe8edc6b7e8abbf9e3e69663d9efdaecf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 21:34:49 +0100 +Subject: firmware: arm_scmi: Fix xfers allocation on Rx channel + +From: Cristian Marussi + +[ Upstream commit b2ccba9e8cdc6fb3985cc227844e7c6af309ffb1 ] + +Two distinct pools of xfer descriptors are allocated at initialization +time: one (Tx) used to provide xfers to track commands and their replies +(or delayed replies) and another (Rx) to pick xfers from to be used for +processing notifications. + +Such pools, though, are allocated globally to be used by the whole SCMI +instance, they are not allocated per-channel and as such the allocation of +notifications xfers cannot be simply skipped if no Rx channel was found for +the base protocol common channel, because there could be defined more +optional per-protocol dedicated channels that instead support Rx channels. + +Change the conditional check to skip allocation for the notification pool +only if no Rx channel has been detected on any per-channel protocol at all. + +Fixes: 4ebd8f6dea81 ("firmware: arm_scmi: Add receive buffer support for notifications") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20230326203449.3492948-1-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 11842497b2261..7ccda7d720a19 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -1463,7 +1463,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo) + return ret; + + ret = __scmi_xfer_info_init(sinfo, &sinfo->tx_minfo); +- if (!ret && idr_find(&sinfo->rx_idr, SCMI_PROTOCOL_BASE)) ++ if (!ret && !idr_is_empty(&sinfo->rx_idr)) + ret = __scmi_xfer_info_init(sinfo, &sinfo->rx_minfo); + + return ret; +-- +2.39.2 + diff --git a/queue-5.15/firmware-qcom_scm-clear-download-bit-during-reboot.patch b/queue-5.15/firmware-qcom_scm-clear-download-bit-during-reboot.patch new file mode 100644 index 00000000000..d4c5c37e3ed --- /dev/null +++ b/queue-5.15/firmware-qcom_scm-clear-download-bit-during-reboot.patch @@ -0,0 +1,39 @@ +From b5b312495d779878c39e1c2fa24f27d9907326b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 20:44:26 +0530 +Subject: firmware: qcom_scm: Clear download bit during reboot + +From: Mukesh Ojha + +[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ] + +During normal restart of a system download bit should +be cleared irrespective of whether download mode is +set or not. + +Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control") +Signed-off-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index 2b5214d5c0daf..18e1a4b80401c 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -1320,8 +1320,7 @@ static int qcom_scm_probe(struct platform_device *pdev) + static void qcom_scm_shutdown(struct platform_device *pdev) + { + /* Clean shutdown, disable download mode to allow normal restart */ +- if (download_mode) +- qcom_scm_set_download_mode(false); ++ qcom_scm_set_download_mode(false); + } + + static const struct of_device_id qcom_scm_dt_match[] = { +-- +2.39.2 + diff --git a/queue-5.15/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch b/queue-5.15/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch new file mode 100644 index 00000000000..c18bdf5e9ae --- /dev/null +++ b/queue-5.15/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch @@ -0,0 +1,39 @@ +From 057f5d285cc2d9fd42f9f2cf20fe9edf7b0b448b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 17:27:03 +0300 +Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe + +From: Dan Carpenter + +[ Upstream commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 ] + +The svc_create_memory_pool() function returns error pointers. It never +returns NULL. Fix the check. + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/stratix10-svc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 4fdd75f1e86ea..2b50dc21fba1e 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -989,8 +989,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + return ret; + + genpool = svc_create_memory_pool(pdev, sh_memory); +- if (!genpool) +- return -ENOMEM; ++ if (IS_ERR(genpool)) ++ return PTR_ERR(genpool); + + /* allocate service controller and supporting channel */ + controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); +-- +2.39.2 + diff --git a/queue-5.15/fpga-bridge-fix-kernel-doc-parameter-description.patch b/queue-5.15/fpga-bridge-fix-kernel-doc-parameter-description.patch new file mode 100644 index 00000000000..ff051c84aec --- /dev/null +++ b/queue-5.15/fpga-bridge-fix-kernel-doc-parameter-description.patch @@ -0,0 +1,39 @@ +From 9546f71a79b094d3a754cb983e6826ce22d346d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 15:03:08 +0100 +Subject: fpga: bridge: fix kernel-doc parameter description + +From: Marco Pagani + +[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ] + +Fix the kernel-doc description for the "struct fpga_image_info *info" +parameter of the fpga_bridge_get() function. + +Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes") +Signed-off-by: Marco Pagani +Reviewed-by: Tom Rix +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fpga/fpga-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c +index 798f55670646c..75a24b0457243 100644 +--- a/drivers/fpga/fpga-bridge.c ++++ b/drivers/fpga/fpga-bridge.c +@@ -115,7 +115,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data) + /** + * fpga_bridge_get - get an exclusive reference to an fpga bridge + * @dev: parent device that fpga bridge was registered with +- * @info: fpga manager info ++ * @info: fpga image specific information + * + * Given a device, get an exclusive reference to an fpga bridge. + * +-- +2.39.2 + diff --git a/queue-5.15/fs-ntfs3-add-check-for-kmemdup.patch b/queue-5.15/fs-ntfs3-add-check-for-kmemdup.patch new file mode 100644 index 00000000000..a61a0db5ed4 --- /dev/null +++ b/queue-5.15/fs-ntfs3-add-check-for-kmemdup.patch @@ -0,0 +1,39 @@ +From 8147e6348455857a3f5e0376004d327bbdc0303a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 16:48:46 +0800 +Subject: fs/ntfs3: Add check for kmemdup + +From: Jiasheng Jiang + +[ Upstream commit e6c3cef24cb0d045f99d5cb039b344874e3cfd74 ] + +Since the kmemdup may return NULL pointer, +it should be better to add check for the return value +in order to avoid NULL pointer dereference. + +Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 20abdb2682860..88218831527c2 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -4256,6 +4256,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + rec_len -= t32; + + attr_names = kmemdup(Add2Ptr(lrh, t32), rec_len, GFP_NOFS); ++ if (!attr_names) { ++ err = -ENOMEM; ++ goto out; ++ } + + lcb_put(lcb); + lcb = NULL; +-- +2.39.2 + diff --git a/queue-5.15/fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch b/queue-5.15/fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch new file mode 100644 index 00000000000..7a03aaa285a --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch @@ -0,0 +1,71 @@ +From 0744d77e2f9a40087820f29245b242305eadb234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 17:24:14 +0800 +Subject: fs/ntfs3: Fix memory leak if ntfs_read_mft failed + +From: Chen Zhongjin + +[ Upstream commit bfa434c60157c9793e9b12c9b68ade02aff9f803 ] + +Label ATTR_ROOT in ntfs_read_mft() sets is_root = true and +ni->ni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC +and alloc ni->dir.alloc_run. However two states are not always +consistent and can make memory leak. + + 1) attr_name in ATTR_ROOT does not fit the condition it will set + is_root = true but NI_FLAG_DIR is not set. + 2) next attr_name in ATTR_ALLOC fits the condition and alloc + ni->dir.alloc_run + 3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees + ni->dir.alloc_run, otherwise it frees ni->file.run + 4) because NI_FLAG_DIR is not set in this case, ni->dir.alloc_run is + leaked as kmemleak reported: + +unreferenced object 0xffff888003bc5480 (size 64): + backtrace: + [<000000003d42e6b0>] __kmalloc_node+0x4e/0x1c0 + [<00000000d8e19b8a>] kvmalloc_node+0x39/0x1f0 + [<00000000fc3eb5b8>] run_add_entry+0x18a/0xa40 [ntfs3] + [<0000000011c9f978>] run_unpack+0x75d/0x8e0 [ntfs3] + [<00000000e7cf1819>] run_unpack_ex+0xbc/0x500 [ntfs3] + [<00000000bbf0a43d>] ntfs_iget5+0xb25/0x2dd0 [ntfs3] + [<00000000a6e50693>] ntfs_fill_super+0x218d/0x3580 [ntfs3] + [<00000000b9170608>] get_tree_bdev+0x3fb/0x710 + [<000000004833798a>] vfs_get_tree+0x8e/0x280 + [<000000006e20b8e6>] path_mount+0xf3c/0x1930 + [<000000007bf15a5f>] do_mount+0xf3/0x110 + ... + +Fix this by always setting is_root and NI_FLAG_DIR together. + +Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") +Signed-off-by: Chen Zhongjin +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 136236a25da60..359eff346910e 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -257,7 +257,6 @@ static struct inode *ntfs_read_mft(struct inode *inode, + goto out; + + root = Add2Ptr(attr, roff); +- is_root = true; + + if (attr->name_len != ARRAY_SIZE(I30_NAME) || + memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME))) +@@ -270,6 +269,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, + if (!is_dir) + goto next_attr; + ++ is_root = true; + ni->ni_flags |= NI_FLAG_DIR; + + err = indx_init(&ni->dir, sbi, attr, INDEX_MUTEX_I30); +-- +2.39.2 + diff --git a/queue-5.15/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch b/queue-5.15/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch new file mode 100644 index 00000000000..c9933017936 --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch @@ -0,0 +1,80 @@ +From 9cef343056036e96bcfdc98629134fa81f8cf8d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 10:21:59 +0000 +Subject: fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() + +From: ZhangPeng + +[ Upstream commit 254e69f284d7270e0abdc023ee53b71401c3ba0c ] + +Syzbot reported a null-ptr-deref bug: + +ntfs3: loop0: Different NTFS' sector size (1024) and media sector size +(512) +ntfs3: loop0: Mark volume as dirty due to NTFS errors +general protection fault, probably for non-canonical address +0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +RIP: 0010:d_flags_for_inode fs/dcache.c:1980 [inline] +RIP: 0010:__d_add+0x5ce/0x800 fs/dcache.c:2796 +Call Trace: + + d_splice_alias+0x122/0x3b0 fs/dcache.c:3191 + lookup_open fs/namei.c:3391 [inline] + open_last_lookups fs/namei.c:3481 [inline] + path_openat+0x10e6/0x2df0 fs/namei.c:3688 + do_filp_open+0x264/0x4f0 fs/namei.c:3718 + do_sys_openat2+0x124/0x4e0 fs/open.c:1310 + do_sys_open fs/open.c:1326 [inline] + __do_sys_open fs/open.c:1334 [inline] + __se_sys_open fs/open.c:1330 [inline] + __x64_sys_open+0x221/0x270 fs/open.c:1330 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +If the MFT record of ntfs inode is not a base record, inode->i_op can be +NULL. And a null-ptr-deref may happen: + +ntfs_lookup() + dir_search_u() # inode->i_op is set to NULL + d_splice_alias() + __d_add() + d_flags_for_inode() # inode->i_op->get_link null-ptr-deref + +Fix this by adding a Check on inode->i_op before calling the +d_splice_alias() function. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Reported-by: syzbot+a8f26a403c169b7593fe@syzkaller.appspotmail.com +Signed-off-by: ZhangPeng +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/namei.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c +index bc741213ad848..29fd76d94c744 100644 +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -86,6 +86,16 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, + __putname(uni); + } + ++ /* ++ * Check for a null pointer ++ * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL. ++ * This causes null pointer dereference in d_splice_alias(). ++ */ ++ if (!IS_ERR(inode) && inode->i_op == NULL) { ++ iput(inode); ++ inode = ERR_PTR(-EINVAL); ++ } ++ + return d_splice_alias(inode, dentry); + } + +-- +2.39.2 + diff --git a/queue-5.15/fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch b/queue-5.15/fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch new file mode 100644 index 00000000000..0d33eda8adf --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch @@ -0,0 +1,60 @@ +From 64ef6431c2e42fd9824d9a276cc8033c99e814ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 09:46:10 +0000 +Subject: fs/ntfs3: Fix OOB read in indx_insert_into_buffer + +From: ZhangPeng + +[ Upstream commit b8c44949044e5f7f864525fdffe8e95135ce9ce5 ] + +Syzbot reported a OOB read bug: + +BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 +fs/ntfs3/index.c:1755 +Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630 + +Call Trace: + + memmove+0x25/0x60 mm/kasan/shadow.c:54 + indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 + indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863 + ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548 + ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100 + lookup_open fs/namei.c:3413 [inline] + +If the member struct INDEX_BUFFER *index of struct indx_node is +incorrect, that is, the value of __le32 used is greater than the value +of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when +memmove is called in indx_insert_into_buffer(). +Fix this by adding a check in hdr_find_e(). + +Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") +Reported-by: syzbot+d882d57193079e379309@syzkaller.appspotmail.com +Signed-off-by: ZhangPeng +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 99f8a57e9f7a9..37688cf6e3d05 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -679,9 +679,13 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx, + u32 e_size, e_key_len; + u32 end = le32_to_cpu(hdr->used); + u32 off = le32_to_cpu(hdr->de_off); ++ u32 total = le32_to_cpu(hdr->total); + u16 offs[128]; + + fill_table: ++ if (end > total) ++ return NULL; ++ + if (off + sizeof(struct NTFS_DE) > end) + return NULL; + +-- +2.39.2 + diff --git a/queue-5.15/fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch b/queue-5.15/fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch new file mode 100644 index 00000000000..abd69f759a6 --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch @@ -0,0 +1,81 @@ +From 1367f16bfc52e19c4d192574943570a109260c26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 09:31:34 +0800 +Subject: fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() + +From: Zeng Heng + +[ Upstream commit ab84eee4c7ab929996602eda7832854c35a6dda2 ] + +Here is a BUG report from syzbot: + +BUG: KASAN: slab-out-of-bounds in hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806 +Read of size 16842960 at addr ffff888079cc0600 by task syz-executor934/3631 + +Call Trace: + memmove+0x25/0x60 mm/kasan/shadow.c:54 + hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806 + indx_delete_entry+0x74f/0x3670 fs/ntfs3/index.c:2193 + ni_remove_name+0x27a/0x980 fs/ntfs3/frecord.c:2910 + ntfs_unlink_inode+0x3d4/0x720 fs/ntfs3/inode.c:1712 + ntfs_rename+0x41a/0xcb0 fs/ntfs3/namei.c:276 + +Before using the meta-data in struct INDEX_HDR, we need to +check index header valid or not. Otherwise, the corruptedi +(or malicious) fs image can cause out-of-bounds access which +could make kernel panic. + +Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") +Reported-by: syzbot+9c2811fd56591639ff5f@syzkaller.appspotmail.com +Signed-off-by: Zeng Heng +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 2 +- + fs/ntfs3/index.c | 4 ++++ + fs/ntfs3/ntfs_fs.h | 1 + + 3 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 88218831527c2..59f813cbdaa8e 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2575,7 +2575,7 @@ static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn) + return find_log_rec(log, *lsn, lcb); + } + +-static inline bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes) ++bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes) + { + __le16 mask; + u32 min_de, de_off, used, total; +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 37688cf6e3d05..f62e0df7a7b4e 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -802,6 +802,10 @@ static inline struct NTFS_DE *hdr_delete_de(struct INDEX_HDR *hdr, + u32 off = PtrOffset(hdr, re); + int bytes = used - (off + esize); + ++ /* check INDEX_HDR valid before using INDEX_HDR */ ++ if (!check_index_header(hdr, le32_to_cpu(hdr->total))) ++ return NULL; ++ + if (off >= used || esize < sizeof(struct NTFS_DE) || + bytes < sizeof(struct NTFS_DE)) + return NULL; +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index 8aaec7e0804ef..e571e7643596e 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -575,6 +575,7 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, + bool ni_is_dirty(struct inode *inode); + + /* Globals from fslog.c */ ++bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes); + int log_replay(struct ntfs_inode *ni, bool *initialized); + + /* Globals from fsntfs.c */ +-- +2.39.2 + diff --git a/queue-5.15/hid-amd_sfh-add-support-for-shutdown-operation.patch b/queue-5.15/hid-amd_sfh-add-support-for-shutdown-operation.patch new file mode 100644 index 00000000000..2426ed8af14 --- /dev/null +++ b/queue-5.15/hid-amd_sfh-add-support-for-shutdown-operation.patch @@ -0,0 +1,51 @@ +From d2724ee2ee20d49265d14eab5f311f94340874c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:27 +0530 +Subject: HID: amd_sfh: Add support for shutdown operation + +From: Basavaraj Natikar + +[ Upstream commit 1353ecaf1830d6d1b74f3225378a9498b4e14fdd ] + +As soon as the system is booted after shutdown, the sensors may remain in +a weird state and fail to initialize. Therefore, all sensors should be +turned off during shutdown. + +Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +index f17f061aeb792..6ff8f254dc840 100644 +--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c ++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +@@ -351,6 +351,14 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i + return devm_add_action_or_reset(&pdev->dev, amd_mp2_pci_remove, privdata); + } + ++static void amd_sfh_shutdown(struct pci_dev *pdev) ++{ ++ struct amd_mp2_dev *mp2 = pci_get_drvdata(pdev); ++ ++ if (mp2 && mp2->mp2_ops) ++ mp2->mp2_ops->stop_all(mp2); ++} ++ + static int __maybe_unused amd_mp2_pci_resume(struct device *dev) + { + struct pci_dev *pdev = to_pci_dev(dev); +@@ -420,6 +428,7 @@ static struct pci_driver amd_mp2_pci_driver = { + .id_table = amd_mp2_pci_tbl, + .probe = amd_mp2_pci_probe, + .driver.pm = &amd_mp2_pm_ops, ++ .shutdown = amd_sfh_shutdown, + }; + module_pci_driver(amd_mp2_pci_driver); + +-- +2.39.2 + diff --git a/queue-5.15/hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch b/queue-5.15/hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch new file mode 100644 index 00000000000..5d72b4f0645 --- /dev/null +++ b/queue-5.15/hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch @@ -0,0 +1,49 @@ +From 03c0484c29e3708cecc4b1103bcd0c6a42114eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 19:19:39 +0200 +Subject: hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomáš Pecka + +[ Upstream commit 93822f5161a2dc57a60b95b35b3cb8589f53413e ] + +The bit flags in pmbus_driver_info functionality for YM-2151E chip were +joined with a comma operator instead of a bitwise OR. This means that +the last constant PMBUS_HAVE_IIN was not OR-ed with the other +PM_BUS_HAVE_* constants for this page but it initialized the next element +of the func array (which was not accessed from anywhere because of the +number of pages). + +However, there is no need for setting PMBUS_HAVE_IIN in the 5Vsb page +because this command does not seem to be paged. Obviously, the device +only has one IIN sensor, so it doesn't make sense to query it again from +the second page. + +Fixes: 1734b4135a62 ("hwmon: Add driver for fsp-3y PSUs and PDUs") +Signed-off-by: Jan Kundrát +Signed-off-by: Tomáš Pecka +Link: https://lore.kernel.org/r/20230420171939.212040-1-tomas.pecka@cesnet.cz +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/fsp-3y.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/hwmon/pmbus/fsp-3y.c b/drivers/hwmon/pmbus/fsp-3y.c +index aec294cc72d1f..c7469d2cdedcf 100644 +--- a/drivers/hwmon/pmbus/fsp-3y.c ++++ b/drivers/hwmon/pmbus/fsp-3y.c +@@ -180,7 +180,6 @@ static struct pmbus_driver_info fsp3y_info[] = { + PMBUS_HAVE_FAN12, + .func[YM2151_PAGE_5VSB_LOG] = + PMBUS_HAVE_VOUT | PMBUS_HAVE_IOUT, +- PMBUS_HAVE_IIN, + .read_word_data = fsp3y_read_word_data, + .read_byte_data = fsp3y_read_byte_data, + }, +-- +2.39.2 + diff --git a/queue-5.15/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch b/queue-5.15/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch new file mode 100644 index 00000000000..a24ca67b140 --- /dev/null +++ b/queue-5.15/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch @@ -0,0 +1,46 @@ +From c7ae5da8f86e8fb4bae3d44c70ef68677a373f65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 19:10:21 -0700 +Subject: i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error + path + +From: Lars-Peter Clausen + +[ Upstream commit ae1664f04f504a998737f5bb563f16b44357bcca ] + +The cdns_i2c_master_xfer() function gets a runtime PM reference when the +function is entered. This reference is released when the function is +exited. There is currently one error path where the function exits +directly, which leads to a leak of the runtime PM reference. + +Make sure that this error path also releases the runtime PM reference. + +Fixes: 1a351b10b967 ("i2c: cadence: Added slave support") +Signed-off-by: Lars-Peter Clausen +Reviewed-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 33f5588a50c07..5ea92dc97f0c5 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -828,8 +828,10 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, + #if IS_ENABLED(CONFIG_I2C_SLAVE) + /* Check i2c operating mode and switch if possible */ + if (id->dev_mode == CDNS_I2C_MODE_SLAVE) { +- if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE) +- return -EAGAIN; ++ if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE) { ++ ret = -EAGAIN; ++ goto out; ++ } + + /* Set mode to master */ + cdns_i2c_set_mode(CDNS_I2C_MODE_MASTER, id); +-- +2.39.2 + diff --git a/queue-5.15/ia64-mm-contig-fix-section-mismatch-warning-error.patch b/queue-5.15/ia64-mm-contig-fix-section-mismatch-warning-error.patch new file mode 100644 index 00000000000..e98e3be811d --- /dev/null +++ b/queue-5.15/ia64-mm-contig-fix-section-mismatch-warning-error.patch @@ -0,0 +1,41 @@ +From 7114a33f7f4efcad835327aa8361dd8d3ff56f7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:42:58 -0800 +Subject: ia64: mm/contig: fix section mismatch warning/error + +From: Randy Dunlap + +[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ] + +alloc_per_cpu_data() is called by find_memory(), which is marked as +__init. Therefore alloc_per_cpu_data() can also be marked as __init to +remedy this modpost problem. + +WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text) + +Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org +Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/mm/contig.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c +index 42e025cfbd088..9817caba07026 100644 +--- a/arch/ia64/mm/contig.c ++++ b/arch/ia64/mm/contig.c +@@ -77,7 +77,7 @@ void *per_cpu_init(void) + return __per_cpu_start + __per_cpu_offset[smp_processor_id()]; + } + +-static inline void ++static inline __init void + alloc_per_cpu_data(void) + { + size_t size = PERCPU_PAGE_SIZE * num_possible_cpus(); +-- +2.39.2 + diff --git a/queue-5.15/ia64-salinfo-placate-defined-but-not-used-warning.patch b/queue-5.15/ia64-salinfo-placate-defined-but-not-used-warning.patch new file mode 100644 index 00000000000..cae5e4edc6f --- /dev/null +++ b/queue-5.15/ia64-salinfo-placate-defined-but-not-used-warning.patch @@ -0,0 +1,42 @@ +From 189cc8c358903715188b33b86a9c800f3ee6ac8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:43:09 -0800 +Subject: ia64: salinfo: placate defined-but-not-used warning + +From: Randy Dunlap + +[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ] + +When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the +function as __maybe_unused to quieten the warning message. + +../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function] + 584 | static int proc_salinfo_show(struct seq_file *m, void *v) + | ^~~~~~~~~~~~~~~~~ + +Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org +Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/salinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c +index a25ab9b37953e..bb99b543dc672 100644 +--- a/arch/ia64/kernel/salinfo.c ++++ b/arch/ia64/kernel/salinfo.c +@@ -581,7 +581,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu) + * 'data' contains an integer that corresponds to the feature we're + * testing + */ +-static int proc_salinfo_show(struct seq_file *m, void *v) ++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v) + { + unsigned long data = (unsigned long)v; + seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n"); +-- +2.39.2 + diff --git a/queue-5.15/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch b/queue-5.15/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch new file mode 100644 index 00000000000..3d16b4aeb19 --- /dev/null +++ b/queue-5.15/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch @@ -0,0 +1,1148 @@ +From 540ac5ee88dc475292b0bf5335f5123f6c205d2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 12:52:44 -0400 +Subject: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA + requests + +From: Patrick Kelsey + +[ Upstream commit 00cbce5cbf88459cd1aa1d60d0f1df15477df127 ] + +hfi1 user SDMA request processing has two bugs that can cause data +corruption for user SDMA requests that have multiple payload iovecs +where an iovec other than the tail iovec does not run up to the page +boundary for the buffer pointed to by that iovec.a + +Here are the specific bugs: +1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len. + Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec + to the packet, even if some of those bytes are past + iovec->iov.iov_len and are thus not intended to be in the packet. +2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the + next iovec in user_sdma_request->iovs when the current iovec + is not PAGE_SIZE and does not contain enough data to complete the + packet. The transmitted packet will contain the wrong data from the + iovec pages. + +This has not been an issue with SDMA packets from hfi1 Verbs or PSM2 +because they only produce iovecs that end short of PAGE_SIZE as the tail +iovec of an SDMA request. + +Fixing these bugs exposes other bugs with the SDMA pin cache +(struct mmu_rb_handler) that get in way of supporting user SDMA requests +with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So +this commit fixes those issues as well. + +Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec +payload user SDMA requests can hit: +1. Overlapping memory ranges in mmu_rb_handler will result in duplicate + pinnings. +2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node), + the mmu_rb code (1) removes the existing entry under a lock, (2) + releases that lock, pins the new pages, (3) then reacquires the lock + to insert the extended mmu_rb_node. + + If someone else comes in and inserts an overlapping entry between (2) + and (3), insert in (3) will fail. + + The failure path code in this case unpins _all_ pages in either the + original mmu_rb_node or the new mmu_rb_node that was inserted between + (2) and (3). +3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is + incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node + could be evicted by another thread that gets mmu_rb_handler->lock and + checks mmu_rb_node->refcount before mmu_rb_node->refcount is + incremented. +4. Related to #2 above, SDMA request submission failure path does not + check mmu_rb_node->refcount before freeing mmu_rb_node object. + + If there are other SDMA requests in progress whose iovecs have + pointers to the now-freed mmu_rb_node(s), those pointers to the + now-freed mmu_rb nodes will be dereferenced when those SDMA requests + complete. + +Fixes: 7be85676f1d1 ("IB/hfi1: Don't remove RB entry when not needed.") +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088636445.3027109.10054635277810177889.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 1 + + drivers/infiniband/hw/hfi1/mmu_rb.c | 66 +-- + drivers/infiniband/hw/hfi1/mmu_rb.h | 8 +- + drivers/infiniband/hw/hfi1/sdma.c | 21 +- + drivers/infiniband/hw/hfi1/sdma.h | 16 +- + drivers/infiniband/hw/hfi1/sdma_txreq.h | 1 + + drivers/infiniband/hw/hfi1/trace_mmu.h | 4 - + drivers/infiniband/hw/hfi1/user_sdma.c | 600 +++++++++++++++--------- + drivers/infiniband/hw/hfi1/user_sdma.h | 5 - + drivers/infiniband/hw/hfi1/verbs.c | 4 +- + drivers/infiniband/hw/hfi1/vnic_sdma.c | 1 + + 11 files changed, 423 insertions(+), 304 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 15b0cb0f363f4..33ffb00c63823 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -251,6 +251,7 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx, + const skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + + ret = sdma_txadd_page(dd, ++ NULL, + txreq, + skb_frag_page(frag), + frag->bv_offset, +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index af46ff2033426..71b9ac0188875 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -126,7 +126,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, mnode->addr, mnode->len); + if (node) { +- ret = -EINVAL; ++ ret = -EEXIST; + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +@@ -143,6 +143,19 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + return ret; + } + ++/* Caller must hold handler lock */ ++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, ++ unsigned long addr, unsigned long len) ++{ ++ struct mmu_rb_node *node; ++ ++ trace_hfi1_mmu_rb_search(addr, len); ++ node = __mmu_int_rb_iter_first(&handler->root, addr, (addr + len) - 1); ++ if (node) ++ list_move_tail(&node->list, &handler->lru_list); ++ return node; ++} ++ + /* Caller must hold handler lock */ + static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + unsigned long addr, +@@ -167,34 +180,6 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + return node; + } + +-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, +- unsigned long addr, unsigned long len, +- struct mmu_rb_node **rb_node) +-{ +- struct mmu_rb_node *node; +- unsigned long flags; +- bool ret = false; +- +- if (current->mm != handler->mn.mm) +- return ret; +- +- spin_lock_irqsave(&handler->lock, flags); +- node = __mmu_rb_search(handler, addr, len); +- if (node) { +- if (node->addr == addr && node->len == len) { +- list_move_tail(&node->list, &handler->lru_list); +- goto unlock; +- } +- __mmu_int_rb_remove(node, &handler->root); +- list_del(&node->list); /* remove from LRU list */ +- ret = true; +- } +-unlock: +- spin_unlock_irqrestore(&handler->lock, flags); +- *rb_node = node; +- return ret; +-} +- + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + { + struct mmu_rb_node *rbnode, *ptr; +@@ -225,29 +210,6 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + } + +-/* +- * It is up to the caller to ensure that this function does not race with the +- * mmu invalidate notifier which may be calling the users remove callback on +- * 'node'. +- */ +-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, +- struct mmu_rb_node *node) +-{ +- unsigned long flags; +- +- if (current->mm != handler->mn.mm) +- return; +- +- /* Validity of handler and node pointers has been checked by caller. */ +- trace_hfi1_mmu_rb_remove(node->addr, node->len); +- spin_lock_irqsave(&handler->lock, flags); +- __mmu_int_rb_remove(node, &handler->root); +- list_del(&node->list); /* remove from LRU list */ +- spin_unlock_irqrestore(&handler->lock, flags); +- +- handler->ops->remove(handler->ops_arg, node); +-} +- + static int mmu_notifier_range_start(struct mmu_notifier *mn, + const struct mmu_notifier_range *range) + { +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h +index 7417be2b9dc8a..ed75acdb7b839 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.h ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h +@@ -52,10 +52,8 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler); + int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + struct mmu_rb_node *mnode); + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg); +-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, +- struct mmu_rb_node *mnode); +-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, +- unsigned long addr, unsigned long len, +- struct mmu_rb_node **rb_node); ++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, ++ unsigned long addr, ++ unsigned long len); + + #endif /* _HFI1_MMU_RB_H */ +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 8ed20392e9f0d..bb2552dd29c1e 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -1593,22 +1593,7 @@ static inline void sdma_unmap_desc( + struct hfi1_devdata *dd, + struct sdma_desc *descp) + { +- switch (sdma_mapping_type(descp)) { +- case SDMA_MAP_SINGLE: +- dma_unmap_single( +- &dd->pcidev->dev, +- sdma_mapping_addr(descp), +- sdma_mapping_len(descp), +- DMA_TO_DEVICE); +- break; +- case SDMA_MAP_PAGE: +- dma_unmap_page( +- &dd->pcidev->dev, +- sdma_mapping_addr(descp), +- sdma_mapping_len(descp), +- DMA_TO_DEVICE); +- break; +- } ++ system_descriptor_complete(dd, descp); + } + + /* +@@ -3128,7 +3113,7 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx, + + /* Add descriptor for coalesce buffer */ + tx->desc_limit = MAX_DESC; +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, + addr, tx->tlen); + } + +@@ -3167,10 +3152,12 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + return rval; + } + } ++ + /* finish the one just added */ + make_tx_sdma_desc( + tx, + SDMA_MAP_NONE, ++ NULL, + dd->sdma_pad_phys, + sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); + tx->num_desc++; +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index b023fc461bd51..95aaec14c6c28 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -594,6 +594,7 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d) + static inline void make_tx_sdma_desc( + struct sdma_txreq *tx, + int type, ++ void *pinning_ctx, + dma_addr_t addr, + size_t len) + { +@@ -612,6 +613,7 @@ static inline void make_tx_sdma_desc( + << SDMA_DESC0_PHY_ADDR_SHIFT) | + (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK) + << SDMA_DESC0_BYTE_COUNT_SHIFT); ++ desc->pinning_ctx = pinning_ctx; + } + + /* helper to extend txreq */ +@@ -643,6 +645,7 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd, + static inline int _sdma_txadd_daddr( + struct hfi1_devdata *dd, + int type, ++ void *pinning_ctx, + struct sdma_txreq *tx, + dma_addr_t addr, + u16 len) +@@ -652,6 +655,7 @@ static inline int _sdma_txadd_daddr( + make_tx_sdma_desc( + tx, + type, ++ pinning_ctx, + addr, len); + WARN_ON(len > tx->tlen); + tx->num_desc++; +@@ -672,6 +676,7 @@ static inline int _sdma_txadd_daddr( + /** + * sdma_txadd_page() - add a page to the sdma_txreq + * @dd: the device to use for mapping ++ * @pinning_ctx: context to be released at descriptor retirement + * @tx: tx request to which the page is added + * @page: page to map + * @offset: offset within the page +@@ -687,6 +692,7 @@ static inline int _sdma_txadd_daddr( + */ + static inline int sdma_txadd_page( + struct hfi1_devdata *dd, ++ void *pinning_ctx, + struct sdma_txreq *tx, + struct page *page, + unsigned long offset, +@@ -714,8 +720,7 @@ static inline int sdma_txadd_page( + return -ENOSPC; + } + +- return _sdma_txadd_daddr( +- dd, SDMA_MAP_PAGE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len); + } + + /** +@@ -749,7 +754,8 @@ static inline int sdma_txadd_daddr( + return rval; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx, ++ addr, len); + } + + /** +@@ -795,8 +801,7 @@ static inline int sdma_txadd_kvaddr( + return -ENOSPC; + } + +- return _sdma_txadd_daddr( +- dd, SDMA_MAP_SINGLE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len); + } + + struct iowait_work; +@@ -1030,4 +1035,5 @@ extern uint mod_num_sdma; + + void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid); + ++void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp); + #endif +diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h +index e262fb5c5ec61..fad946cb5e0d8 100644 +--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h ++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h +@@ -19,6 +19,7 @@ + struct sdma_desc { + /* private: don't use directly */ + u64 qw[2]; ++ void *pinning_ctx; + }; + + /** +diff --git a/drivers/infiniband/hw/hfi1/trace_mmu.h b/drivers/infiniband/hw/hfi1/trace_mmu.h +index 187e9244fe5ed..57900ebb7702e 100644 +--- a/drivers/infiniband/hw/hfi1/trace_mmu.h ++++ b/drivers/infiniband/hw/hfi1/trace_mmu.h +@@ -37,10 +37,6 @@ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_search, + TP_PROTO(unsigned long addr, unsigned long len), + TP_ARGS(addr, len)); + +-DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_remove, +- TP_PROTO(unsigned long addr, unsigned long len), +- TP_ARGS(addr, len)); +- + DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_mem_invalidate, + TP_PROTO(unsigned long addr, unsigned long len), + TP_ARGS(addr, len)); +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index 5b11c82827445..a932ae1e03af5 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -24,7 +24,6 @@ + + #include "hfi.h" + #include "sdma.h" +-#include "mmu_rb.h" + #include "user_sdma.h" + #include "verbs.h" /* for the headers */ + #include "common.h" /* for struct hfi1_tid_info */ +@@ -39,11 +38,7 @@ static unsigned initial_pkt_count = 8; + static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts); + static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status); + static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq); +-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin); +-static int pin_vector_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec); +-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, +- unsigned start, unsigned npages); ++static void user_sdma_free_request(struct user_sdma_request *req); + static int check_header_template(struct user_sdma_request *req, + struct hfi1_pkt_header *hdr, u32 lrhlen, + u32 datalen); +@@ -81,6 +76,11 @@ static struct mmu_rb_ops sdma_rb_ops = { + .invalidate = sdma_rb_invalidate + }; + ++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ u32 *pkt_remaining); ++ + static int defer_packet_queue( + struct sdma_engine *sde, + struct iowait_work *wait, +@@ -412,6 +412,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + ret = -EINVAL; + goto free_req; + } ++ + /* Copy the header from the user buffer */ + ret = copy_from_user(&req->hdr, iovec[idx].iov_base + sizeof(info), + sizeof(req->hdr)); +@@ -486,9 +487,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + memcpy(&req->iovs[i].iov, + iovec + idx++, + sizeof(req->iovs[i].iov)); +- ret = pin_vector_pages(req, &req->iovs[i]); +- if (ret) { +- req->data_iovs = i; ++ if (req->iovs[i].iov.iov_len == 0) { ++ ret = -EINVAL; + goto free_req; + } + req->data_len += req->iovs[i].iov.iov_len; +@@ -586,7 +586,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + if (req->seqsubmitted) + wait_event(pq->busy.wait_dma, + (req->seqcomp == req->seqsubmitted - 1)); +- user_sdma_free_request(req, true); ++ user_sdma_free_request(req); + pq_update(pq); + set_comp_state(pq, cq, info.comp_idx, ERROR, ret); + } +@@ -698,48 +698,6 @@ static int user_sdma_txadd_ahg(struct user_sdma_request *req, + return ret; + } + +-static int user_sdma_txadd(struct user_sdma_request *req, +- struct user_sdma_txreq *tx, +- struct user_sdma_iovec *iovec, u32 datalen, +- u32 *queued_ptr, u32 *data_sent_ptr, +- u64 *iov_offset_ptr) +-{ +- int ret; +- unsigned int pageidx, len; +- unsigned long base, offset; +- u64 iov_offset = *iov_offset_ptr; +- u32 queued = *queued_ptr, data_sent = *data_sent_ptr; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- +- base = (unsigned long)iovec->iov.iov_base; +- offset = offset_in_page(base + iovec->offset + iov_offset); +- pageidx = (((iovec->offset + iov_offset + base) - (base & PAGE_MASK)) >> +- PAGE_SHIFT); +- len = offset + req->info.fragsize > PAGE_SIZE ? +- PAGE_SIZE - offset : req->info.fragsize; +- len = min((datalen - queued), len); +- ret = sdma_txadd_page(pq->dd, &tx->txreq, iovec->pages[pageidx], +- offset, len); +- if (ret) { +- SDMA_DBG(req, "SDMA txreq add page failed %d\n", ret); +- return ret; +- } +- iov_offset += len; +- queued += len; +- data_sent += len; +- if (unlikely(queued < datalen && pageidx == iovec->npages && +- req->iov_idx < req->data_iovs - 1)) { +- iovec->offset += iov_offset; +- iovec = &req->iovs[++req->iov_idx]; +- iov_offset = 0; +- } +- +- *queued_ptr = queued; +- *data_sent_ptr = data_sent; +- *iov_offset_ptr = iov_offset; +- return ret; +-} +- + static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + { + int ret = 0; +@@ -771,8 +729,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + maxpkts = req->info.npkts - req->seqnum; + + while (npkts < maxpkts) { +- u32 datalen = 0, queued = 0, data_sent = 0; +- u64 iov_offset = 0; ++ u32 datalen = 0; + + /* + * Check whether any of the completions have come back +@@ -865,27 +822,17 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + goto free_txreq; + } + +- /* +- * If the request contains any data vectors, add up to +- * fragsize bytes to the descriptor. +- */ +- while (queued < datalen && +- (req->sent + data_sent) < req->data_len) { +- ret = user_sdma_txadd(req, tx, iovec, datalen, +- &queued, &data_sent, &iov_offset); +- if (ret) +- goto free_txreq; +- } +- /* +- * The txreq was submitted successfully so we can update +- * the counters. +- */ + req->koffset += datalen; + if (req_opcode(req->info.ctrl) == EXPECTED) + req->tidoffset += datalen; +- req->sent += data_sent; +- if (req->data_len) +- iovec->offset += iov_offset; ++ req->sent += datalen; ++ while (datalen) { ++ ret = add_system_pages_to_sdma_packet(req, tx, iovec, ++ &datalen); ++ if (ret) ++ goto free_txreq; ++ iovec = &req->iovs[req->iov_idx]; ++ } + list_add_tail(&tx->txreq.list, &req->txps); + /* + * It is important to increment this here as it is used to +@@ -922,133 +869,14 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + static u32 sdma_cache_evict(struct hfi1_user_sdma_pkt_q *pq, u32 npages) + { + struct evict_data evict_data; ++ struct mmu_rb_handler *handler = pq->handler; + + evict_data.cleared = 0; + evict_data.target = npages; +- hfi1_mmu_rb_evict(pq->handler, &evict_data); ++ hfi1_mmu_rb_evict(handler, &evict_data); + return evict_data.cleared; + } + +-static int pin_sdma_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec, +- struct sdma_mmu_node *node, +- int npages) +-{ +- int pinned, cleared; +- struct page **pages; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- +- pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); +- if (!pages) +- return -ENOMEM; +- memcpy(pages, node->pages, node->npages * sizeof(*pages)); +- +- npages -= node->npages; +-retry: +- if (!hfi1_can_pin_pages(pq->dd, current->mm, +- atomic_read(&pq->n_locked), npages)) { +- cleared = sdma_cache_evict(pq, npages); +- if (cleared >= npages) +- goto retry; +- } +- pinned = hfi1_acquire_user_pages(current->mm, +- ((unsigned long)iovec->iov.iov_base + +- (node->npages * PAGE_SIZE)), npages, 0, +- pages + node->npages); +- if (pinned < 0) { +- kfree(pages); +- return pinned; +- } +- if (pinned != npages) { +- unpin_vector_pages(current->mm, pages, node->npages, pinned); +- return -EFAULT; +- } +- kfree(node->pages); +- node->rb.len = iovec->iov.iov_len; +- node->pages = pages; +- atomic_add(pinned, &pq->n_locked); +- return pinned; +-} +- +-static void unpin_sdma_pages(struct sdma_mmu_node *node) +-{ +- if (node->npages) { +- unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, +- node->npages); +- atomic_sub(node->npages, &node->pq->n_locked); +- } +-} +- +-static int pin_vector_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec) +-{ +- int ret = 0, pinned, npages; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- struct sdma_mmu_node *node = NULL; +- struct mmu_rb_node *rb_node; +- struct iovec *iov; +- bool extracted; +- +- extracted = +- hfi1_mmu_rb_remove_unless_exact(pq->handler, +- (unsigned long) +- iovec->iov.iov_base, +- iovec->iov.iov_len, &rb_node); +- if (rb_node) { +- node = container_of(rb_node, struct sdma_mmu_node, rb); +- if (!extracted) { +- atomic_inc(&node->refcount); +- iovec->pages = node->pages; +- iovec->npages = node->npages; +- iovec->node = node; +- return 0; +- } +- } +- +- if (!node) { +- node = kzalloc(sizeof(*node), GFP_KERNEL); +- if (!node) +- return -ENOMEM; +- +- node->rb.addr = (unsigned long)iovec->iov.iov_base; +- node->pq = pq; +- atomic_set(&node->refcount, 0); +- } +- +- iov = &iovec->iov; +- npages = num_user_pages((unsigned long)iov->iov_base, iov->iov_len); +- if (node->npages < npages) { +- pinned = pin_sdma_pages(req, iovec, node, npages); +- if (pinned < 0) { +- ret = pinned; +- goto bail; +- } +- node->npages += pinned; +- npages = node->npages; +- } +- iovec->pages = node->pages; +- iovec->npages = npages; +- iovec->node = node; +- +- ret = hfi1_mmu_rb_insert(req->pq->handler, &node->rb); +- if (ret) { +- iovec->node = NULL; +- goto bail; +- } +- return 0; +-bail: +- unpin_sdma_pages(node); +- kfree(node); +- return ret; +-} +- +-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, +- unsigned start, unsigned npages) +-{ +- hfi1_release_user_pages(mm, pages + start, npages, false); +- kfree(pages); +-} +- + static int check_header_template(struct user_sdma_request *req, + struct hfi1_pkt_header *hdr, u32 lrhlen, + u32 datalen) +@@ -1390,7 +1218,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status) + if (req->seqcomp != req->info.npkts - 1) + return; + +- user_sdma_free_request(req, false); ++ user_sdma_free_request(req); + set_comp_state(pq, cq, req->info.comp_idx, state, status); + pq_update(pq); + } +@@ -1401,10 +1229,8 @@ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq) + wake_up(&pq->wait); + } + +-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) ++static void user_sdma_free_request(struct user_sdma_request *req) + { +- int i; +- + if (!list_empty(&req->txps)) { + struct sdma_txreq *t, *p; + +@@ -1417,21 +1243,6 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) + } + } + +- for (i = 0; i < req->data_iovs; i++) { +- struct sdma_mmu_node *node = req->iovs[i].node; +- +- if (!node) +- continue; +- +- req->iovs[i].node = NULL; +- +- if (unpin) +- hfi1_mmu_rb_remove(req->pq->handler, +- &node->rb); +- else +- atomic_dec(&node->refcount); +- } +- + kfree(req->tids); + clear_bit(req->info.comp_idx, req->pq->req_in_use); + } +@@ -1449,6 +1260,368 @@ static inline void set_comp_state(struct hfi1_user_sdma_pkt_q *pq, + idx, state, ret); + } + ++static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, ++ unsigned int start, unsigned int npages) ++{ ++ hfi1_release_user_pages(mm, pages + start, npages, false); ++ kfree(pages); ++} ++ ++static void free_system_node(struct sdma_mmu_node *node) ++{ ++ if (node->npages) { ++ unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, ++ node->npages); ++ atomic_sub(node->npages, &node->pq->n_locked); ++ } ++ kfree(node); ++} ++ ++static inline void acquire_node(struct sdma_mmu_node *node) ++{ ++ atomic_inc(&node->refcount); ++ WARN_ON(atomic_read(&node->refcount) < 0); ++} ++ ++static inline void release_node(struct mmu_rb_handler *handler, ++ struct sdma_mmu_node *node) ++{ ++ atomic_dec(&node->refcount); ++ WARN_ON(atomic_read(&node->refcount) < 0); ++} ++ ++static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, ++ unsigned long start, ++ unsigned long end) ++{ ++ struct mmu_rb_node *rb_node; ++ struct sdma_mmu_node *node; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&handler->lock, flags); ++ rb_node = hfi1_mmu_rb_get_first(handler, start, (end - start)); ++ if (!rb_node) { ++ spin_unlock_irqrestore(&handler->lock, flags); ++ return NULL; ++ } ++ node = container_of(rb_node, struct sdma_mmu_node, rb); ++ acquire_node(node); ++ spin_unlock_irqrestore(&handler->lock, flags); ++ ++ return node; ++} ++ ++static int pin_system_pages(struct user_sdma_request *req, ++ uintptr_t start_address, size_t length, ++ struct sdma_mmu_node *node, int npages) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ int pinned, cleared; ++ struct page **pages; ++ ++ pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); ++ if (!pages) ++ return -ENOMEM; ++ ++retry: ++ if (!hfi1_can_pin_pages(pq->dd, current->mm, atomic_read(&pq->n_locked), ++ npages)) { ++ SDMA_DBG(req, "Evicting: nlocked %u npages %u", ++ atomic_read(&pq->n_locked), npages); ++ cleared = sdma_cache_evict(pq, npages); ++ if (cleared >= npages) ++ goto retry; ++ } ++ ++ SDMA_DBG(req, "Acquire user pages start_address %lx node->npages %u npages %u", ++ start_address, node->npages, npages); ++ pinned = hfi1_acquire_user_pages(current->mm, start_address, npages, 0, ++ pages); ++ ++ if (pinned < 0) { ++ kfree(pages); ++ SDMA_DBG(req, "pinned %d", pinned); ++ return pinned; ++ } ++ if (pinned != npages) { ++ unpin_vector_pages(current->mm, pages, node->npages, pinned); ++ SDMA_DBG(req, "npages %u pinned %d", npages, pinned); ++ return -EFAULT; ++ } ++ node->rb.addr = start_address; ++ node->rb.len = length; ++ node->pages = pages; ++ node->npages = npages; ++ atomic_add(pinned, &pq->n_locked); ++ SDMA_DBG(req, "done. pinned %d", pinned); ++ return 0; ++} ++ ++static int add_system_pinning(struct user_sdma_request *req, ++ struct sdma_mmu_node **node_p, ++ unsigned long start, unsigned long len) ++ ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ struct sdma_mmu_node *node; ++ int ret; ++ ++ node = kzalloc(sizeof(*node), GFP_KERNEL); ++ if (!node) ++ return -ENOMEM; ++ ++ node->pq = pq; ++ ret = pin_system_pages(req, start, len, node, PFN_DOWN(len)); ++ if (ret == 0) { ++ ret = hfi1_mmu_rb_insert(pq->handler, &node->rb); ++ if (ret) ++ free_system_node(node); ++ else ++ *node_p = node; ++ ++ return ret; ++ } ++ ++ kfree(node); ++ return ret; ++} ++ ++static int get_system_cache_entry(struct user_sdma_request *req, ++ struct sdma_mmu_node **node_p, ++ size_t req_start, size_t req_len) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ u64 start = ALIGN_DOWN(req_start, PAGE_SIZE); ++ u64 end = PFN_ALIGN(req_start + req_len); ++ struct mmu_rb_handler *handler = pq->handler; ++ int ret; ++ ++ if ((end - start) == 0) { ++ SDMA_DBG(req, ++ "Request for empty cache entry req_start %lx req_len %lx start %llx end %llx", ++ req_start, req_len, start, end); ++ return -EINVAL; ++ } ++ ++ SDMA_DBG(req, "req_start %lx req_len %lu", req_start, req_len); ++ ++ while (1) { ++ struct sdma_mmu_node *node = ++ find_system_node(handler, start, end); ++ u64 prepend_len = 0; ++ ++ SDMA_DBG(req, "node %p start %llx end %llu", node, start, end); ++ if (!node) { ++ ret = add_system_pinning(req, node_p, start, ++ end - start); ++ if (ret == -EEXIST) { ++ /* ++ * Another execution context has inserted a ++ * conficting entry first. ++ */ ++ continue; ++ } ++ return ret; ++ } ++ ++ if (node->rb.addr <= start) { ++ /* ++ * This entry covers at least part of the region. If it doesn't extend ++ * to the end, then this will be called again for the next segment. ++ */ ++ *node_p = node; ++ return 0; ++ } ++ ++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d", ++ node->rb.addr, atomic_read(&node->refcount)); ++ prepend_len = node->rb.addr - start; ++ ++ /* ++ * This node will not be returned, instead a new node ++ * will be. So release the reference. ++ */ ++ release_node(handler, node); ++ ++ /* Prepend a node to cover the beginning of the allocation */ ++ ret = add_system_pinning(req, node_p, start, prepend_len); ++ if (ret == -EEXIST) { ++ /* Another execution context has inserted a conficting entry first. */ ++ continue; ++ } ++ return ret; ++ } ++} ++ ++static int add_mapping_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct sdma_mmu_node *cache_entry, ++ size_t start, ++ size_t from_this_cache_entry) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ unsigned int page_offset; ++ unsigned int from_this_page; ++ size_t page_index; ++ void *ctx; ++ int ret; ++ ++ /* ++ * Because the cache may be more fragmented than the memory that is being accessed, ++ * it's not strictly necessary to have a descriptor per cache entry. ++ */ ++ ++ while (from_this_cache_entry) { ++ page_index = PFN_DOWN(start - cache_entry->rb.addr); ++ ++ if (page_index >= cache_entry->npages) { ++ SDMA_DBG(req, ++ "Request for page_index %zu >= cache_entry->npages %u", ++ page_index, cache_entry->npages); ++ return -EINVAL; ++ } ++ ++ page_offset = start - ALIGN_DOWN(start, PAGE_SIZE); ++ from_this_page = PAGE_SIZE - page_offset; ++ ++ if (from_this_page < from_this_cache_entry) { ++ ctx = NULL; ++ } else { ++ /* ++ * In the case they are equal the next line has no practical effect, ++ * but it's better to do a register to register copy than a conditional ++ * branch. ++ */ ++ from_this_page = from_this_cache_entry; ++ ctx = cache_entry; ++ } ++ ++ ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq, ++ cache_entry->pages[page_index], ++ page_offset, from_this_page); ++ if (ret) { ++ /* ++ * When there's a failure, the entire request is freed by ++ * user_sdma_send_pkts(). ++ */ ++ SDMA_DBG(req, ++ "sdma_txadd_page failed %d page_index %lu page_offset %u from_this_page %u", ++ ret, page_index, page_offset, from_this_page); ++ return ret; ++ } ++ start += from_this_page; ++ from_this_cache_entry -= from_this_page; ++ } ++ return 0; ++} ++ ++static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ size_t from_this_iovec) ++{ ++ struct mmu_rb_handler *handler = req->pq->handler; ++ ++ while (from_this_iovec > 0) { ++ struct sdma_mmu_node *cache_entry; ++ size_t from_this_cache_entry; ++ size_t start; ++ int ret; ++ ++ start = (uintptr_t)iovec->iov.iov_base + iovec->offset; ++ ret = get_system_cache_entry(req, &cache_entry, start, ++ from_this_iovec); ++ if (ret) { ++ SDMA_DBG(req, "pin system segment failed %d", ret); ++ return ret; ++ } ++ ++ from_this_cache_entry = cache_entry->rb.len - (start - cache_entry->rb.addr); ++ if (from_this_cache_entry > from_this_iovec) ++ from_this_cache_entry = from_this_iovec; ++ ++ ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start, ++ from_this_cache_entry); ++ if (ret) { ++ /* ++ * We're guaranteed that there will be no descriptor ++ * completion callback that releases this node ++ * because only the last descriptor referencing it ++ * has a context attached, and a failure means the ++ * last descriptor was never added. ++ */ ++ release_node(handler, cache_entry); ++ SDMA_DBG(req, "add system segment failed %d", ret); ++ return ret; ++ } ++ ++ iovec->offset += from_this_cache_entry; ++ from_this_iovec -= from_this_cache_entry; ++ } ++ ++ return 0; ++} ++ ++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ u32 *pkt_data_remaining) ++{ ++ size_t remaining_to_add = *pkt_data_remaining; ++ /* ++ * Walk through iovec entries, ensure the associated pages ++ * are pinned and mapped, add data to the packet until no more ++ * data remains to be added. ++ */ ++ while (remaining_to_add > 0) { ++ struct user_sdma_iovec *cur_iovec; ++ size_t from_this_iovec; ++ int ret; ++ ++ cur_iovec = iovec; ++ from_this_iovec = iovec->iov.iov_len - iovec->offset; ++ ++ if (from_this_iovec > remaining_to_add) { ++ from_this_iovec = remaining_to_add; ++ } else { ++ /* The current iovec entry will be consumed by this pass. */ ++ req->iov_idx++; ++ iovec++; ++ } ++ ++ ret = add_system_iovec_to_sdma_packet(req, tx, cur_iovec, ++ from_this_iovec); ++ if (ret) ++ return ret; ++ ++ remaining_to_add -= from_this_iovec; ++ } ++ *pkt_data_remaining = remaining_to_add; ++ ++ return 0; ++} ++ ++void system_descriptor_complete(struct hfi1_devdata *dd, ++ struct sdma_desc *descp) ++{ ++ switch (sdma_mapping_type(descp)) { ++ case SDMA_MAP_SINGLE: ++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ case SDMA_MAP_PAGE: ++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ } ++ ++ if (descp->pinning_ctx) { ++ struct sdma_mmu_node *node = descp->pinning_ctx; ++ ++ release_node(node->rb.handler, node); ++ } ++} ++ + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len) + { +@@ -1495,8 +1668,7 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode) + struct sdma_mmu_node *node = + container_of(mnode, struct sdma_mmu_node, rb); + +- unpin_sdma_pages(node); +- kfree(node); ++ free_system_node(node); + } + + static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode) +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index ea56eb57e6568..a241836371dc1 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -112,16 +112,11 @@ struct sdma_mmu_node { + struct user_sdma_iovec { + struct list_head list; + struct iovec iov; +- /* number of pages in this vector */ +- unsigned int npages; +- /* array of pinned pages for this vector */ +- struct page **pages; + /* + * offset into the virtual address space of the vector at + * which we last left off. + */ + u64 offset; +- struct sdma_mmu_node *node; + }; + + /* evict operation argument */ +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index ef8e0bdacb516..dcc167dcfc61b 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -778,8 +778,8 @@ static int build_verbs_tx_desc( + + /* add icrc, lt byte, and padding to flit */ + if (extra_bytes) +- ret = sdma_txadd_daddr(sde->dd, &tx->txreq, +- sde->dd->sdma_pad_phys, extra_bytes); ++ ret = sdma_txadd_daddr(sde->dd, &tx->txreq, sde->dd->sdma_pad_phys, ++ extra_bytes); + + bail_txadd: + return ret; +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index c3f0f8d877c37..727eedfba332a 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -64,6 +64,7 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde, + + /* combine physically continuous fragments later? */ + ret = sdma_txadd_page(sde->dd, ++ NULL, + &tx->txreq, + skb_frag_page(frag), + skb_frag_off(frag), +-- +2.39.2 + diff --git a/queue-5.15/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch b/queue-5.15/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch new file mode 100644 index 00000000000..33ec1d95daf --- /dev/null +++ b/queue-5.15/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch @@ -0,0 +1,93 @@ +From 9aecbced74e41b373e2733fb4b217401394124f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 12:52:39 -0400 +Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order + +From: Patrick Kelsey + +[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ] + +hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in +mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node. + +As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly +least-recently used nodes. + +This could be a performance issue for an application when that +application: +- Uses some long-lived buffers frequently. +- Uses a large number of buffers once. +- Hits the mmu_rb_handler cache size or pinned-page limits, forcing + mmu_rb_handler cache entries to be evicted. + +In this case, the one-time use buffers cause the long-lived buffer +entries to eventually filter to the end of the LRU list where +hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived +entry instead of evicting one of the one-time use entries. + +Fix this by inserting new mmu_rb_node at the tail of +mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of +mmu_rb_handler->lru_list when the mmu_rb_node is a hit in +hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict +from the head of mmu_rb_handler->lru_list instead of the tail. + +Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 7333646021bb8..af46ff2033426 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -130,7 +130,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +- list_add(&mnode->list, &handler->lru_list); ++ list_add_tail(&mnode->list, &handler->lru_list); + + ret = handler->ops->insert(handler->ops_arg, mnode); + if (ret) { +@@ -181,8 +181,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, addr, len); + if (node) { +- if (node->addr == addr && node->len == len) ++ if (node->addr == addr && node->len == len) { ++ list_move_tail(&node->list, &handler->lru_list); + goto unlock; ++ } + __mmu_int_rb_remove(node, &handler->root); + list_del(&node->list); /* remove from LRU list */ + ret = true; +@@ -206,8 +208,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + INIT_LIST_HEAD(&del_list); + + spin_lock_irqsave(&handler->lock, flags); +- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list, +- list) { ++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -219,9 +220,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- while (!list_empty(&del_list)) { +- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); +- list_del(&rbnode->list); ++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) { + handler->ops->remove(handler->ops_arg, rbnode); + } + } +-- +2.39.2 + diff --git a/queue-5.15/iio-light-max44009-add-missing-of-device-matching.patch b/queue-5.15/iio-light-max44009-add-missing-of-device-matching.patch new file mode 100644 index 00000000000..c89e8a440c8 --- /dev/null +++ b/queue-5.15/iio-light-max44009-add-missing-of-device-matching.patch @@ -0,0 +1,66 @@ +From 1e2d45d62450cb4f5d1423529e131b8be03aab97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 16:34:28 +0100 +Subject: iio: light: max44009: add missing OF device matching +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit b29c49026c3c05a11f845dba17cad0b3ba06836d ] + +The driver currently matches only via i2c_device_id, but also has +of_device_id table: + + drivers/iio/light/max44009.c:545:34: error: ‘max44009_of_match’ defined but not used [-Werror=unused-const-variable=] + +Fixes: 6aef699a7d7e ("iio: light: add driver for MAX44009") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230312153429.371702-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/light/max44009.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/light/max44009.c b/drivers/iio/light/max44009.c +index 801e5a0ad496b..f3648f20ef2c0 100644 +--- a/drivers/iio/light/max44009.c ++++ b/drivers/iio/light/max44009.c +@@ -528,6 +528,12 @@ static int max44009_probe(struct i2c_client *client, + return devm_iio_device_register(&client->dev, indio_dev); + } + ++static const struct of_device_id max44009_of_match[] = { ++ { .compatible = "maxim,max44009" }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, max44009_of_match); ++ + static const struct i2c_device_id max44009_id[] = { + { "max44009", 0 }, + { } +@@ -537,18 +543,13 @@ MODULE_DEVICE_TABLE(i2c, max44009_id); + static struct i2c_driver max44009_driver = { + .driver = { + .name = MAX44009_DRV_NAME, ++ .of_match_table = max44009_of_match, + }, + .probe = max44009_probe, + .id_table = max44009_id, + }; + module_i2c_driver(max44009_driver); + +-static const struct of_device_id max44009_of_match[] = { +- { .compatible = "maxim,max44009" }, +- { } +-}; +-MODULE_DEVICE_TABLE(of, max44009_of_match); +- + MODULE_AUTHOR("Robert Eshleman "); + MODULE_LICENSE("GPL v2"); + MODULE_DESCRIPTION("MAX44009 ambient light sensor driver"); +-- +2.39.2 + diff --git a/queue-5.15/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch b/queue-5.15/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch new file mode 100644 index 00000000000..532e53992d4 --- /dev/null +++ b/queue-5.15/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch @@ -0,0 +1,48 @@ +From 394b69f2aa816b1d054e57e8a357fca74f2e378f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 23:05:20 -0700 +Subject: Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe + +From: Miaoqian Lin + +[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ] + +rpi_firmware_get() take reference, we need to release it in error paths +as well. Use devm_rpi_firmware_get() helper to handling the resources. +Also remove the existing rpi_firmware_put(). + +Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver") +Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed") +Signed-off-by: Miaoqian Lin +Reviewed-by: Mattijs Korpershoek +Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/raspberrypi-ts.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c +index 5000f5fd9ec38..45c575df994e0 100644 +--- a/drivers/input/touchscreen/raspberrypi-ts.c ++++ b/drivers/input/touchscreen/raspberrypi-ts.c +@@ -134,7 +134,7 @@ static int rpi_ts_probe(struct platform_device *pdev) + return -ENOENT; + } + +- fw = rpi_firmware_get(fw_node); ++ fw = devm_rpi_firmware_get(&pdev->dev, fw_node); + of_node_put(fw_node); + if (!fw) + return -EPROBE_DEFER; +@@ -160,7 +160,6 @@ static int rpi_ts_probe(struct platform_device *pdev) + touchbuf = (u32)ts->fw_regs_phys; + error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF, + &touchbuf, sizeof(touchbuf)); +- rpi_firmware_put(fw); + if (error || touchbuf != 0) { + dev_warn(dev, "Failed to set touchbuf, %d\n", error); + return error; +-- +2.39.2 + diff --git a/queue-5.15/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch b/queue-5.15/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch new file mode 100644 index 00000000000..42e79eaf07d --- /dev/null +++ b/queue-5.15/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch @@ -0,0 +1,51 @@ +From d25f8dbd4fd1551c219015f74a82a6153fc10704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Feb 2023 21:39:46 -0800 +Subject: ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on + it + +From: Randy Dunlap + +[ Upstream commit 2a587b9ad052e7e92e508aea90c1e2ae433c1908 ] + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP_MMIO" to +"select REGMAP_MMIO", which will also set REGMAP. + +Fixes: eb994594bc22 ("ipmi: bt-bmc: Use a regmap for register access") +Signed-off-by: Randy Dunlap +Cc: Andrew Jeffery +Cc: Corey Minyard +Cc: openipmi-developer@lists.sourceforge.net +Cc: Arnd Bergmann +Cc: Greg Kroah-Hartman +Message-Id: <20230226053953.4681-2-rdunlap@infradead.org> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig +index 249b31197eeae..8298a4dd0de68 100644 +--- a/drivers/char/ipmi/Kconfig ++++ b/drivers/char/ipmi/Kconfig +@@ -153,7 +153,8 @@ config IPMI_KCS_BMC_SERIO + + config ASPEED_BT_IPMI_BMC + depends on ARCH_ASPEED || COMPILE_TEST +- depends on REGMAP && REGMAP_MMIO && MFD_SYSCON ++ depends on MFD_SYSCON ++ select REGMAP_MMIO + tristate "BT IPMI bmc driver" + help + Provides a driver for the BT (Block Transfer) IPMI interface +-- +2.39.2 + diff --git a/queue-5.15/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch b/queue-5.15/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch new file mode 100644 index 00000000000..cd66b7e3b2f --- /dev/null +++ b/queue-5.15/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch @@ -0,0 +1,56 @@ +From 1326a09acf71654634c9eea6390d41659190926d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 20:40:35 +0800 +Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb() + +From: Ziyang Xuan + +[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ] + +Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in +__ip6_make_skb()"). icmphdr does not in skb linear region under the +scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will +trigger the uninit variable access bug. + +Use a local variable icmp_type to carry the correct value in different +scenarios. + +Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") +Reviewed-by: Willem de Bruijn +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index ef786c6232df7..ae8a456df5ab2 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1555,9 +1555,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk, + cork->dst = NULL; + skb_dst_set(skb, &rt->dst); + +- if (iph->protocol == IPPROTO_ICMP) +- icmp_out_count(net, ((struct icmphdr *) +- skb_transport_header(skb))->type); ++ if (iph->protocol == IPPROTO_ICMP) { ++ u8 icmp_type; ++ ++ /* For such sockets, transhdrlen is zero when do ip_append_data(), ++ * so icmphdr does not in skb linear region and can not get icmp_type ++ * by icmp_hdr(skb)->type. ++ */ ++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) ++ icmp_type = fl4->fl4_icmp_type; ++ else ++ icmp_type = icmp_hdr(skb)->type; ++ icmp_out_count(net, icmp_type); ++ } + + ip_cork_release(cork); + out: +-- +2.39.2 + diff --git a/queue-5.15/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch b/queue-5.15/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch new file mode 100644 index 00000000000..5edabb55462 --- /dev/null +++ b/queue-5.15/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch @@ -0,0 +1,68 @@ +From f4887c30f34472d64f69676dc6f965ecf6a21f95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:22 +0000 +Subject: ixgbe: Allow flow hash to be set via ethtool + +From: Joe Damato + +[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ] + +ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool +because the ethtool code in the kernel passes a non-zero value for hfunc +that ixgbe should allow. + +When ethtool is called with `ETHTOOL_SRXFHINDIR`, +`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function +with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted. + +When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will +call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be +hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should +also be accepted. + +Before this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 + 24: 4 5 6 7 8 9 0 1 + ... + +Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index beda8e0ef7d42..37d57cb48071c 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -3099,8 +3099,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir, + int i; + u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter); + +- if (hfunc) +- return -EINVAL; ++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) ++ return -EOPNOTSUPP; + + /* Fill out the redirection table */ + if (indir) { +-- +2.39.2 + diff --git a/queue-5.15/ixgbe-enable-setting-rss-table-to-default-values.patch b/queue-5.15/ixgbe-enable-setting-rss-table-to-default-values.patch new file mode 100644 index 00000000000..dd4f40fe9fc --- /dev/null +++ b/queue-5.15/ixgbe-enable-setting-rss-table-to-default-values.patch @@ -0,0 +1,147 @@ +From 96807445263f4a0bccf14e1a20cce3a1f2b43487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:23 +0000 +Subject: ixgbe: Enable setting RSS table to default values + +From: Joe Damato + +[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ] + +ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported +by RSS. The driver should return the smaller of either: + - The maximum number of RSS queues the device supports, OR + - The number of RX queues configured + +Prior to this change, running `ethtool -X $iface default` fails if the +number of queues configured is larger than the number supported by RSS, +even though changing the queue count correctly resets the flowhash to +use all supported queues. + +Other drivers (for example, i40e) will succeed but the flow hash will +reset to support the maximum number of queues supported by RSS, even if +that amount is smaller than the configured amount. + +Prior to this change: + +$ sudo ethtool -L eth1 combined 20 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 20 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 + 24: 8 9 10 11 12 13 14 15 + 32: 0 1 2 3 4 5 6 7 +... + +You can see that the flowhash was correctly set to use the maximum +number of queues supported by the driver (16). + +However, asking the NIC to reset to "default" fails: + +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this change, the flowhash can be reset to default which will use +all of the available RSS queues (16) or the configured queue count, +whichever is smaller. + +Starting with eth1 which has 10 queues and a flowhash distributing to +all 10 queues: + +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 +... + +Increasing the queue count to 48 resets the flowhash to distribute to 16 +queues, as it did before this patch: + +$ sudo ethtool -L eth1 combined 48 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Due to the other bugfix in this series, the flowhash can be set to use +queues 0-5: + +$ sudo ethtool -X eth1 equal 5 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 0 1 2 + 8: 3 4 0 1 2 3 4 0 + 16: 1 2 3 4 0 1 2 3 +... + +Due to this bugfix, the flowhash can be reset to default and use 16 +queues: + +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index 37d57cb48071c..c829cb65171c7 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -2633,6 +2633,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter, + return 0; + } + ++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) ++{ ++ if (adapter->hw.mac.type < ixgbe_mac_X550) ++ return 16; ++ else ++ return 64; ++} ++ + static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + u32 *rule_locs) + { +@@ -2641,7 +2649,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + + switch (cmd->cmd) { + case ETHTOOL_GRXRINGS: +- cmd->data = adapter->num_rx_queues; ++ cmd->data = min_t(int, adapter->num_rx_queues, ++ ixgbe_rss_indir_tbl_max(adapter)); + ret = 0; + break; + case ETHTOOL_GRXCLSRLCNT: +@@ -3043,14 +3052,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) + return ret; + } + +-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) +-{ +- if (adapter->hw.mac.type < ixgbe_mac_X550) +- return 16; +- else +- return 64; +-} +- + static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev) + { + return IXGBE_RSS_KEY_SIZE; +-- +2.39.2 + diff --git a/queue-5.15/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch b/queue-5.15/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch new file mode 100644 index 00000000000..7fb0037a3f1 --- /dev/null +++ b/queue-5.15/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch @@ -0,0 +1,44 @@ +From 2d42c8a434f8b74a0015b2d42bfda823d4e32a62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 17:49:32 +0200 +Subject: jdb2: Don't refuse invalidation of already invalidated buffers + +From: Jan Kara + +[ Upstream commit bd159398a2d2234de07d310132865706964aaaa7 ] + +When invalidating buffers under the partial tail page, +jbd2_journal_invalidate_folio() returns -EBUSY if the buffer is part of +the committing transaction as we cannot safely modify buffer state. +However if the buffer is already invalidated (due to previous +invalidation attempts from ext4_wait_for_tail_page_commit()), there's +nothing to do and there's no point in returning -EBUSY. This fixes +occasional warnings from ext4_journalled_invalidate_folio() triggered by +generic/051 fstest when blocksize < pagesize. + +Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20230329154950.19720-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 55232064cab21..ce4a5ccadeff4 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2378,6 +2378,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh, + spin_unlock(&jh->b_state_lock); + write_unlock(&journal->j_state_lock); + jbd2_journal_put_journal_head(jh); ++ /* Already zapped buffer? Nothing to do... */ ++ if (!bh->b_bdev) ++ return 0; + return -EBUSY; + } + /* +-- +2.39.2 + diff --git a/queue-5.15/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch b/queue-5.15/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch new file mode 100644 index 00000000000..be56fed128b --- /dev/null +++ b/queue-5.15/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch @@ -0,0 +1,62 @@ +From 402b7a423eb731da1f03f88141cba7f9d7b60b43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Apr 2023 13:12:59 +0200 +Subject: leds: tca6507: Fix error handling of using + fwnode_property_read_string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: H. Nikolaus Schaller + +[ Upstream commit c1087c29e96a48e9080377e168d35dcb52fb068b ] + +Commit 96f524105b9c ("leds: tca6507: use fwnode API instead of OF") + +changed to fwnode API but did not take into account that a missing property +"linux,default-trigger" now seems to return an error and as a side effect +sets value to -1. This seems to be different from of_get_property() which +always returned NULL in any case of error. + +Neglecting this side-effect leads to + +[ 11.201965] Unable to handle kernel paging request at virtual address ffffffff when read + +in the strcmp() of led_trigger_set_default() if there is no led-trigger +defined in the DTS. + +I don't know if this was recently introduced somewhere in the fwnode lib +or if the effect was missed in initial testing. Anyways it seems to be a +bug to ignore the error return value of an optional value here in the +driver. + +Fixes: 96f524105b9c ("leds: tca6507: use fwnode API instead of OF") +Signed-off-by: H. Nikolaus Schaller +Acked-by: Pavel Machek +Reviewed-by: Marek Behún +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/cbae7617db83113de726fcc423a805ebaa1bfca6.1680433978.git.hns@goldelico.com +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-tca6507.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c +index 225b765830bdc..caad9d3e0eac8 100644 +--- a/drivers/leds/leds-tca6507.c ++++ b/drivers/leds/leds-tca6507.c +@@ -696,8 +696,9 @@ tca6507_led_dt_init(struct device *dev) + if (fwnode_property_read_string(child, "label", &led.name)) + led.name = fwnode_get_name(child); + +- fwnode_property_read_string(child, "linux,default-trigger", +- &led.default_trigger); ++ if (fwnode_property_read_string(child, "linux,default-trigger", ++ &led.default_trigger)) ++ led.default_trigger = NULL; + + led.flags = 0; + if (fwnode_property_match_string(child, "compatible", +-- +2.39.2 + diff --git a/queue-5.15/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch b/queue-5.15/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch new file mode 100644 index 00000000000..30226ed47b0 --- /dev/null +++ b/queue-5.15/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch @@ -0,0 +1,44 @@ +From 2eaa23f504bbdf2700b0a571f8983d3714a68ef7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Feb 2023 21:39:49 -0800 +Subject: leds: TI_LMU_COMMON: select REGMAP instead of depending on it + +From: Randy Dunlap + +[ Upstream commit a61079efc87888587e463afaed82417b162fbd69 ] + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP" to "select REGMAP". + +Fixes: 3fce8e1eb994 ("leds: TI LMU: Add common code for TI LMU devices") +Signed-off-by: Randy Dunlap +Acked-by: Pavel Machek +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230226053953.4681-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/leds/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig +index ed800f5da7d88..8bf545100fb04 100644 +--- a/drivers/leds/Kconfig ++++ b/drivers/leds/Kconfig +@@ -821,7 +821,7 @@ config LEDS_SPI_BYTE + config LEDS_TI_LMU_COMMON + tristate "LED driver for TI LMU" + depends on LEDS_CLASS +- depends on REGMAP ++ select REGMAP + help + Say Y to enable the LED driver for TI LMU devices. + This supports common features between the TI LM3532, LM3631, LM3632, +-- +2.39.2 + diff --git a/queue-5.15/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch b/queue-5.15/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch new file mode 100644 index 00000000000..6abbe763744 --- /dev/null +++ b/queue-5.15/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch @@ -0,0 +1,58 @@ +From 5143718d364938dc0cdf784d6de97c36e5487646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 19:15:29 -0700 +Subject: linux/vt_buffer.h: allow either builtin or modular for macros + +From: Randy Dunlap + +[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ] + +Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m. +This allows the ARCH macros to be the only ones defined. + +In file included from ../drivers/video/console/mdacon.c:37: +../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~ +../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew' + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^~~~ +../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^ +../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~~~ +../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile' + 25 | static inline u16 scr_readw(volatile const u16 *addr) + | ^~~~~~~~ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: dri-devel@lists.freedesktop.org +Cc: linux-fbdev@vger.kernel.org +Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/vt_buffer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h +index 848db1b1569ff..919d999a8c1db 100644 +--- a/include/linux/vt_buffer.h ++++ b/include/linux/vt_buffer.h +@@ -16,7 +16,7 @@ + + #include + +-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE) ++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE) + #include + #endif + +-- +2.39.2 + diff --git a/queue-5.15/macintosh-via-pmu-led-requires-ata-to-be-set.patch b/queue-5.15/macintosh-via-pmu-led-requires-ata-to-be-set.patch new file mode 100644 index 00000000000..4bfab03c034 --- /dev/null +++ b/queue-5.15/macintosh-via-pmu-led-requires-ata-to-be-set.patch @@ -0,0 +1,45 @@ +From fd5c8925f2f4b6375b99b4b7d118c97a7609191f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 17:42:41 -0800 +Subject: macintosh: via-pmu-led: requires ATA to be set + +From: Randy Dunlap + +[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ] + +LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK +when ATA is not set/enabled causes a Kconfig warning: + +WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK + Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n] + Selected by [y]: + - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y] + +Fix this by making ADB_PMU_LED_DISK depend on ATA. + +Seen on both PPC32 and PPC64. + +Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/macintosh/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig +index 539a2ed4e13dc..a0e717a986dcb 100644 +--- a/drivers/macintosh/Kconfig ++++ b/drivers/macintosh/Kconfig +@@ -86,6 +86,7 @@ config ADB_PMU_LED + + config ADB_PMU_LED_DISK + bool "Use front LED as DISK LED by default" ++ depends on ATA + depends on ADB_PMU_LED + depends on LEDS_CLASS + select LEDS_TRIGGERS +-- +2.39.2 + diff --git a/queue-5.15/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch b/queue-5.15/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch new file mode 100644 index 00000000000..0d8f59bc374 --- /dev/null +++ b/queue-5.15/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch @@ -0,0 +1,36 @@ +From 4fdd0bcd18a355ac44fc6452495bb5768b983fd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 11:35:58 +0800 +Subject: macintosh/windfarm_smu_sat: Add missing of_node_put() + +From: Liang He + +[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ] + +We call of_node_get() in wf_sat_probe() after sat is created, +so we need the of_node_put() before *kfree(sat)*. + +Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s") +Signed-off-by: Liang He +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/macintosh/windfarm_smu_sat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c +index e46e1153a0b43..7d7d6213e32aa 100644 +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -171,6 +171,7 @@ static void wf_sat_release(struct kref *ref) + + if (sat->nr >= 0) + sats[sat->nr] = NULL; ++ of_node_put(sat->node); + kfree(sat); + } + +-- +2.39.2 + diff --git a/queue-5.15/mailbox-mpfs-switch-to-txdone_poll.patch b/queue-5.15/mailbox-mpfs-switch-to-txdone_poll.patch new file mode 100644 index 00000000000..5a934c56877 --- /dev/null +++ b/queue-5.15/mailbox-mpfs-switch-to-txdone_poll.patch @@ -0,0 +1,73 @@ +From c74d098f4f9af9f738b79496cf22704dcb0726da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 20:22:52 +0000 +Subject: mailbox: mpfs: switch to txdone_poll + +From: Conor Dooley + +[ Upstream commit b5984a9844fc45cd301a28fb56f3de95f7e20f3c ] + +The system controller on PolarFire SoC has no interrupt to signify that +the TX has been completed. The interrupt instead signals that a service +requested by the mailbox client has succeeded. If a service fails, there +will be no interrupt delivered. + +Switch to polling the busy register to determine whether transmission +has completed. + +Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox") +Acked-by: Jassi Brar +Tested-by: Valentina Fernandez +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox-mpfs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/mailbox-mpfs.c b/drivers/mailbox/mailbox-mpfs.c +index 853901acaeec2..08aa840cccaca 100644 +--- a/drivers/mailbox/mailbox-mpfs.c ++++ b/drivers/mailbox/mailbox-mpfs.c +@@ -79,6 +79,13 @@ static bool mpfs_mbox_busy(struct mpfs_mbox *mbox) + return status & SCB_STATUS_BUSY_MASK; + } + ++static bool mpfs_mbox_last_tx_done(struct mbox_chan *chan) ++{ ++ struct mpfs_mbox *mbox = (struct mpfs_mbox *)chan->con_priv; ++ ++ return !mpfs_mbox_busy(mbox); ++} ++ + static int mpfs_mbox_send_data(struct mbox_chan *chan, void *data) + { + struct mpfs_mbox *mbox = (struct mpfs_mbox *)chan->con_priv; +@@ -182,7 +189,6 @@ static irqreturn_t mpfs_mbox_inbox_isr(int irq, void *data) + + mpfs_mbox_rx_data(chan); + +- mbox_chan_txdone(chan, 0); + return IRQ_HANDLED; + } + +@@ -212,6 +218,7 @@ static const struct mbox_chan_ops mpfs_mbox_ops = { + .send_data = mpfs_mbox_send_data, + .startup = mpfs_mbox_startup, + .shutdown = mpfs_mbox_shutdown, ++ .last_tx_done = mpfs_mbox_last_tx_done, + }; + + static int mpfs_mbox_probe(struct platform_device *pdev) +@@ -247,7 +254,8 @@ static int mpfs_mbox_probe(struct platform_device *pdev) + mbox->controller.num_chans = 1; + mbox->controller.chans = mbox->chans; + mbox->controller.ops = &mpfs_mbox_ops; +- mbox->controller.txdone_irq = true; ++ mbox->controller.txdone_poll = true; ++ mbox->controller.txpoll_period = 10u; + + ret = devm_mbox_controller_register(&pdev->dev, &mbox->controller); + if (ret) { +-- +2.39.2 + diff --git a/queue-5.15/md-drop-queue-limitation-for-raid1-and-raid10.patch b/queue-5.15/md-drop-queue-limitation-for-raid1-and-raid10.patch new file mode 100644 index 00000000000..9bef20ebcad --- /dev/null +++ b/queue-5.15/md-drop-queue-limitation-for-raid1-and-raid10.patch @@ -0,0 +1,96 @@ +From 0045dc91eaf802e52ec88b36cb0418325d92b126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 10:29:55 +0100 +Subject: md: drop queue limitation for RAID1 and RAID10 + +From: Mariusz Tkaczyk + +[ Upstream commit a92ce0feffeed8b91f02dac85246d1205e4a64b6 ] + +As suggested by Neil Brown[1], this limitation seems to be +deprecated. + +With plugging in use, writes are processed behind the raid thread +and conf->pending_count is not increased. This limitation occurs only +if caller doesn't use plugs. + +It can be avoided and often it is (with plugging). There are no reports +that queue is growing to enormous size so remove queue limitation for +non-plugged IOs too. + +[1] https://lore.kernel.org/linux-raid/162496301481.7211.18031090130574610495@noble.neil.brown.name + +Signed-off-by: Mariusz Tkaczyk +Signed-off-by: Song Liu +Stable-dep-of: 72c215ed8731 ("md/raid10: fix task hung in raid10d") +Signed-off-by: Sasha Levin +--- + drivers/md/raid1-10.c | 6 ------ + drivers/md/raid1.c | 7 ------- + drivers/md/raid10.c | 7 ------- + 3 files changed, 20 deletions(-) + +diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c +index 54db341639687..83f9a4f3d82e0 100644 +--- a/drivers/md/raid1-10.c ++++ b/drivers/md/raid1-10.c +@@ -22,12 +22,6 @@ + + #define BIO_SPECIAL(bio) ((unsigned long)bio <= 2) + +-/* When there are this many requests queue to be written by +- * the raid thread, we become 'congested' to provide back-pressure +- * for writeback. +- */ +-static int max_queued_requests = 1024; +- + /* for managing resync I/O pages */ + struct resync_pages { + void *raid_bio; +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 783763f6845f4..47997a9a3ca18 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1358,12 +1358,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + r1_bio = alloc_r1bio(mddev, bio); + r1_bio->sectors = max_write_sectors; + +- if (conf->pending_count >= max_queued_requests) { +- md_wakeup_thread(mddev->thread); +- raid1_log(mddev, "wait queued"); +- wait_event(conf->wait_barrier, +- conf->pending_count < max_queued_requests); +- } + /* first select target devices under rcu_lock and + * inc refcount on their rdev. Record them by setting + * bios[x] to bio +@@ -3413,4 +3407,3 @@ MODULE_ALIAS("md-personality-3"); /* RAID1 */ + MODULE_ALIAS("md-raid1"); + MODULE_ALIAS("md-level-1"); + +-module_param(max_queued_requests, int, S_IRUGO|S_IWUSR); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index c4c1a3a7d7abc..69708b455295b 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1387,12 +1387,6 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + conf->reshape_safe = mddev->reshape_position; + } + +- if (conf->pending_count >= max_queued_requests) { +- md_wakeup_thread(mddev->thread); +- raid10_log(mddev, "wait queued"); +- wait_event(conf->wait_barrier, +- conf->pending_count < max_queued_requests); +- } + /* first select target devices under rcu_lock and + * inc refcount on their rdev. Record them by setting + * bios[x] to bio +@@ -5246,4 +5240,3 @@ MODULE_ALIAS("md-personality-9"); /* RAID10 */ + MODULE_ALIAS("md-raid10"); + MODULE_ALIAS("md-level-10"); + +-module_param(max_queued_requests, int, S_IRUGO|S_IWUSR); +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-add-nowait-support.patch b/queue-5.15/md-raid10-add-nowait-support.patch new file mode 100644 index 00000000000..ea18f1a9112 --- /dev/null +++ b/queue-5.15/md-raid10-add-nowait-support.patch @@ -0,0 +1,271 @@ +From 8beae2537d3ef8318fe72c6cebd93a40cb73ecd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Dec 2021 20:06:21 +0000 +Subject: md: raid10 add nowait support + +From: Vishal Verma + +[ Upstream commit c9aa889b035fca4598ae985a0f0c76ebbb547ad2 ] + +This adds nowait support to the RAID10 driver. Very similar to +raid1 driver changes. It makes RAID10 driver return with EAGAIN +for situations where it could wait for eg: + + - Waiting for the barrier, + - Reshape operation, + - Discard operation. + +wait_barrier() and regular_request_wait() fn are modified to return bool +to support error for wait barriers. They returns true in case of wait +or if wait is not required and returns false if wait was required +but not performed to support nowait. + +Reviewed-by: Jens Axboe +Signed-off-by: Vishal Verma +Signed-off-by: Song Liu +Stable-dep-of: 72c215ed8731 ("md/raid10: fix task hung in raid10d") +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 100 +++++++++++++++++++++++++++++--------------- + 1 file changed, 67 insertions(+), 33 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 69708b455295b..287bebde2e546 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -952,8 +952,10 @@ static void lower_barrier(struct r10conf *conf) + wake_up(&conf->wait_barrier); + } + +-static void wait_barrier(struct r10conf *conf) ++static bool wait_barrier(struct r10conf *conf, bool nowait) + { ++ bool ret = true; ++ + spin_lock_irq(&conf->resync_lock); + if (conf->barrier) { + struct bio_list *bio_list = current->bio_list; +@@ -967,27 +969,35 @@ static void wait_barrier(struct r10conf *conf) + * that queue to get the nr_pending + * count down. + */ +- raid10_log(conf->mddev, "wait barrier"); +- wait_event_lock_irq(conf->wait_barrier, +- !conf->barrier || +- (atomic_read(&conf->nr_pending) && +- bio_list && +- (!bio_list_empty(&bio_list[0]) || +- !bio_list_empty(&bio_list[1]))) || +- /* move on if recovery thread is +- * blocked by us +- */ +- (conf->mddev->thread->tsk == current && +- test_bit(MD_RECOVERY_RUNNING, +- &conf->mddev->recovery) && +- conf->nr_queued > 0), +- conf->resync_lock); ++ /* Return false when nowait flag is set */ ++ if (nowait) { ++ ret = false; ++ } else { ++ raid10_log(conf->mddev, "wait barrier"); ++ wait_event_lock_irq(conf->wait_barrier, ++ !conf->barrier || ++ (atomic_read(&conf->nr_pending) && ++ bio_list && ++ (!bio_list_empty(&bio_list[0]) || ++ !bio_list_empty(&bio_list[1]))) || ++ /* move on if recovery thread is ++ * blocked by us ++ */ ++ (conf->mddev->thread->tsk == current && ++ test_bit(MD_RECOVERY_RUNNING, ++ &conf->mddev->recovery) && ++ conf->nr_queued > 0), ++ conf->resync_lock); ++ } + conf->nr_waiting--; + if (!conf->nr_waiting) + wake_up(&conf->wait_barrier); + } +- atomic_inc(&conf->nr_pending); ++ /* Only increment nr_pending when we wait */ ++ if (ret) ++ atomic_inc(&conf->nr_pending); + spin_unlock_irq(&conf->resync_lock); ++ return ret; + } + + static void allow_barrier(struct r10conf *conf) +@@ -1098,21 +1108,30 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule) + * currently. + * 2. If IO spans the reshape position. Need to wait for reshape to pass. + */ +-static void regular_request_wait(struct mddev *mddev, struct r10conf *conf, ++static bool regular_request_wait(struct mddev *mddev, struct r10conf *conf, + struct bio *bio, sector_t sectors) + { +- wait_barrier(conf); ++ /* Bail out if REQ_NOWAIT is set for the bio */ ++ if (!wait_barrier(conf, bio->bi_opf & REQ_NOWAIT)) { ++ bio_wouldblock_error(bio); ++ return false; ++ } + while (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && + bio->bi_iter.bi_sector < conf->reshape_progress && + bio->bi_iter.bi_sector + sectors > conf->reshape_progress) { +- raid10_log(conf->mddev, "wait reshape"); + allow_barrier(conf); ++ if (bio->bi_opf & REQ_NOWAIT) { ++ bio_wouldblock_error(bio); ++ return false; ++ } ++ raid10_log(conf->mddev, "wait reshape"); + wait_event(conf->wait_barrier, + conf->reshape_progress <= bio->bi_iter.bi_sector || + conf->reshape_progress >= bio->bi_iter.bi_sector + + sectors); +- wait_barrier(conf); ++ wait_barrier(conf, false); + } ++ return true; + } + + static void raid10_read_request(struct mddev *mddev, struct bio *bio, +@@ -1157,7 +1176,8 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, + rcu_read_unlock(); + } + +- regular_request_wait(mddev, conf, bio, r10_bio->sectors); ++ if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) ++ return; + rdev = read_balance(conf, r10_bio, &max_sectors); + if (!rdev) { + if (err_rdev) { +@@ -1179,7 +1199,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, + bio_chain(split, bio); + allow_barrier(conf); + submit_bio_noacct(bio); +- wait_barrier(conf); ++ wait_barrier(conf, false); + bio = split; + r10_bio->master_bio = bio; + r10_bio->sectors = max_sectors; +@@ -1338,7 +1358,7 @@ static void wait_blocked_dev(struct mddev *mddev, struct r10bio *r10_bio) + raid10_log(conf->mddev, "%s wait rdev %d blocked", + __func__, blocked_rdev->raid_disk); + md_wait_for_blocked_rdev(blocked_rdev, mddev); +- wait_barrier(conf); ++ wait_barrier(conf, false); + goto retry_wait; + } + } +@@ -1356,6 +1376,11 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + bio->bi_iter.bi_sector, + bio_end_sector(bio)))) { + DEFINE_WAIT(w); ++ /* Bail out if REQ_NOWAIT is set for the bio */ ++ if (bio->bi_opf & REQ_NOWAIT) { ++ bio_wouldblock_error(bio); ++ return; ++ } + for (;;) { + prepare_to_wait(&conf->wait_barrier, + &w, TASK_IDLE); +@@ -1368,7 +1393,8 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + } + + sectors = r10_bio->sectors; +- regular_request_wait(mddev, conf, bio, sectors); ++ if (!regular_request_wait(mddev, conf, bio, sectors)) ++ return; + if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && + (mddev->reshape_backwards + ? (bio->bi_iter.bi_sector < conf->reshape_safe && +@@ -1380,6 +1406,11 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + set_mask_bits(&mddev->sb_flags, 0, + BIT(MD_SB_CHANGE_DEVS) | BIT(MD_SB_CHANGE_PENDING)); + md_wakeup_thread(mddev->thread); ++ if (bio->bi_opf & REQ_NOWAIT) { ++ allow_barrier(conf); ++ bio_wouldblock_error(bio); ++ return; ++ } + raid10_log(conf->mddev, "wait reshape metadata"); + wait_event(mddev->sb_wait, + !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)); +@@ -1476,7 +1507,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + bio_chain(split, bio); + allow_barrier(conf); + submit_bio_noacct(bio); +- wait_barrier(conf); ++ wait_barrier(conf, false); + bio = split; + r10_bio->master_bio = bio; + } +@@ -1601,7 +1632,11 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) + if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery)) + return -EAGAIN; + +- wait_barrier(conf); ++ if (WARN_ON_ONCE(bio->bi_opf & REQ_NOWAIT)) { ++ bio_wouldblock_error(bio); ++ return 0; ++ } ++ wait_barrier(conf, false); + + /* + * Check reshape again to avoid reshape happens after checking +@@ -1643,7 +1678,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) + allow_barrier(conf); + /* Resend the fist split part */ + submit_bio_noacct(split); +- wait_barrier(conf); ++ wait_barrier(conf, false); + } + div_u64_rem(bio_end, stripe_size, &remainder); + if (remainder) { +@@ -1654,7 +1689,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) + /* Resend the second split part */ + submit_bio_noacct(bio); + bio = split; +- wait_barrier(conf); ++ wait_barrier(conf, false); + } + + bio_start = bio->bi_iter.bi_sector; +@@ -1810,7 +1845,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) + end_disk_offset += geo->stride; + atomic_inc(&first_r10bio->remaining); + raid_end_discard_bio(r10_bio); +- wait_barrier(conf); ++ wait_barrier(conf, false); + goto retry_discard; + } + +@@ -2005,7 +2040,7 @@ static void print_conf(struct r10conf *conf) + + static void close_sync(struct r10conf *conf) + { +- wait_barrier(conf); ++ wait_barrier(conf, false); + allow_barrier(conf); + + mempool_exit(&conf->r10buf_pool); +@@ -4816,7 +4851,7 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, + if (need_flush || + time_after(jiffies, conf->reshape_checkpoint + 10*HZ)) { + /* Need to update reshape_position in metadata */ +- wait_barrier(conf); ++ wait_barrier(conf, false); + mddev->reshape_position = conf->reshape_progress; + if (mddev->reshape_backwards) + mddev->curr_resync_completed = raid10_size(mddev, 0, 0) +@@ -5239,4 +5274,3 @@ MODULE_DESCRIPTION("RAID10 (striped mirror) personality for MD"); + MODULE_ALIAS("md-personality-9"); /* RAID10 */ + MODULE_ALIAS("md-raid10"); + MODULE_ALIAS("md-level-10"); +- +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch b/queue-5.15/md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch new file mode 100644 index 00000000000..2146c8334b4 --- /dev/null +++ b/queue-5.15/md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch @@ -0,0 +1,51 @@ +From 34d50b8269c03c3759cd5030b2ff78bbeaa3d9a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 09:22:58 +0800 +Subject: md/raid10: don't call bio_start_io_acct twice for bio which + experienced read error + +From: Yu Kuai + +[ Upstream commit 7cddb055bfda5f7b0be931e8ea750fc28bc18a27 ] + +handle_read_error() will resumit r10_bio by raid10_read_request(), which +will call bio_start_io_acct() again, while bio_end_io_acct() will only +be called once. + +Fix the problem by don't account io again from handle_read_error(). + +Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") +Suggested-by: Song Liu +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230314012258.2395894-1-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 9fc9198fc5c4f..5df5e7df6069c 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1216,7 +1216,8 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, + } + slot = r10_bio->read_slot; + +- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) ++ if (!r10_bio->start_time && ++ blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) + r10_bio->start_time = bio_start_io_acct(bio); + read_bio = bio_clone_fast(bio, gfp, &mddev->bio_set); + +@@ -1550,6 +1551,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors) + r10_bio->sector = bio->bi_iter.bi_sector; + r10_bio->state = 0; + r10_bio->read_slot = -1; ++ r10_bio->start_time = 0; + memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * + conf->geo.raid_disks); + +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-factor-out-code-from-wait_barrier-to-stop_.patch b/queue-5.15/md-raid10-factor-out-code-from-wait_barrier-to-stop_.patch new file mode 100644 index 00000000000..2a7d6da8ddd --- /dev/null +++ b/queue-5.15/md-raid10-factor-out-code-from-wait_barrier-to-stop_.patch @@ -0,0 +1,103 @@ +From dad5a7dc4963d82c70930d9b292cf2d105eef29f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 19:34:24 +0800 +Subject: md/raid10: factor out code from wait_barrier() to + stop_waiting_barrier() + +From: Yu Kuai + +[ Upstream commit ed2e063f92c44c891ccd883e289dde6ca870edcc ] + +Currently the nasty condition in wait_barrier() is hard to read. This +patch factors out the condition into a function. + +There are no functional changes. + +Signed-off-by: Yu Kuai +Acked-by: Paul Menzel +Reviewed-by: Logan Gunthorpe +Acked-by: Guoqing Jiang +Signed-off-by: Song Liu +Stable-dep-of: 72c215ed8731 ("md/raid10: fix task hung in raid10d") +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 50 +++++++++++++++++++++++++-------------------- + 1 file changed, 28 insertions(+), 22 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 287bebde2e546..31ecb080851ac 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -952,41 +952,47 @@ static void lower_barrier(struct r10conf *conf) + wake_up(&conf->wait_barrier); + } + ++static bool stop_waiting_barrier(struct r10conf *conf) ++{ ++ struct bio_list *bio_list = current->bio_list; ++ ++ /* barrier is dropped */ ++ if (!conf->barrier) ++ return true; ++ ++ /* ++ * If there are already pending requests (preventing the barrier from ++ * rising completely), and the pre-process bio queue isn't empty, then ++ * don't wait, as we need to empty that queue to get the nr_pending ++ * count down. ++ */ ++ if (atomic_read(&conf->nr_pending) && bio_list && ++ (!bio_list_empty(&bio_list[0]) || !bio_list_empty(&bio_list[1]))) ++ return true; ++ ++ /* move on if recovery thread is blocked by us */ ++ if (conf->mddev->thread->tsk == current && ++ test_bit(MD_RECOVERY_RUNNING, &conf->mddev->recovery) && ++ conf->nr_queued > 0) ++ return true; ++ ++ return false; ++} ++ + static bool wait_barrier(struct r10conf *conf, bool nowait) + { + bool ret = true; + + spin_lock_irq(&conf->resync_lock); + if (conf->barrier) { +- struct bio_list *bio_list = current->bio_list; + conf->nr_waiting++; +- /* Wait for the barrier to drop. +- * However if there are already pending +- * requests (preventing the barrier from +- * rising completely), and the +- * pre-process bio queue isn't empty, +- * then don't wait, as we need to empty +- * that queue to get the nr_pending +- * count down. +- */ + /* Return false when nowait flag is set */ + if (nowait) { + ret = false; + } else { + raid10_log(conf->mddev, "wait barrier"); + wait_event_lock_irq(conf->wait_barrier, +- !conf->barrier || +- (atomic_read(&conf->nr_pending) && +- bio_list && +- (!bio_list_empty(&bio_list[0]) || +- !bio_list_empty(&bio_list[1]))) || +- /* move on if recovery thread is +- * blocked by us +- */ +- (conf->mddev->thread->tsk == current && +- test_bit(MD_RECOVERY_RUNNING, +- &conf->mddev->recovery) && +- conf->nr_queued > 0), ++ stop_waiting_barrier(conf), + conf->resync_lock); + } + conf->nr_waiting--; +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch b/queue-5.15/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch new file mode 100644 index 00000000000..4e8bdd3242e --- /dev/null +++ b/queue-5.15/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch @@ -0,0 +1,73 @@ +From f551d16f7a783c65b2bb591b56f9c860520103fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:53 +0800 +Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery + +From: Yu Kuai + +[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ] + +raid10_sync_request() will add 'r10bio->remaining' for both rdev and +replacement rdev. However, if the read io fails, recovery_request_write() +returns without issuing the write io, in this case, end_sync_request() +is only called once and 'remaining' is leaked, cause an io hang. + +Fix the problem by decreasing 'remaining' according to if 'bio' and +'repl_bio' is valid. + +Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 4bf09ecedec14..2b4a4dc213d8c 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2581,11 +2581,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + { + struct r10conf *conf = mddev->private; + int d; +- struct bio *wbio, *wbio2; ++ struct bio *wbio = r10_bio->devs[1].bio; ++ struct bio *wbio2 = r10_bio->devs[1].repl_bio; ++ ++ /* Need to test wbio2->bi_end_io before we call ++ * submit_bio_noacct as if the former is NULL, ++ * the latter is free to free wbio2. ++ */ ++ if (wbio2 && !wbio2->bi_end_io) ++ wbio2 = NULL; + + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) { + fix_recovery_read_error(r10_bio); +- end_sync_request(r10_bio); ++ if (wbio->bi_end_io) ++ end_sync_request(r10_bio); ++ if (wbio2) ++ end_sync_request(r10_bio); + return; + } + +@@ -2594,14 +2605,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + * and submit the write request + */ + d = r10_bio->devs[1].devnum; +- wbio = r10_bio->devs[1].bio; +- wbio2 = r10_bio->devs[1].repl_bio; +- /* Need to test wbio2->bi_end_io before we call +- * submit_bio_noacct as if the former is NULL, +- * the latter is free to free wbio2. +- */ +- if (wbio2 && !wbio2->bi_end_io) +- wbio2 = NULL; + if (wbio->bi_end_io) { + atomic_inc(&conf->mirrors[d].rdev->nr_pending); + md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio)); +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-memleak-for-conf-bio_split.patch b/queue-5.15/md-raid10-fix-memleak-for-conf-bio_split.patch new file mode 100644 index 00000000000..57b24217ae5 --- /dev/null +++ b/queue-5.15/md-raid10-fix-memleak-for-conf-bio_split.patch @@ -0,0 +1,96 @@ +From 5cfd5c4e5b2df6fe07f7a4bf538f67015de005ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:54 +0800 +Subject: md/raid10: fix memleak for 'conf->bio_split' + +From: Yu Kuai + +[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ] + +In the error path of raid10_run(), 'conf' need be freed, however, +'conf->bio_split' is missed and memory will be leaked. + +Since there are 3 places to free 'conf', factor out a helper to fix the +problem. + +Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 37 +++++++++++++++++-------------------- + 1 file changed, 17 insertions(+), 20 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 2b4a4dc213d8c..69650b1ac1484 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3991,6 +3991,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new) + return nc*fc; + } + ++static void raid10_free_conf(struct r10conf *conf) ++{ ++ if (!conf) ++ return; ++ ++ mempool_exit(&conf->r10bio_pool); ++ kfree(conf->mirrors); ++ kfree(conf->mirrors_old); ++ kfree(conf->mirrors_new); ++ safe_put_page(conf->tmppage); ++ bioset_exit(&conf->bio_split); ++ kfree(conf); ++} ++ + static struct r10conf *setup_conf(struct mddev *mddev) + { + struct r10conf *conf = NULL; +@@ -4073,13 +4087,7 @@ static struct r10conf *setup_conf(struct mddev *mddev) + return conf; + + out: +- if (conf) { +- mempool_exit(&conf->r10bio_pool); +- kfree(conf->mirrors); +- safe_put_page(conf->tmppage); +- bioset_exit(&conf->bio_split); +- kfree(conf); +- } ++ raid10_free_conf(conf); + return ERR_PTR(err); + } + +@@ -4285,10 +4293,7 @@ static int raid10_run(struct mddev *mddev) + + out_free_conf: + md_unregister_thread(&mddev->thread); +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf); ++ raid10_free_conf(conf); + mddev->private = NULL; + out: + return -EIO; +@@ -4296,15 +4301,7 @@ static int raid10_run(struct mddev *mddev) + + static void raid10_free(struct mddev *mddev, void *priv) + { +- struct r10conf *conf = priv; +- +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf->mirrors_old); +- kfree(conf->mirrors_new); +- bioset_exit(&conf->bio_split); +- kfree(conf); ++ raid10_free_conf(priv); + } + + static void raid10_quiesce(struct mddev *mddev, int quiesce) +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-memleak-of-md-thread.patch b/queue-5.15/md-raid10-fix-memleak-of-md-thread.patch new file mode 100644 index 00000000000..b970a65315e --- /dev/null +++ b/queue-5.15/md-raid10-fix-memleak-of-md-thread.patch @@ -0,0 +1,51 @@ +From 1ea863a1948e6b3a5546e480e6a7be96615980c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:55 +0800 +Subject: md/raid10: fix memleak of md thread + +From: Yu Kuai + +[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ] + +In raid10_run(), if setup_conf() succeed and raid10_run() failed before +setting 'mddev->thread', then in the error path 'conf->thread' is not +freed. + +Fix the problem by setting 'mddev->thread' right after setup_conf(). + +Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 69650b1ac1484..9fc9198fc5c4f 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4125,6 +4125,9 @@ static int raid10_run(struct mddev *mddev) + if (!conf) + goto out; + ++ mddev->thread = conf->thread; ++ conf->thread = NULL; ++ + if (mddev_is_clustered(conf->mddev)) { + int fc, fo; + +@@ -4137,9 +4140,6 @@ static int raid10_run(struct mddev *mddev) + } + } + +- mddev->thread = conf->thread; +- conf->thread = NULL; +- + if (mddev->queue) { + blk_queue_max_discard_sectors(mddev->queue, + UINT_MAX); +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-task-hung-in-raid10d.patch b/queue-5.15/md-raid10-fix-task-hung-in-raid10d.patch new file mode 100644 index 00000000000..211a7235278 --- /dev/null +++ b/queue-5.15/md-raid10-fix-task-hung-in-raid10d.patch @@ -0,0 +1,115 @@ +From 605dc4a9a4e81ffa16a6e42bfd20f862d8bddf0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 12:09:59 +0800 +Subject: md/raid10: fix task hung in raid10d + +From: Li Nan + +[ Upstream commit 72c215ed8731c88b2d7e09afc51fffc207ae47b8 ] + +commit fe630de009d0 ("md/raid10: avoid deadlock on recovery.") allowed +normal io and sync io to exist at the same time. Task hung will occur as +below: + +T1 T2 T3 T4 +raid10d + handle_read_error + allow_barrier + conf->nr_pending-- + -> 0 + //submit sync io + raid10_sync_request + raise_barrier + ->will not be blocked + ... + //submit to drivers + raid10_read_request + wait_barrier + conf->nr_pending++ + -> 1 + //retry read fail + raid10_end_read_request + reschedule_retry + add to retry_list + conf->nr_queued++ + -> 1 + //sync io fail + end_sync_read + __end_sync_read + reschedule_retry + add to retry_list + conf->nr_queued++ + -> 2 + ... + handle_read_error + get form retry_list + conf->nr_queued-- + freeze_array + wait nr_pending == nr_queued+1 + ->1 ->2 + //task hung + +retry read and sync io will be added to retry_list(nr_queued->2) if they +fails. raid10d() called handle_read_error() and hung in freeze_array(). +nr_queued will not decrease because raid10d is blocked, nr_pending will +not increase because conf->barrier is not released. + +Fix it by moving allow_barrier() after raid10_read_request(). +raise_barrier() will wait for nr_waiting to become 0. Therefore, sync io +and regular io will not be issued at the same time. + +Also remove the check of nr_queued in stop_waiting_barrier. It can be 0 +but don't need to be blocking. Remove the check for MD_RECOVERY_RUNNING as +the check is redundent. + +Fixes: fe630de009d0 ("md/raid10: avoid deadlock on recovery.") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230222041000.3341651-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 31ecb080851ac..4bf09ecedec14 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -970,11 +970,15 @@ static bool stop_waiting_barrier(struct r10conf *conf) + (!bio_list_empty(&bio_list[0]) || !bio_list_empty(&bio_list[1]))) + return true; + +- /* move on if recovery thread is blocked by us */ +- if (conf->mddev->thread->tsk == current && +- test_bit(MD_RECOVERY_RUNNING, &conf->mddev->recovery) && +- conf->nr_queued > 0) ++ /* ++ * move on if io is issued from raid10d(), nr_pending is not released ++ * from original io(see handle_read_error()). All raise barrier is ++ * blocked until this io is done. ++ */ ++ if (conf->mddev->thread->tsk == current) { ++ WARN_ON_ONCE(atomic_read(&conf->nr_pending) == 0); + return true; ++ } + + return false; + } +@@ -2954,9 +2958,13 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) + md_error(mddev, rdev); + + rdev_dec_pending(rdev, mddev); +- allow_barrier(conf); + r10_bio->state = 0; + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); ++ /* ++ * allow_barrier after re-submit to ensure no sync io ++ * can be issued while regular io pending. ++ */ ++ allow_barrier(conf); + } + + static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) +-- +2.39.2 + diff --git a/queue-5.15/media-av7110-prevent-underflow-in-write_ts_to_decode.patch b/queue-5.15/media-av7110-prevent-underflow-in-write_ts_to_decode.patch new file mode 100644 index 00000000000..44f634f2ecd --- /dev/null +++ b/queue-5.15/media-av7110-prevent-underflow-in-write_ts_to_decode.patch @@ -0,0 +1,47 @@ +From 2d9a022c6ef50a1cc20c6ed25d9477b9d1abd99d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:00:23 +0100 +Subject: media: av7110: prevent underflow in write_ts_to_decoder() + +From: Dan Carpenter + +[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ] + +The buf[4] value comes from the user via ts_play(). It is a value in +the u8 range. The final length we pass to av7110_ipack_instant_repack() +is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is +not negative. It's not clear that passing a negative len value does +anything bad necessarily, but it's not best practice. + +With the new bounds checking the "if (!len)" condition is no longer +possible or required so remove that. + +Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/av7110/av7110_av.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/av7110/av7110_av.c b/drivers/staging/media/av7110/av7110_av.c +index 91f4866c7e59b..964092e2f41fd 100644 +--- a/drivers/staging/media/av7110/av7110_av.c ++++ b/drivers/staging/media/av7110/av7110_av.c +@@ -823,10 +823,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s + av7110_ipack_flush(ipack); + + if (buf[3] & ADAPT_FIELD) { ++ if (buf[4] > len - 1 - 4) ++ return 0; + len -= buf[4] + 1; + buf += buf[4] + 1; +- if (!len) +- return 0; + } + + av7110_ipack_instant_repack(buf + 4, len - 4, ipack); +-- +2.39.2 + diff --git a/queue-5.15/media-bdisp-add-missing-check-for-create_workqueue.patch b/queue-5.15/media-bdisp-add-missing-check-for-create_workqueue.patch new file mode 100644 index 00000000000..d92d0fc8e10 --- /dev/null +++ b/queue-5.15/media-bdisp-add-missing-check-for-create_workqueue.patch @@ -0,0 +1,37 @@ +From 311594094938d19ea87ca11c09fbc8ff15fa538d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 08:14:42 +0100 +Subject: media: bdisp: Add missing check for create_workqueue + +From: Jiasheng Jiang + +[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ] + +Add the check for the return value of the create_workqueue +in order to avoid NULL pointer dereference. + +Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index 6413cd2791251..19a0f12483dba 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -1310,6 +1310,8 @@ static int bdisp_probe(struct platform_device *pdev) + init_waitqueue_head(&bdisp->irq_queue); + INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout); + bdisp->work_queue = create_workqueue(BDISP_NAME); ++ if (!bdisp->work_queue) ++ return -ENOMEM; + + spin_lock_init(&bdisp->slock); + mutex_init(&bdisp->lock); +-- +2.39.2 + diff --git a/queue-5.15/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch b/queue-5.15/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch new file mode 100644 index 00000000000..da272f95eea --- /dev/null +++ b/queue-5.15/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch @@ -0,0 +1,56 @@ +From 233cf57994efd14b6f3bbe81b73c8943096a4708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:15:06 +0800 +Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race + condition + +From: Zheng Wang + +[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ] + +In dm1105_probe, it called dm1105_ir_init and bound +&dm1105->ir.work with dm1105_emit_key. +When it handles IRQ request with dm1105_irq, +it may call schedule_work to start the work. + +When we call dm1105_remove to remove the driver, there +may be a sequence as follows: + +Fix it by finishing the work before cleanup in dm1105_remove + +CPU0 CPU1 + + |dm1105_emit_key +dm1105_remove | + dm1105_ir_exit | + rc_unregister_device | + rc_free_device | + rc_dev_release | + kfree(dev); | + | + | rc_keydown + | //use + +Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/dm1105/dm1105.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c +index 4ac645a56c14e..9e9c7c071accc 100644 +--- a/drivers/media/pci/dm1105/dm1105.c ++++ b/drivers/media/pci/dm1105/dm1105.c +@@ -1176,6 +1176,7 @@ static void dm1105_remove(struct pci_dev *pdev) + struct dvb_demux *dvbdemux = &dev->demux; + struct dmx_demux *dmx = &dvbdemux->dmx; + ++ cancel_work_sync(&dev->ir.work); + dm1105_ir_exit(dev); + dmx->close(dmx); + dvb_net_release(&dev->dvbnet); +-- +2.39.2 + diff --git a/queue-5.15/media-max9286-free-control-handler.patch b/queue-5.15/media-max9286-free-control-handler.patch new file mode 100644 index 00000000000..4eb29d926bd --- /dev/null +++ b/queue-5.15/media-max9286-free-control-handler.patch @@ -0,0 +1,41 @@ +From 828a4e4b661880c69a2c6b4760e0903737cb2409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 22:46:50 +0100 +Subject: media: max9286: Free control handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Pinchart + +[ Upstream commit bfce6a12e5ba1edde95126aa06778027f16115d4 ] + +The control handler is leaked in some probe-time error paths, as well as +in the remove path. Fix it. + +Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver") +Signed-off-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/max9286.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c +index b9513e93ac617..404a03f48b976 100644 +--- a/drivers/media/i2c/max9286.c ++++ b/drivers/media/i2c/max9286.c +@@ -937,6 +937,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv) + static void max9286_v4l2_unregister(struct max9286_priv *priv) + { + fwnode_handle_put(priv->sd.fwnode); ++ v4l2_ctrl_handler_free(&priv->ctrls); + v4l2_async_unregister_subdev(&priv->sd); + max9286_v4l2_notifier_unregister(priv); + } +-- +2.39.2 + diff --git a/queue-5.15/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch b/queue-5.15/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch new file mode 100644 index 00000000000..9573e007e9b --- /dev/null +++ b/queue-5.15/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch @@ -0,0 +1,43 @@ +From b696039104fd9ddcec7a58870eae2183eec3697e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 13:38:33 -0700 +Subject: media: rc: gpio-ir-recv: Fix support for wake-up + +From: Florian Fainelli + +[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ] + +The driver was intended from the start to be a wake-up source for the +system, however due to the absence of a suitable call to +device_set_wakeup_capable(), the device_may_wakeup() call used to decide +whether to enable the GPIO interrupt as a wake-up source would never +happen. Lookup the DT standard "wakeup-source" property and call +device_init_wakeup() to ensure the device is flagged as being wakeup +capable. + +Reported-by: Matthew Lear +Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver") +Signed-off-by: Florian Fainelli +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/gpio-ir-recv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c +index a56c844d7f816..16795e07dc103 100644 +--- a/drivers/media/rc/gpio-ir-recv.c ++++ b/drivers/media/rc/gpio-ir-recv.c +@@ -107,6 +107,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev) + rcdev->map_name = RC_MAP_EMPTY; + + gpio_dev->rcdev = rcdev; ++ if (of_property_read_bool(np, "wakeup-source")) ++ device_init_wakeup(dev, true); + + rc = devm_rc_register_device(dev, rcdev); + if (rc < 0) { +-- +2.39.2 + diff --git a/queue-5.15/media-rcar_fdp1-convert-to-platform-remove-callback-.patch b/queue-5.15/media-rcar_fdp1-convert-to-platform-remove-callback-.patch new file mode 100644 index 00000000000..9a685209558 --- /dev/null +++ b/queue-5.15/media-rcar_fdp1-convert-to-platform-remove-callback-.patch @@ -0,0 +1,66 @@ +From c20f0a7ce94188ff2b9298f0941f3c895bc7c4e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 16:31:19 +0200 +Subject: media: rcar_fdp1: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 0e82d3715fd208de567b8e4307fbf91ae5e57db4 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Hans Verkuil +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 37ecf489d112e..d80b3214dfae1 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2396,7 +2396,7 @@ static int fdp1_probe(struct platform_device *pdev) + return ret; + } + +-static int fdp1_remove(struct platform_device *pdev) ++static void fdp1_remove(struct platform_device *pdev) + { + struct fdp1_dev *fdp1 = platform_get_drvdata(pdev); + +@@ -2404,8 +2404,6 @@ static int fdp1_remove(struct platform_device *pdev) + video_unregister_device(&fdp1->vfd); + v4l2_device_unregister(&fdp1->v4l2_dev); + pm_runtime_disable(&pdev->dev); +- +- return 0; + } + + static int __maybe_unused fdp1_pm_runtime_suspend(struct device *dev) +@@ -2441,7 +2439,7 @@ MODULE_DEVICE_TABLE(of, fdp1_dt_ids); + + static struct platform_driver fdp1_pdrv = { + .probe = fdp1_probe, +- .remove = fdp1_remove, ++ .remove_new = fdp1_remove, + .driver = { + .name = DRIVER_NAME, + .of_match_table = fdp1_dt_ids, +-- +2.39.2 + diff --git a/queue-5.15/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch b/queue-5.15/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch new file mode 100644 index 00000000000..91f049f0b2f --- /dev/null +++ b/queue-5.15/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch @@ -0,0 +1,70 @@ +From 5d765548b19762aafd9ac7992be3428a8ff4d813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 11:58:09 +0400 +Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function + +From: Miaoqian Lin + +[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ] + +rcar_fcp_get() take reference, which should be balanced with +rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and +the error paths of fdp1_probe() to fix this. + +Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +[hverkuil: resolve merge conflict, remove() is now void] +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index d80b3214dfae1..c548cb01957b0 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2313,8 +2313,10 @@ static int fdp1_probe(struct platform_device *pdev) + + /* Determine our clock rate */ + clk = clk_get(&pdev->dev, NULL); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); ++ if (IS_ERR(clk)) { ++ ret = PTR_ERR(clk); ++ goto put_dev; ++ } + + fdp1->clk_rate = clk_get_rate(clk); + clk_put(clk); +@@ -2323,7 +2325,7 @@ static int fdp1_probe(struct platform_device *pdev) + ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev); + if (ret) { + v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n"); +- return ret; ++ goto put_dev; + } + + /* M2M registration */ +@@ -2393,6 +2395,8 @@ static int fdp1_probe(struct platform_device *pdev) + unreg_dev: + v4l2_device_unregister(&fdp1->v4l2_dev); + ++put_dev: ++ rcar_fcp_put(fdp1->fcp); + return ret; + } + +@@ -2404,6 +2408,7 @@ static void fdp1_remove(struct platform_device *pdev) + video_unregister_device(&fdp1->vfd); + v4l2_device_unregister(&fdp1->v4l2_dev); + pm_runtime_disable(&pdev->dev); ++ rcar_fcp_put(fdp1->fcp); + } + + static int __maybe_unused fdp1_pm_runtime_suspend(struct device *dev) +-- +2.39.2 + diff --git a/queue-5.15/media-rcar_fdp1-fix-the-correct-variable-assignments.patch b/queue-5.15/media-rcar_fdp1-fix-the-correct-variable-assignments.patch new file mode 100644 index 00000000000..638e952da7f --- /dev/null +++ b/queue-5.15/media-rcar_fdp1-fix-the-correct-variable-assignments.patch @@ -0,0 +1,48 @@ +From 1fe2531bdd1d9b17910c381cd28a9e8fc752b3c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 05:09:38 +0200 +Subject: media: rcar_fdp1: Fix the correct variable assignments + +From: Tang Bin + +[ Upstream commit af88c2adbb72a09ab1bb5c37ba388c98fecca69b ] + +In the function fdp1_probe(), when get irq failed, the +function platform_get_irq() log an error message, so +remove redundant message here. And the variable type +of "ret" is int, the "fdp1->irq" is unsigned int, when +irq failed, this place maybe wrong, thus fix it. + +Signed-off-by: Tang Bin +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 19de3c19bcca2..37ecf489d112e 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2287,11 +2287,10 @@ static int fdp1_probe(struct platform_device *pdev) + return PTR_ERR(fdp1->regs); + + /* Interrupt service routine registration */ +- fdp1->irq = ret = platform_get_irq(pdev, 0); +- if (ret < 0) { +- dev_err(&pdev->dev, "cannot find IRQ\n"); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) + return ret; +- } ++ fdp1->irq = ret; + + ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0, + dev_name(&pdev->dev), fdp1); +-- +2.39.2 + diff --git a/queue-5.15/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch b/queue-5.15/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch new file mode 100644 index 00000000000..bc5dcd3b46f --- /dev/null +++ b/queue-5.15/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch @@ -0,0 +1,49 @@ +From a16f50e11e9cbc27ecacc97b7dfd28a07db540ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 07:55:24 +0200 +Subject: media: rcar_fdp1: Make use of the helper function + devm_platform_ioremap_resource() + +From: Cai Huoqing + +[ Upstream commit 736cce12fa630e28705de06570d74f0513d948d5 ] + +Use the devm_platform_ioremap_resource() helper instead of +calling platform_get_resource() and devm_ioremap_resource() +separately + +Signed-off-by: Cai Huoqing +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 89aac60066d91..19de3c19bcca2 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2256,7 +2256,6 @@ static int fdp1_probe(struct platform_device *pdev) + struct fdp1_dev *fdp1; + struct video_device *vfd; + struct device_node *fcp_node; +- struct resource *res; + struct clk *clk; + unsigned int i; + +@@ -2283,8 +2282,7 @@ static int fdp1_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, fdp1); + + /* Memory-mapped registers */ +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- fdp1->regs = devm_ioremap_resource(&pdev->dev, res); ++ fdp1->regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(fdp1->regs)) + return PTR_ERR(fdp1->regs); + +-- +2.39.2 + diff --git a/queue-5.15/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch b/queue-5.15/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch new file mode 100644 index 00000000000..410a0798ab2 --- /dev/null +++ b/queue-5.15/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch @@ -0,0 +1,56 @@ +From 30e1383ed4a3a3ff85f9316dd1035ce3d8d291b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 16:42:20 +0000 +Subject: media: rkvdec: fix use after free bug in rkvdec_remove + +From: Zheng Wang + +[ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ] + +In rkvdec_probe, rkvdec->watchdog_work is bound with +rkvdec_watchdog_func. Then rkvdec_vp9_run may +be called to start the work. + +If we remove the module which will call rkvdec_remove + to make cleanup, there may be a unfinished work. + The possible sequence is as follows, which will + cause a typical UAF bug. + +Fix it by canceling the work before cleanup in rkvdec_remove. + +CPU0 CPU1 + + |rkvdec_watchdog_func +rkvdec_remove | + rkvdec_v4l2_cleanup| + v4l2_m2m_release | + kfree(m2m_dev); | + | + | v4l2_m2m_get_curr_priv + | m2m_dev->curr_ctx //use + +Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkvdec/rkvdec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index 4fd4a2907da70..bc4683a75e61f 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -1042,6 +1042,8 @@ static int rkvdec_remove(struct platform_device *pdev) + { + struct rkvdec_dev *rkvdec = platform_get_drvdata(pdev); + ++ cancel_delayed_work_sync(&rkvdec->watchdog_work); ++ + rkvdec_v4l2_cleanup(rkvdec); + pm_runtime_disable(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev); +-- +2.39.2 + diff --git a/queue-5.15/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch b/queue-5.15/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch new file mode 100644 index 00000000000..443fc953d8b --- /dev/null +++ b/queue-5.15/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch @@ -0,0 +1,86 @@ +From 06539d15113a29db97d2b6bbcc77932ba29cda4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:50:23 +0800 +Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race + condition + +From: Zheng Wang + +[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ] + +In saa7134_initdev, it will call saa7134_hwinit1. There are three +function invoking here: saa7134_video_init1, saa7134_ts_init1 +and saa7134_vbi_init1. + +All of them will init a timer with same function. Take +saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout +with saa7134_buffer_timeout. + +In buffer_activate, the timer funtcion is started. + +If we remove the module or device which will call saa7134_finidev +to make cleanup, there may be a unfinished work. The +possible sequence is as follows, which will cause a +typical UAF bug. + +Fix it by canceling the timer works accordingly before cleanup in +saa7134_finidev. + +CPU0 CPU1 + + |saa7134_buffer_timeout +saa7134_finidev | + kfree(dev); | + | + | saa7134_buffer_next + | //use dev + +Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-ts.c | 1 + + drivers/media/pci/saa7134/saa7134-vbi.c | 1 + + drivers/media/pci/saa7134/saa7134-video.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c +index 6a5053126237f..437dbe5e75e29 100644 +--- a/drivers/media/pci/saa7134/saa7134-ts.c ++++ b/drivers/media/pci/saa7134/saa7134-ts.c +@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) + + int saa7134_ts_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->ts_q.timeout); + saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); + return 0; + } +diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c +index 3f0b0933eed69..3e773690468bd 100644 +--- a/drivers/media/pci/saa7134/saa7134-vbi.c ++++ b/drivers/media/pci/saa7134/saa7134-vbi.c +@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) + int saa7134_vbi_fini(struct saa7134_dev *dev) + { + /* nothing */ ++ del_timer_sync(&dev->vbi_q.timeout); + return 0; + } + +diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c +index 374c8e1087de1..81bb9a3671953 100644 +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -2153,6 +2153,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) + + void saa7134_video_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->video_q.timeout); + /* free stuff */ + saa7134_pgtable_free(dev->pci, &dev->video_q.pt); + saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt); +-- +2.39.2 + diff --git a/queue-5.15/media-venus-dec-fix-handling-of-the-start-cmd.patch b/queue-5.15/media-venus-dec-fix-handling-of-the-start-cmd.patch new file mode 100644 index 00000000000..567200855fe --- /dev/null +++ b/queue-5.15/media-venus-dec-fix-handling-of-the-start-cmd.patch @@ -0,0 +1,61 @@ +From 497ef1b912ca3ca978c054854ea4080c606630af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 13:54:18 +0000 +Subject: media: venus: dec: Fix handling of the start cmd +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Krawczyk + +[ Upstream commit 50248ad9f190d527cbd578190ca769729518b703 ] + +The decoder driver should clear the last_buffer_dequeued flag of the +capture queue upon receiving V4L2_DEC_CMD_START. + +The last_buffer_dequeued flag is set upon receiving EOS (which always +happens upon receiving V4L2_DEC_CMD_STOP). + +Without this patch, after issuing the V4L2_DEC_CMD_STOP and +V4L2_DEC_CMD_START, the vb2_dqbuf() function will always fail, even if +the buffers are completed by the hardware. + +Fixes: beac82904a87 ("media: venus: make decoder compliant with stateful codec API") + +Signed-off-by: Michał Krawczyk +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 9a4443a390b1f..6e0466772339a 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -498,6 +498,7 @@ static int + vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) + { + struct venus_inst *inst = to_inst(file); ++ struct vb2_queue *dst_vq; + struct hfi_frame_data fdata = {0}; + int ret; + +@@ -528,6 +529,13 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) + inst->codec_state = VENUS_DEC_STATE_DRAIN; + inst->drain_active = true; + } ++ } else if (cmd->cmd == V4L2_DEC_CMD_START && ++ inst->codec_state == VENUS_DEC_STATE_STOPPED) { ++ dst_vq = v4l2_m2m_get_vq(inst->fh.m2m_ctx, ++ V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); ++ vb2_clear_last_buffer_dequeued(dst_vq); ++ ++ inst->codec_state = VENUS_DEC_STATE_DECODING; + } + + unlock: +-- +2.39.2 + diff --git a/queue-5.15/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch b/queue-5.15/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch new file mode 100644 index 00000000000..0ceec930d32 --- /dev/null +++ b/queue-5.15/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch @@ -0,0 +1,119 @@ +From ad47c690f16f0cab1d50a7d3ce98d5776186633e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:25:46 +0100 +Subject: mfd: tqmx86: Correct board names for TQMxE39x + +From: Matthias Schiffer + +[ Upstream commit f376c479668557bcc2fd9e9fbc0f53e7819a11cd ] + +It seems that this driver was developed based on preliminary documentation. +Report the correct names for all TQMxE39x variants, as they are used by +the released hardware revisions: + +- Fix names for TQMxE39C1/C2 board IDs +- Distinguish TQMxE39M and TQMxE39S, which use the same board ID + +The TQMxE39M/S are distinguished using the SAUC (Sanctioned Alternate +Uses Configuration) register of the GPIO controller. This also prepares +for the correct handling of the differences between the GPIO controllers +of our COMe and SMARC modules. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/aca9a7cb42a85181bcb456c437554d2728e708ec.1676892223.git.matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index 958334f14eb00..fac02875fe7d9 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -30,9 +30,9 @@ + #define TQMX86_REG_BOARD_ID_50UC 2 + #define TQMX86_REG_BOARD_ID_E38C 3 + #define TQMX86_REG_BOARD_ID_60EB 4 +-#define TQMX86_REG_BOARD_ID_E39M 5 +-#define TQMX86_REG_BOARD_ID_E39C 6 +-#define TQMX86_REG_BOARD_ID_E39x 7 ++#define TQMX86_REG_BOARD_ID_E39MS 5 ++#define TQMX86_REG_BOARD_ID_E39C1 6 ++#define TQMX86_REG_BOARD_ID_E39C2 7 + #define TQMX86_REG_BOARD_ID_70EB 8 + #define TQMX86_REG_BOARD_ID_80UC 9 + #define TQMX86_REG_BOARD_ID_110EB 11 +@@ -48,6 +48,7 @@ + #define TQMX86_REG_IO_EXT_INT_12 3 + #define TQMX86_REG_IO_EXT_INT_MASK 0x3 + #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT 4 ++#define TQMX86_REG_SAUC 0x17 + + #define TQMX86_REG_I2C_DETECT 0x1a7 + #define TQMX86_REG_I2C_DETECT_SOFT 0xa5 +@@ -110,7 +111,7 @@ static const struct mfd_cell tqmx86_devs[] = { + }, + }; + +-static const char *tqmx86_board_id_to_name(u8 board_id) ++static const char *tqmx86_board_id_to_name(u8 board_id, u8 sauc) + { + switch (board_id) { + case TQMX86_REG_BOARD_ID_E38M: +@@ -121,12 +122,12 @@ static const char *tqmx86_board_id_to_name(u8 board_id) + return "TQMxE38C"; + case TQMX86_REG_BOARD_ID_60EB: + return "TQMx60EB"; +- case TQMX86_REG_BOARD_ID_E39M: +- return "TQMxE39M"; +- case TQMX86_REG_BOARD_ID_E39C: +- return "TQMxE39C"; +- case TQMX86_REG_BOARD_ID_E39x: +- return "TQMxE39x"; ++ case TQMX86_REG_BOARD_ID_E39MS: ++ return (sauc == 0xff) ? "TQMxE39M" : "TQMxE39S"; ++ case TQMX86_REG_BOARD_ID_E39C1: ++ return "TQMxE39C1"; ++ case TQMX86_REG_BOARD_ID_E39C2: ++ return "TQMxE39C2"; + case TQMX86_REG_BOARD_ID_70EB: + return "TQMx70EB"; + case TQMX86_REG_BOARD_ID_80UC: +@@ -159,9 +160,9 @@ static int tqmx86_board_id_to_clk_rate(struct device *dev, u8 board_id) + case TQMX86_REG_BOARD_ID_E40C1: + case TQMX86_REG_BOARD_ID_E40C2: + return 24000; +- case TQMX86_REG_BOARD_ID_E39M: +- case TQMX86_REG_BOARD_ID_E39C: +- case TQMX86_REG_BOARD_ID_E39x: ++ case TQMX86_REG_BOARD_ID_E39MS: ++ case TQMX86_REG_BOARD_ID_E39C1: ++ case TQMX86_REG_BOARD_ID_E39C2: + return 25000; + case TQMX86_REG_BOARD_ID_E38M: + case TQMX86_REG_BOARD_ID_E38C: +@@ -175,7 +176,7 @@ static int tqmx86_board_id_to_clk_rate(struct device *dev, u8 board_id) + + static int tqmx86_probe(struct platform_device *pdev) + { +- u8 board_id, rev, i2c_det, io_ext_int_val; ++ u8 board_id, sauc, rev, i2c_det, io_ext_int_val; + struct device *dev = &pdev->dev; + u8 gpio_irq_cfg, readback; + const char *board_name; +@@ -205,7 +206,8 @@ static int tqmx86_probe(struct platform_device *pdev) + return -ENOMEM; + + board_id = ioread8(io_base + TQMX86_REG_BOARD_ID); +- board_name = tqmx86_board_id_to_name(board_id); ++ sauc = ioread8(io_base + TQMX86_REG_SAUC); ++ board_name = tqmx86_board_id_to_name(board_id, sauc); + rev = ioread8(io_base + TQMX86_REG_BOARD_REV); + + dev_info(dev, +-- +2.39.2 + diff --git a/queue-5.15/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch b/queue-5.15/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch new file mode 100644 index 00000000000..911603aa83c --- /dev/null +++ b/queue-5.15/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch @@ -0,0 +1,61 @@ +From b3e899e1709e9649154758bac6bfaffd4bd1fe2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:25:44 +0100 +Subject: mfd: tqmx86: Do not access I2C_DETECT register through io_base + +From: Matthias Schiffer + +[ Upstream commit 1be1b23696b3d4b0231c694f5e0767b4471d33a9 ] + +The I2C_DETECT register is at IO port 0x1a7, which is outside the range +passed to devm_ioport_map() for io_base, and was only working because +there aren't actually any bounds checks for IO port accesses. + +Extending the range does not seem like a good solution here, as it would +then conflict with the IO resource assigned to the I2C controller. As +this is just a one-off access during probe, use a simple inb() instead. + +While we're at it, drop the unused define TQMX86_REG_I2C_INT_EN. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/e8300a30f0791afb67d79db8089fb6004855f378.1676892223.git.matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index 7ae906ff8e353..31d0efb5aacf8 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -49,9 +49,8 @@ + #define TQMX86_REG_IO_EXT_INT_MASK 0x3 + #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT 4 + +-#define TQMX86_REG_I2C_DETECT 0x47 ++#define TQMX86_REG_I2C_DETECT 0x1a7 + #define TQMX86_REG_I2C_DETECT_SOFT 0xa5 +-#define TQMX86_REG_I2C_INT_EN 0x49 + + static uint gpio_irq; + module_param(gpio_irq, uint, 0); +@@ -213,7 +212,12 @@ static int tqmx86_probe(struct platform_device *pdev) + "Found %s - Board ID %d, PCB Revision %d, PLD Revision %d\n", + board_name, board_id, rev >> 4, rev & 0xf); + +- i2c_det = ioread8(io_base + TQMX86_REG_I2C_DETECT); ++ /* ++ * The I2C_DETECT register is in the range assigned to the I2C driver ++ * later, so we don't extend TQMX86_IOSIZE. Use inb() for this one-off ++ * access instead of ioport_map + unmap. ++ */ ++ i2c_det = inb(TQMX86_REG_I2C_DETECT); + + if (gpio_irq_cfg) { + io_ext_int_val = +-- +2.39.2 + diff --git a/queue-5.15/mfd-tqmx86-specify-io-port-register-range-more-preci.patch b/queue-5.15/mfd-tqmx86-specify-io-port-register-range-more-preci.patch new file mode 100644 index 00000000000..2b5b683b36a --- /dev/null +++ b/queue-5.15/mfd-tqmx86-specify-io-port-register-range-more-preci.patch @@ -0,0 +1,64 @@ +From 6f89f16ab73e9e2bcd540fd2d9b377f4593672e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:25:45 +0100 +Subject: mfd: tqmx86: Specify IO port register range more precisely + +From: Matthias Schiffer + +[ Upstream commit 051c69ff4f607aa114c7bbdd7c41ed881367aeee ] + +Registers 0x160..0x17f are unassigned. Use 0x180 as base register and +update offets accordingly. + +Also change the size of the range to include 0x19f. While 0x19f is +currently reserved for future extensions, so are several of the previous +registers up to 0x19e, and it is weird to leave out just the last one. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/db4677ac318b1283c8956f637f409995a30a31c3.1676892223.git.matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index 31d0efb5aacf8..958334f14eb00 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -16,8 +16,8 @@ + #include + #include + +-#define TQMX86_IOBASE 0x160 +-#define TQMX86_IOSIZE 0x3f ++#define TQMX86_IOBASE 0x180 ++#define TQMX86_IOSIZE 0x20 + #define TQMX86_IOBASE_I2C 0x1a0 + #define TQMX86_IOSIZE_I2C 0xa + #define TQMX86_IOBASE_WATCHDOG 0x18b +@@ -25,7 +25,7 @@ + #define TQMX86_IOBASE_GPIO 0x18d + #define TQMX86_IOSIZE_GPIO 0x4 + +-#define TQMX86_REG_BOARD_ID 0x20 ++#define TQMX86_REG_BOARD_ID 0x00 + #define TQMX86_REG_BOARD_ID_E38M 1 + #define TQMX86_REG_BOARD_ID_50UC 2 + #define TQMX86_REG_BOARD_ID_E38C 3 +@@ -40,8 +40,8 @@ + #define TQMX86_REG_BOARD_ID_E40S 13 + #define TQMX86_REG_BOARD_ID_E40C1 14 + #define TQMX86_REG_BOARD_ID_E40C2 15 +-#define TQMX86_REG_BOARD_REV 0x21 +-#define TQMX86_REG_IO_EXT_INT 0x26 ++#define TQMX86_REG_BOARD_REV 0x01 ++#define TQMX86_REG_IO_EXT_INT 0x06 + #define TQMX86_REG_IO_EXT_INT_NONE 0 + #define TQMX86_REG_IO_EXT_INT_7 1 + #define TQMX86_REG_IO_EXT_INT_9 2 +-- +2.39.2 + diff --git a/queue-5.15/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch b/queue-5.15/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch new file mode 100644 index 00000000000..caff220c996 --- /dev/null +++ b/queue-5.15/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch @@ -0,0 +1,82 @@ +From 8ecb6b40216dd2b63b910ed23f46adc2d02380fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 23:37:15 +0300 +Subject: mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data + +From: Georgii Kruglov + +[ Upstream commit 0dd8316037a2a6d85b2be208bef9991de7b42170 ] + +If spec_reg is equal to 'SDHCI_PRESENT_STATE', esdhc_readl_fixup() +fixes up register value and returns it immediately. As a result, the +further block +(spec_reg == SDHCI_PRESENT_STATE) + &&(esdhc->quirk_ignore_data_inhibit == true), +is never executed. + +The patch merges the second block into the first one. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1f1929f3f2fa ("mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data") +Signed-off-by: Georgii Kruglov +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20230321203715.3975-1-georgy.kruglov@yandex.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-esdhc.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 04a37fd137ee1..ea9bb545b1a21 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -126,6 +126,7 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + return ret; + } + } ++ + /* + * The DAT[3:0] line signal levels and the CMD line signal level are + * not compatible with standard SDHC register. The line signal levels +@@ -137,6 +138,16 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + ret = value & 0x000fffff; + ret |= (value >> 4) & SDHCI_DATA_LVL_MASK; + ret |= (value << 1) & SDHCI_CMD_LVL; ++ ++ /* ++ * Some controllers have unreliable Data Line Active ++ * bit for commands with busy signal. This affects ++ * Command Inhibit (data) bit. Just ignore it since ++ * MMC core driver has already polled card status ++ * with CMD13 after any command with busy siganl. ++ */ ++ if (esdhc->quirk_ignore_data_inhibit) ++ ret &= ~SDHCI_DATA_INHIBIT; + return ret; + } + +@@ -151,19 +162,6 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + return ret; + } + +- /* +- * Some controllers have unreliable Data Line Active +- * bit for commands with busy signal. This affects +- * Command Inhibit (data) bit. Just ignore it since +- * MMC core driver has already polled card status +- * with CMD13 after any command with busy siganl. +- */ +- if ((spec_reg == SDHCI_PRESENT_STATE) && +- (esdhc->quirk_ignore_data_inhibit == true)) { +- ret = value & ~SDHCI_DATA_INHIBIT; +- return ret; +- } +- + ret = value; + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/net-amd-fix-link-leak-when-verifying-config-failed.patch b/queue-5.15/net-amd-fix-link-leak-when-verifying-config-failed.patch new file mode 100644 index 00000000000..f4c3d3b34fd --- /dev/null +++ b/queue-5.15/net-amd-fix-link-leak-when-verifying-config-failed.patch @@ -0,0 +1,47 @@ +From a9846aee0430471d20ac2a630e956eccf7167893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 23:28:01 +0800 +Subject: net: amd: Fix link leak when verifying config failed + +From: Gencen Gan + +[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ] + +After failing to verify configuration, it returns directly without +releasing link, which may cause memory leak. + +Paolo Abeni thinks that the whole code of this driver is quite +"suboptimal" and looks unmainatained since at least ~15y, so he +suggests that we could simply remove the whole driver, please +take it into consideration. + +Simon Horman suggests that the fix label should be set to +"Linux-2.6.12-rc2" considering that the problem has existed +since the driver was introduced and the commit above doesn't +seem to exist in net/net-next. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Gan Gecen +Reviewed-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/nmclan_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c +index 4019cab875051..8bd063e54ac38 100644 +--- a/drivers/net/ethernet/amd/nmclan_cs.c ++++ b/drivers/net/ethernet/amd/nmclan_cs.c +@@ -650,7 +650,7 @@ static int nmclan_config(struct pcmcia_device *link) + } else { + pr_notice("mace id not found: %x %x should be 0x40 0x?9\n", + sig[0], sig[1]); +- return -ENODEV; ++ goto failed; + } + } + +-- +2.39.2 + diff --git a/queue-5.15/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch b/queue-5.15/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch new file mode 100644 index 00000000000..1abe672061a --- /dev/null +++ b/queue-5.15/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch @@ -0,0 +1,64 @@ +From 1661b2dbd305cee27f8294e26b7305239eff4477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 18:11:29 +0200 +Subject: net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling + +From: Sebastian Reichel + +[ Upstream commit db21973263f8c56750cb610f1d5e8bee00a513b9 ] + +The usual devm_regulator_get() call already handles "optional" +regulators by returning a valid dummy and printing a warning +that the dummy regulator should be described properly. This +code open coded the same behaviour, but masked any errors that +are not -EPROBE_DEFER and is quite noisy. + +This change effectively unmasks and propagates regulators errors +not involving -ENODEV, downgrades the error print to warning level +if no regulator is specified and captures the probe defer message +for /sys/kernel/debug/devices_deferred. + +Fixes: 2e12f536635f ("net: stmmac: dwmac-rk: Use standard devicetree property for phy regulator") +Signed-off-by: Sebastian Reichel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +index c469abc91fa1b..8394a215725d3 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -1347,9 +1347,6 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable) + int ret; + struct device *dev = &bsp_priv->pdev->dev; + +- if (!ldo) +- return 0; +- + if (enable) { + ret = regulator_enable(ldo); + if (ret) +@@ -1397,14 +1394,11 @@ static struct rk_priv_data *rk_gmac_setup(struct platform_device *pdev, + } + } + +- bsp_priv->regulator = devm_regulator_get_optional(dev, "phy"); ++ bsp_priv->regulator = devm_regulator_get(dev, "phy"); + if (IS_ERR(bsp_priv->regulator)) { +- if (PTR_ERR(bsp_priv->regulator) == -EPROBE_DEFER) { +- dev_err(dev, "phy regulator is not available yet, deferred probing\n"); +- return ERR_PTR(-EPROBE_DEFER); +- } +- dev_err(dev, "no regulator found\n"); +- bsp_priv->regulator = NULL; ++ ret = PTR_ERR(bsp_priv->regulator); ++ dev_err_probe(dev, ret, "failed to get phy regulator\n"); ++ return ERR_PTR(ret); + } + + ret = of_property_read_string(dev->of_node, "clock_in_out", &strings); +-- +2.39.2 + diff --git a/queue-5.15/net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch b/queue-5.15/net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch new file mode 100644 index 00000000000..4c41cc0fc37 --- /dev/null +++ b/queue-5.15/net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch @@ -0,0 +1,51 @@ +From 54d2a6e427d1ce0433c3004ba5e8fe79149ceb70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 09:56:08 +0200 +Subject: net/mlx5: E-switch, Don't destroy indirect table in split rule + +From: Chris Mi + +[ Upstream commit 4c8189302567f75099a336b0efcff8291ec86ff4 ] + +Source port rewrite (forward to ovs internal port or statck device) isn't +supported in the rule of split action. So there is no indirect table in +split rule. The cited commit destroyes indirect table in split rule. The +indirect table for other rules will be destroyed wrongly. It will cause +traffic loss. + +Fix it by removing the destroy function in split rule. And also remove +the destroy function in error flow. + +Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading") +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 002567792e91e..829f703233a9e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -656,7 +656,6 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw, + + return rule; + err_chain_src_rewrite: +- esw_put_dest_tables_loop(esw, attr, 0, i); + mlx5_esw_vporttbl_put(esw, &fwd_attr); + err_get_fwd: + mlx5_chains_put_table(chains, attr->chain, attr->prio, 0); +@@ -698,7 +697,6 @@ __mlx5_eswitch_del_rule(struct mlx5_eswitch *esw, + if (fwd_rule) { + mlx5_esw_vporttbl_put(esw, &fwd_attr); + mlx5_chains_put_table(chains, attr->chain, attr->prio, 0); +- esw_put_dest_tables_loop(esw, attr, 0, esw_attr->split_count); + } else { + if (split) + mlx5_esw_vporttbl_put(esw, &fwd_attr); +-- +2.39.2 + diff --git a/queue-5.15/net-packet-annotate-accesses-to-po-xmit.patch b/queue-5.15/net-packet-annotate-accesses-to-po-xmit.patch new file mode 100644 index 00000000000..8e6b3c84cb1 --- /dev/null +++ b/queue-5.15/net-packet-annotate-accesses-to-po-xmit.patch @@ -0,0 +1,70 @@ +From 2c9c66b9bab19c1821029bc8d47f5f50764306b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:06 +0000 +Subject: net/packet: annotate accesses to po->xmit + +From: Eric Dumazet + +[ Upstream commit b9d83ab8a708f23a4001d60e9d8d0b3be3d9f607 ] + +po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS), +while read locklessly. + +Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store +tearing issues. + +Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 7f9f2d0ef0e62..1b3c54e0fbdfb 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -271,7 +271,8 @@ static void packet_cached_dev_reset(struct packet_sock *po) + + static bool packet_use_direct_xmit(const struct packet_sock *po) + { +- return po->xmit == packet_direct_xmit; ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ return READ_ONCE(po->xmit) == packet_direct_xmit; + } + + static u16 packet_pick_tx_queue(struct sk_buff *skb) +@@ -2828,7 +2829,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + packet_inc_pending(&po->tx_ring); + + status = TP_STATUS_SEND_REQUEST; +- err = po->xmit(skb); ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ err = READ_ONCE(po->xmit)(skb); + if (unlikely(err != 0)) { + if (err > 0) + err = net_xmit_errno(err); +@@ -3031,7 +3033,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + virtio_net_hdr_set_proto(skb, &vnet_hdr); + } + +- err = po->xmit(skb); ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ err = READ_ONCE(po->xmit)(skb); + if (unlikely(err != 0)) { + if (err > 0) + err = net_xmit_errno(err); +@@ -3976,7 +3979,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +- po->xmit = val ? packet_direct_xmit : dev_queue_xmit; ++ /* Paired with all lockless reads of po->xmit */ ++ WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit); + return 0; + } + default: +-- +2.39.2 + diff --git a/queue-5.15/net-packet-convert-po-auxdata-to-an-atomic-flag.patch b/queue-5.15/net-packet-convert-po-auxdata-to-an-atomic-flag.patch new file mode 100644 index 00000000000..1a054c59a6e --- /dev/null +++ b/queue-5.15/net-packet-convert-po-auxdata-to-an-atomic-flag.patch @@ -0,0 +1,95 @@ +From b6860cf5fcee584a6d3e9b93ceccb74890027ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:08 +0000 +Subject: net/packet: convert po->auxdata to an atomic flag + +From: Eric Dumazet + +[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ] + +po->auxdata can be read while another thread +is changing its value, potentially raising KCSAN splat. + +Convert it to PACKET_SOCK_AUXDATA flag. + +Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 8 +++----- + net/packet/diag.c | 2 +- + net/packet/internal.h | 4 ++-- + 3 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index cb944ae999471..0db871edd3a18 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3485,7 +3485,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); + } + +- if (pkt_sk(sk)->auxdata) { ++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) { + struct tpacket_auxdata aux; + + aux.tp_status = TP_STATUS_USER; +@@ -3869,9 +3869,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->auxdata = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val); + return 0; + } + case PACKET_ORIGDEV: +@@ -4029,7 +4027,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + + break; + case PACKET_AUXDATA: +- val = po->auxdata; ++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA); + break; + case PACKET_ORIGDEV: + val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); +diff --git a/net/packet/diag.c b/net/packet/diag.c +index e1ac9bb375b31..d704c7bf51b20 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -23,7 +23,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags = 0; + if (po->running) + pinfo.pdi_flags |= PDI_RUNNING; +- if (po->auxdata) ++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA)) + pinfo.pdi_flags |= PDI_AUXDATA; + if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 178cd1852238d..3bae8ea7a36f5 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -118,8 +118,7 @@ struct packet_sock { + struct mutex pg_vec_lock; + unsigned long flags; + unsigned int running; /* bind_lock must be held */ +- unsigned int auxdata:1, /* writer must hold sock lock */ +- has_vnet_hdr:1, ++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */ + tp_loss:1, + tp_tx_has_off:1; + int pressure; +@@ -146,6 +145,7 @@ static inline struct packet_sock *pkt_sk(struct sock *sk) + + enum packet_sock_flags { + PACKET_SOCK_ORIGDEV, ++ PACKET_SOCK_AUXDATA, + }; + + static inline void packet_sock_flag_set(struct packet_sock *po, +-- +2.39.2 + diff --git a/queue-5.15/net-packet-convert-po-origdev-to-an-atomic-flag.patch b/queue-5.15/net-packet-convert-po-origdev-to-an-atomic-flag.patch new file mode 100644 index 00000000000..1c7c79c6d74 --- /dev/null +++ b/queue-5.15/net-packet-convert-po-origdev-to-an-atomic-flag.patch @@ -0,0 +1,126 @@ +From 0f762a372ac1eff6707e6e481a49f400323597a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:07 +0000 +Subject: net/packet: convert po->origdev to an atomic flag + +From: Eric Dumazet + +[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ] + +syzbot/KCAN reported that po->origdev can be read +while another thread is changing its value. + +We can avoid this splat by converting this field +to an actual bit. + +Following patches will convert remaining 1bit fields. + +Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 10 ++++------ + net/packet/diag.c | 2 +- + net/packet/internal.h | 22 +++++++++++++++++++++- + 3 files changed, 26 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 1b3c54e0fbdfb..cb944ae999471 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2149,7 +2149,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, + sll = &PACKET_SKB_CB(skb)->sa.ll; + sll->sll_hatype = dev->type; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -2422,7 +2422,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + sll->sll_hatype = dev->type; + sll->sll_protocol = skb->protocol; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -3883,9 +3883,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->origdev = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val); + return 0; + } + case PACKET_VNET_HDR: +@@ -4034,7 +4032,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + val = po->auxdata; + break; + case PACKET_ORIGDEV: +- val = po->origdev; ++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); + break; + case PACKET_VNET_HDR: + val = po->has_vnet_hdr; +diff --git a/net/packet/diag.c b/net/packet/diag.c +index 07812ae5ca073..e1ac9bb375b31 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -25,7 +25,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags |= PDI_RUNNING; + if (po->auxdata) + pinfo.pdi_flags |= PDI_AUXDATA; +- if (po->origdev) ++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; + if (po->has_vnet_hdr) + pinfo.pdi_flags |= PDI_VNETHDR; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 48af35b1aed25..178cd1852238d 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -116,9 +116,9 @@ struct packet_sock { + int copy_thresh; + spinlock_t bind_lock; + struct mutex pg_vec_lock; ++ unsigned long flags; + unsigned int running; /* bind_lock must be held */ + unsigned int auxdata:1, /* writer must hold sock lock */ +- origdev:1, + has_vnet_hdr:1, + tp_loss:1, + tp_tx_has_off:1; +@@ -144,4 +144,24 @@ static inline struct packet_sock *pkt_sk(struct sock *sk) + return (struct packet_sock *)sk; + } + ++enum packet_sock_flags { ++ PACKET_SOCK_ORIGDEV, ++}; ++ ++static inline void packet_sock_flag_set(struct packet_sock *po, ++ enum packet_sock_flags flag, ++ bool val) ++{ ++ if (val) ++ set_bit(flag, &po->flags); ++ else ++ clear_bit(flag, &po->flags); ++} ++ ++static inline bool packet_sock_flag(const struct packet_sock *po, ++ enum packet_sock_flags flag) ++{ ++ return test_bit(flag, &po->flags); ++} ++ + #endif +-- +2.39.2 + diff --git a/queue-5.15/net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch b/queue-5.15/net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch new file mode 100644 index 00000000000..8c976a97915 --- /dev/null +++ b/queue-5.15/net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch @@ -0,0 +1,68 @@ +From f1576ac03be213d270c2cd4e8ee58af27d500f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 14:46:43 +0000 +Subject: net: pcs: xpcs: remove double-read of link state when using AN + +From: Russell King (Oracle) + +[ Upstream commit ef63461caf427a77a04620d74ba90035a712af9c ] + +Phylink does not want the current state of the link when reading the +PCS link state - it wants the latched state. Don't double-read the +MII status register. Phylink will re-read as necessary to capture +transient link-down events as of dbae3388ea9c ("net: phylink: Force +retrigger in case of latched link-fail indicator"). + +The above referenced commit is a dependency for this change, and thus +this change should not be backported to any kernel that does not +contain the above referenced commit. + +Fixes: fcb26bd2b6ca ("net: phy: Add Synopsys DesignWare XPCS MDIO module") +Signed-off-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/pcs/pcs-xpcs.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c +index fd4cbf8a55ad7..556ca98843565 100644 +--- a/drivers/net/pcs/pcs-xpcs.c ++++ b/drivers/net/pcs/pcs-xpcs.c +@@ -309,7 +309,7 @@ static int xpcs_read_fault_c73(struct dw_xpcs *xpcs, + return 0; + } + +-static int xpcs_read_link_c73(struct dw_xpcs *xpcs, bool an) ++static int xpcs_read_link_c73(struct dw_xpcs *xpcs) + { + bool link = true; + int ret; +@@ -321,15 +321,6 @@ static int xpcs_read_link_c73(struct dw_xpcs *xpcs, bool an) + if (!(ret & MDIO_STAT1_LSTATUS)) + link = false; + +- if (an) { +- ret = xpcs_read(xpcs, MDIO_MMD_AN, MDIO_STAT1); +- if (ret < 0) +- return ret; +- +- if (!(ret & MDIO_STAT1_LSTATUS)) +- link = false; +- } +- + return link; + } + +@@ -847,7 +838,7 @@ static int xpcs_get_state_c73(struct dw_xpcs *xpcs, + int ret; + + /* Link needs to be read first ... */ +- state->link = xpcs_read_link_c73(xpcs, state->an_enabled) > 0 ? 1 : 0; ++ state->link = xpcs_read_link_c73(xpcs) > 0 ? 1 : 0; + + /* ... and then we check the faults. */ + ret = xpcs_read_fault_c73(xpcs, state); +-- +2.39.2 + diff --git a/queue-5.15/net-qrtr-correct-types-of-trace-event-parameters.patch b/queue-5.15/net-qrtr-correct-types-of-trace-event-parameters.patch new file mode 100644 index 00000000000..c2b135acffa --- /dev/null +++ b/queue-5.15/net-qrtr-correct-types-of-trace-event-parameters.patch @@ -0,0 +1,108 @@ +From 43c6710e35a13063f24980725f19fbed49f8d141 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 17:43:16 +0200 +Subject: net: qrtr: correct types of trace event parameters + +From: Simon Horman + +[ Upstream commit 054fbf7ff8143d35ca7d3bb5414bb44ee1574194 ] + +The arguments passed to the trace events are of type unsigned int, +however the signature of the events used __le32 parameters. + +I may be missing the point here, but sparse flagged this and it +does seem incorrect to me. + + net/qrtr/ns.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, include/trace/events/qrtr.h): + ./include/trace/events/qrtr.h:11:1: warning: cast to restricted __le32 + ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer + ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer + ... (a lot more similar warnings) + net/qrtr/ns.c:115:47: expected restricted __le32 [usertype] service + net/qrtr/ns.c:115:47: got unsigned int service + net/qrtr/ns.c:115:61: warning: incorrect type in argument 2 (different base types) + ... (a lot more similar warnings) + +Fixes: dfddb54043f0 ("net: qrtr: Add tracepoint support") +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Simon Horman +Link: https://lore.kernel.org/r/20230402-qrtr-trace-types-v1-1-92ad55008dd3@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/trace/events/qrtr.h | 33 ++++++++++++++++++--------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +diff --git a/include/trace/events/qrtr.h b/include/trace/events/qrtr.h +index b1de14c3bb934..441132c67133f 100644 +--- a/include/trace/events/qrtr.h ++++ b/include/trace/events/qrtr.h +@@ -10,15 +10,16 @@ + + TRACE_EVENT(qrtr_ns_service_announce_new, + +- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port), ++ TP_PROTO(unsigned int service, unsigned int instance, ++ unsigned int node, unsigned int port), + + TP_ARGS(service, instance, node, port), + + TP_STRUCT__entry( +- __field(__le32, service) +- __field(__le32, instance) +- __field(__le32, node) +- __field(__le32, port) ++ __field(unsigned int, service) ++ __field(unsigned int, instance) ++ __field(unsigned int, node) ++ __field(unsigned int, port) + ), + + TP_fast_assign( +@@ -36,15 +37,16 @@ TRACE_EVENT(qrtr_ns_service_announce_new, + + TRACE_EVENT(qrtr_ns_service_announce_del, + +- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port), ++ TP_PROTO(unsigned int service, unsigned int instance, ++ unsigned int node, unsigned int port), + + TP_ARGS(service, instance, node, port), + + TP_STRUCT__entry( +- __field(__le32, service) +- __field(__le32, instance) +- __field(__le32, node) +- __field(__le32, port) ++ __field(unsigned int, service) ++ __field(unsigned int, instance) ++ __field(unsigned int, node) ++ __field(unsigned int, port) + ), + + TP_fast_assign( +@@ -62,15 +64,16 @@ TRACE_EVENT(qrtr_ns_service_announce_del, + + TRACE_EVENT(qrtr_ns_server_add, + +- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port), ++ TP_PROTO(unsigned int service, unsigned int instance, ++ unsigned int node, unsigned int port), + + TP_ARGS(service, instance, node, port), + + TP_STRUCT__entry( +- __field(__le32, service) +- __field(__le32, instance) +- __field(__le32, node) +- __field(__le32, port) ++ __field(unsigned int, service) ++ __field(unsigned int, instance) ++ __field(unsigned int, node) ++ __field(unsigned int, port) + ), + + TP_fast_assign( +-- +2.39.2 + diff --git a/queue-5.15/net-sched-sch_fq-fix-integer-overflow-of-credit.patch b/queue-5.15/net-sched-sch_fq-fix-integer-overflow-of-credit.patch new file mode 100644 index 00000000000..3d0e1d85400 --- /dev/null +++ b/queue-5.15/net-sched-sch_fq-fix-integer-overflow-of-credit.patch @@ -0,0 +1,58 @@ +From 2ac40ee9bede0ce4d94267f00855cd664980d1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 16:59:46 +0200 +Subject: net/sched: sch_fq: fix integer overflow of "credit" + +From: Davide Caratti + +[ Upstream commit 7041101ff6c3073fd8f2e99920f535b111c929cb ] + +if sch_fq is configured with "initial quantum" having values greater than +INT_MAX, the first assignment of "credit" does signed integer overflow to +a very negative value. +In this situation, the syzkaller script provided by Cristoph triggers the +CPU soft-lockup warning even with few sockets. It's not an infinite loop, +but "credit" wasn't probably meant to be minus 2Gb for each new flow. +Capping "initial quantum" to INT_MAX proved to fix the issue. + +v2: validation of "initial quantum" is done in fq_policy, instead of open + coding in fq_change() _ suggested by Jakub Kicinski + +Reported-by: Christoph Paasch +Link: https://github.com/multipath-tcp/mptcp_net-next/issues/377 +Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler") +Reviewed-by: Eric Dumazet +Signed-off-by: Davide Caratti +Link: https://lore.kernel.org/r/7b3a3c7e36d03068707a021760a194a8eb5ad41a.1682002300.git.dcaratti@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_fq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 2fb76fc0cc31b..5a1274199fe33 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -779,13 +779,17 @@ static int fq_resize(struct Qdisc *sch, u32 log) + return 0; + } + ++static struct netlink_range_validation iq_range = { ++ .max = INT_MAX, ++}; ++ + static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = { + [TCA_FQ_UNSPEC] = { .strict_start_type = TCA_FQ_TIMER_SLACK }, + + [TCA_FQ_PLIMIT] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_PLIMIT] = { .type = NLA_U32 }, + [TCA_FQ_QUANTUM] = { .type = NLA_U32 }, +- [TCA_FQ_INITIAL_QUANTUM] = { .type = NLA_U32 }, ++ [TCA_FQ_INITIAL_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &iq_range), + [TCA_FQ_RATE_ENABLE] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_DEFAULT_RATE] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 }, +-- +2.39.2 + diff --git a/queue-5.15/net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch b/queue-5.15/net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch new file mode 100644 index 00000000000..2e50d22b9c2 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch @@ -0,0 +1,77 @@ +From 7b61e55914223fba20b5fd516ea041ed7899515d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 22:13:46 +0800 +Subject: net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA + ports + +From: Yan Wang + +[ Upstream commit 35226750f7ab9d49140d95bc7d38a2a9b0f4fdfc ] + +The system hang because of dsa_tag_8021q_port_setup()-> + stmmac_vlan_rx_add_vid(). + +I found in stmmac_drv_probe() that cailing pm_runtime_put() +disabled the clock. + +First, when the kernel is compiled with CONFIG_PM=y,The stmmac's +resume/suspend is active. + +Secondly,stmmac as DSA master,the dsa_tag_8021q_port_setup() function +will callback stmmac_vlan_rx_add_vid when DSA dirver starts. However, +The system is hanged for the stmmac_vlan_rx_add_vid() accesses its +registers after stmmac's clock is closed. + +I would suggest adding the pm_runtime_resume_and_get() to the +stmmac_vlan_rx_add_vid().This guarantees that resuming clock output +while in use. + +Fixes: b3dcb3127786 ("net: stmmac: correct clocks enabled in stmmac_vlan_rx_kill_vid()") +Reviewed-by: Jacob Keller +Signed-off-by: Yan Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index a3bd5396c2f87..179f8d196c890 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -6283,6 +6283,10 @@ static int stmmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid + bool is_double = false; + int ret; + ++ ret = pm_runtime_resume_and_get(priv->device); ++ if (ret < 0) ++ return ret; ++ + if (be16_to_cpu(proto) == ETH_P_8021AD) + is_double = true; + +@@ -6290,16 +6294,18 @@ static int stmmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid + ret = stmmac_vlan_update(priv, is_double); + if (ret) { + clear_bit(vid, priv->active_vlans); +- return ret; ++ goto err_pm_put; + } + + if (priv->hw->num_vlan) { + ret = stmmac_add_hw_vlan_rx_fltr(priv, ndev, priv->hw, proto, vid); + if (ret) +- return ret; ++ goto err_pm_put; + } ++err_pm_put: ++ pm_runtime_put(priv->device); + +- return 0; ++ return ret; + } + + static int stmmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vid) +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nf_tables-don-t-write-table-validation-sta.patch b/queue-5.15/netfilter-nf_tables-don-t-write-table-validation-sta.patch new file mode 100644 index 00000000000..4fd888ed373 --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-don-t-write-table-validation-sta.patch @@ -0,0 +1,87 @@ +From 478da41ee21c124e41807082a189bb2a975a5e22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 17:13:19 +0200 +Subject: netfilter: nf_tables: don't write table validation state without + mutex + +From: Florian Westphal + +[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ] + +The ->cleanup callback needs to be removed, this doesn't work anymore as +the transaction mutex is already released in the ->abort function. + +Just do it after a successful validation pass, this either happens +from commit or abort phases where transaction mutex is held. + +Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 1 - + net/netfilter/nf_tables_api.c | 8 ++------ + net/netfilter/nfnetlink.c | 2 -- + 3 files changed, 2 insertions(+), 9 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index 241e005f290ad..e9a9ab34a7ccc 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -45,7 +45,6 @@ struct nfnetlink_subsystem { + int (*commit)(struct net *net, struct sk_buff *skb); + int (*abort)(struct net *net, struct sk_buff *skb, + enum nfnl_abort_action action); +- void (*cleanup)(struct net *net); + bool (*valid_genid)(struct net *net, u32 genid); + }; + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index d950041364d5f..822d13e64b326 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -8360,6 +8360,8 @@ static int nf_tables_validate(struct net *net) + if (nft_table_validate(net, table) < 0) + return -EAGAIN; + } ++ ++ nft_validate_state_update(net, NFT_VALIDATE_SKIP); + break; + } + +@@ -9231,11 +9233,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) + return 0; + } + +-static void nf_tables_cleanup(struct net *net) +-{ +- nft_validate_state_update(net, NFT_VALIDATE_SKIP); +-} +- + static int nf_tables_abort(struct net *net, struct sk_buff *skb, + enum nfnl_abort_action action) + { +@@ -9269,7 +9266,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = { + .cb = nf_tables_cb, + .commit = nf_tables_commit, + .abort = nf_tables_abort, +- .cleanup = nf_tables_cleanup, + .valid_genid = nf_tables_valid_genid, + .owner = THIS_MODULE, + }; +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 2cce4033a70a6..4d7a2a7bbd434 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -585,8 +585,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + goto replay_abort; + } + } +- if (ss->cleanup) +- ss->cleanup(net); + + nfnl_err_deliver(&err_list, oskb); + kfree_skb(skb); +-- +2.39.2 + diff --git a/queue-5.15/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch b/queue-5.15/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch new file mode 100644 index 00000000000..c56cdbec030 --- /dev/null +++ b/queue-5.15/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch @@ -0,0 +1,171 @@ +From 58396c57d995ecc745240bdd75c2fb04c862ad4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 11:52:55 -0700 +Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt(). + +From: Kuniyuki Iwashima + +[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ] + +Brad Spencer provided a detailed report [0] that when calling getsockopt() +for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such +options require at least sizeof(int) as length. + +The options return a flag value that fits into 1 byte, but such behaviour +confuses users who do not initialise the variable before calling +getsockopt() and do not strictly check the returned value as char. + +Currently, netlink_getsockopt() uses put_user() to copy data to optlen and +optval, but put_user() casts the data based on the pointer, char *optval. +As a result, only 1 byte is set to optval. + +To avoid this behaviour, we need to use copy_to_user() or cast optval for +put_user(). + +Note that this changes the behaviour on big-endian systems, but we document +that the size of optval is int in the man page. + + $ man 7 netlink + ... + Socket options + To set or get a netlink socket option, call getsockopt(2) to read + or setsockopt(2) to write the option with the option level argument + set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to + an int. + +Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups") +Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option") +Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag") +Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option") +Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") +Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") +Reported-by: Brad Spencer +Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Johannes Berg +Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 75 ++++++++++++---------------------------- + 1 file changed, 23 insertions(+), 52 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 011ec7d9a719e..84a7a29be49d8 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1752,7 +1752,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct netlink_sock *nlk = nlk_sk(sk); +- int len, val, err; ++ unsigned int flag; ++ int len, val; + + if (level != SOL_NETLINK) + return -ENOPROTOOPT; +@@ -1764,39 +1765,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + + switch (optname) { + case NETLINK_PKTINFO: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_PKTINFO; + break; + case NETLINK_BROADCAST_ERROR: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_BROADCAST_SEND_ERROR; + break; + case NETLINK_NO_ENOBUFS: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_NO_ENOBUFS; + break; + case NETLINK_LIST_MEMBERSHIPS: { +- int pos, idx, shift; ++ int pos, idx, shift, err = 0; + +- err = 0; + netlink_lock_table(); + for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) { + if (len - pos < sizeof(u32)) +@@ -1813,40 +1792,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen)) + err = -EFAULT; + netlink_unlock_table(); +- break; ++ return err; + } + case NETLINK_CAP_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_CAP_ACK; + break; + case NETLINK_EXT_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_EXT_ACK; + break; + case NETLINK_GET_STRICT_CHK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_STRICT_CHK; + break; + default: +- err = -ENOPROTOOPT; ++ return -ENOPROTOOPT; + } +- return err; ++ ++ if (len < sizeof(int)) ++ return -EINVAL; ++ ++ len = sizeof(int); ++ val = nlk->flags & flag ? 1 : 0; ++ ++ if (put_user(len, optlen) || ++ copy_to_user(optval, &val, len)) ++ return -EFAULT; ++ ++ return 0; + } + + static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) +-- +2.39.2 + diff --git a/queue-5.15/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch b/queue-5.15/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch new file mode 100644 index 00000000000..98d9a712a28 --- /dev/null +++ b/queue-5.15/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch @@ -0,0 +1,45 @@ +From 28c3af3084a6e9666c6f43b93e3e76f48265e646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 18:45:53 -0400 +Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease + +From: Trond Myklebust + +[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ] + +The spec requires that we always at least send a RECLAIM_COMPLETE when +we're done establishing the lease and recovering any state. + +Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 7223816bc5d53..15ba6ad1c571f 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -67,6 +67,8 @@ + + #define OPENOWNER_POOL_SIZE 8 + ++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp); ++ + const nfs4_stateid zero_stateid = { + { .data = { 0 } }, + .type = NFS4_SPECIAL_STATEID_TYPE, +@@ -330,6 +332,8 @@ int nfs41_init_clientid(struct nfs_client *clp, const struct cred *cred) + status = nfs4_proc_create_session(clp, cred); + if (status != 0) + goto out; ++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R)) ++ nfs4_state_start_reclaim_reboot(clp); + nfs41_finish_session_reset(clp); + nfs_mark_client_ready(clp, NFS_CS_READY); + out: +-- +2.39.2 + diff --git a/queue-5.15/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch b/queue-5.15/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch new file mode 100644 index 00000000000..4d057e0e07c --- /dev/null +++ b/queue-5.15/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch @@ -0,0 +1,206 @@ +From b5ba810e4a70303fd5c1463c00a945ad68cccc2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 16:49:04 +0800 +Subject: nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} + usage" + +From: Ming Lei + +[ Upstream commit 4f86a6ff6fbd891232dda3ca97fd1b9630b59809 ] + +fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in +which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled. + +So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply +which enables irq unconditionally. + +Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore() + +Fixes: c38dbbfab1bc ("nvme-fcloop: fix inconsistent lock state warnings") +Reported-by: Yi Zhang +Signed-off-by: Ming Lei +Reviewed-by: Ewan D. Milne +Tested-by: Yi Zhang +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 48 ++++++++++++++++++++---------------- + 1 file changed, 27 insertions(+), 21 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 5c16372f3b533..c780af36c1d4a 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -614,10 +614,11 @@ fcloop_fcp_recv_work(struct work_struct *work) + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, fcp_rcv_work); + struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq; ++ unsigned long flags; + int ret = 0; + bool aborted = false; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + switch (tfcp_req->inistate) { + case INI_IO_START: + tfcp_req->inistate = INI_IO_ACTIVE; +@@ -626,11 +627,11 @@ fcloop_fcp_recv_work(struct work_struct *work) + aborted = true; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(aborted)) + ret = -ECANCELED; +@@ -655,8 +656,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + container_of(work, struct fcloop_fcpreq, abort_rcv_work); + struct nvmefc_fcp_req *fcpreq; + bool completed = false; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + switch (tfcp_req->inistate) { + case INI_IO_ABORTED: +@@ -665,11 +667,11 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + completed = true; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(completed)) { + /* remove reference taken in original abort downcall */ +@@ -681,9 +683,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport, + &tfcp_req->tgt_fcp_req); + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->fcpreq = NULL; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED); + /* call_host_done releases reference for abort downcall */ +@@ -699,11 +701,12 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work) + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, tio_done_work); + struct nvmefc_fcp_req *fcpreq; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + tfcp_req->inistate = INI_IO_COMPLETED; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + fcloop_call_host_done(fcpreq, tfcp_req, tfcp_req->status); + } +@@ -807,13 +810,14 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + u32 rsplen = 0, xfrlen = 0; + int fcp_err = 0, active, aborted; + u8 op = tgt_fcpreq->op; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + active = tfcp_req->active; + aborted = tfcp_req->aborted; + tfcp_req->active = true; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(active)) + /* illegal - call while i/o active */ +@@ -821,9 +825,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + + if (unlikely(aborted)) { + /* target transport has aborted i/o prior */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->active = false; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + tgt_fcpreq->transferred_length = 0; + tgt_fcpreq->fcp_error = -ECANCELED; + tgt_fcpreq->done(tgt_fcpreq); +@@ -880,9 +884,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + break; + } + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->active = false; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + tgt_fcpreq->transferred_length = xfrlen; + tgt_fcpreq->fcp_error = fcp_err; +@@ -896,15 +900,16 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport, + struct nvmefc_tgt_fcp_req *tgt_fcpreq) + { + struct fcloop_fcpreq *tfcp_req = tgt_fcp_req_to_fcpreq(tgt_fcpreq); ++ unsigned long flags; + + /* + * mark aborted only in case there were 2 threads in transport + * (one doing io, other doing abort) and only kills ops posted + * after the abort request + */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->aborted = true; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + tfcp_req->status = NVME_SC_INTERNAL; + +@@ -946,6 +951,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + struct fcloop_ini_fcpreq *inireq = fcpreq->private; + struct fcloop_fcpreq *tfcp_req; + bool abortio = true; ++ unsigned long flags; + + spin_lock(&inireq->inilock); + tfcp_req = inireq->tfcp_req; +@@ -958,7 +964,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + return; + + /* break initiator/target relationship for io */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + switch (tfcp_req->inistate) { + case INI_IO_START: + case INI_IO_ACTIVE: +@@ -968,11 +974,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + abortio = false; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (abortio) + /* leave the reference while the work item is scheduled */ +-- +2.39.2 + diff --git a/queue-5.15/nvme-fix-async-event-trace-event.patch b/queue-5.15/nvme-fix-async-event-trace-event.patch new file mode 100644 index 00000000000..385909bd94e --- /dev/null +++ b/queue-5.15/nvme-fix-async-event-trace-event.patch @@ -0,0 +1,92 @@ +From 77151e09e99503ff0d6e42bbe642c6acdbac1a0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:57:20 -0700 +Subject: nvme: fix async event trace event + +From: Keith Busch + +[ Upstream commit 6622b76fe922b94189499a90ccdb714a4a8d0773 ] + +Mixing AER Event Type and Event Info has masking clashes. Just print the +event type, but also include the event info of the AER result in the +trace. + +Fixes: 09bd1ff4b15143b ("nvme-core: add async event trace helper") +Reported-by: Nate Thornton +Reviewed-by: Sagi Grimberg +Reviewed-by: Minwoo Im +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +---- + drivers/nvme/host/trace.h | 15 ++++++--------- + 2 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 2ad1e4acc0d6b..e5318b38c6624 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4374,8 +4374,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + { + u32 aer_notice_type = nvme_aer_subtype(result); + +- trace_nvme_async_event(ctrl, aer_notice_type); +- + switch (aer_notice_type) { + case NVME_AER_NOTICE_NS_CHANGED: + set_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events); +@@ -4407,7 +4405,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + + static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl) + { +- trace_nvme_async_event(ctrl, NVME_AER_ERROR); + dev_warn(ctrl->device, "resetting controller due to AER\n"); + nvme_reset_ctrl(ctrl); + } +@@ -4422,6 +4419,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS) + return; + ++ trace_nvme_async_event(ctrl, result); + switch (aer_type) { + case NVME_AER_NOTICE: + nvme_handle_aen_notice(ctrl, result); +@@ -4439,7 +4437,6 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + case NVME_AER_SMART: + case NVME_AER_CSS: + case NVME_AER_VS: +- trace_nvme_async_event(ctrl, aer_type); + ctrl->aen_result = result; + break; + default: +diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h +index aa8b0f86b2be1..b258f7b8788e1 100644 +--- a/drivers/nvme/host/trace.h ++++ b/drivers/nvme/host/trace.h +@@ -127,15 +127,12 @@ TRACE_EVENT(nvme_async_event, + ), + TP_printk("nvme%d: NVME_AEN=%#08x [%s]", + __entry->ctrl_id, __entry->result, +- __print_symbolic(__entry->result, +- aer_name(NVME_AER_NOTICE_NS_CHANGED), +- aer_name(NVME_AER_NOTICE_ANA), +- aer_name(NVME_AER_NOTICE_FW_ACT_STARTING), +- aer_name(NVME_AER_NOTICE_DISC_CHANGED), +- aer_name(NVME_AER_ERROR), +- aer_name(NVME_AER_SMART), +- aer_name(NVME_AER_CSS), +- aer_name(NVME_AER_VS)) ++ __print_symbolic(__entry->result & 0x7, ++ aer_name(NVME_AER_ERROR), ++ aer_name(NVME_AER_SMART), ++ aer_name(NVME_AER_NOTICE), ++ aer_name(NVME_AER_CSS), ++ aer_name(NVME_AER_VS)) + ) + ); + +-- +2.39.2 + diff --git a/queue-5.15/nvme-handle-the-persistent-internal-error-aer.patch b/queue-5.15/nvme-handle-the-persistent-internal-error-aer.patch new file mode 100644 index 00000000000..3a7323e7928 --- /dev/null +++ b/queue-5.15/nvme-handle-the-persistent-internal-error-aer.patch @@ -0,0 +1,113 @@ +From f3f0d20f1851c956382e85cc45aa289b2b8059df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 11:52:21 -0700 +Subject: nvme: handle the persistent internal error AER + +From: Michael Kelley + +[ Upstream commit 2c61c97fb12b806e1c8eb15f04c277ad097ec95e ] + +In the NVM Express Revision 1.4 spec, Figure 145 describes possible +values for an AER with event type "Error" (value 000b). For a +Persistent Internal Error (value 03h), the host should perform a +controller reset. + +Add support for this error using code that already exists for +doing a controller reset. As part of this support, introduce +two utility functions for parsing the AER type and subtype. + +This new support was tested in a lab environment where we can +generate the persistent internal error on demand, and observe +both the Linux side and NVMe controller side to see that the +controller reset has been done. + +Signed-off-by: Michael Kelley +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Stable-dep-of: 6622b76fe922 ("nvme: fix async event trace event") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 31 +++++++++++++++++++++++++++++-- + include/linux/nvme.h | 4 ++++ + 2 files changed, 33 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index ef9d7a795b007..2ad1e4acc0d6b 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4360,9 +4360,19 @@ static void nvme_fw_act_work(struct work_struct *work) + nvme_get_fw_slot_info(ctrl); + } + ++static u32 nvme_aer_type(u32 result) ++{ ++ return result & 0x7; ++} ++ ++static u32 nvme_aer_subtype(u32 result) ++{ ++ return (result & 0xff00) >> 8; ++} ++ + static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + { +- u32 aer_notice_type = (result & 0xff00) >> 8; ++ u32 aer_notice_type = nvme_aer_subtype(result); + + trace_nvme_async_event(ctrl, aer_notice_type); + +@@ -4395,11 +4405,19 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + } + } + ++static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl) ++{ ++ trace_nvme_async_event(ctrl, NVME_AER_ERROR); ++ dev_warn(ctrl->device, "resetting controller due to AER\n"); ++ nvme_reset_ctrl(ctrl); ++} ++ + void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + volatile union nvme_result *res) + { + u32 result = le32_to_cpu(res->u32); +- u32 aer_type = result & 0x07; ++ u32 aer_type = nvme_aer_type(result); ++ u32 aer_subtype = nvme_aer_subtype(result); + + if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS) + return; +@@ -4409,6 +4427,15 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + nvme_handle_aen_notice(ctrl, result); + break; + case NVME_AER_ERROR: ++ /* ++ * For a persistent internal error, don't run async_event_work ++ * to submit a new AER. The controller reset will do it. ++ */ ++ if (aer_subtype == NVME_AER_ERROR_PERSIST_INT_ERR) { ++ nvme_handle_aer_persistent_error(ctrl); ++ return; ++ } ++ fallthrough; + case NVME_AER_SMART: + case NVME_AER_CSS: + case NVME_AER_VS: +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index de235916c31c2..461ee0ee59fe4 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -613,6 +613,10 @@ enum { + NVME_AER_VS = 7, + }; + ++enum { ++ NVME_AER_ERROR_PERSIST_INT_ERR = 0x03, ++}; ++ + enum { + NVME_AER_NOTICE_NS_CHANGED = 0x00, + NVME_AER_NOTICE_FW_ACT_STARTING = 0x01, +-- +2.39.2 + diff --git a/queue-5.15/nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch b/queue-5.15/nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch new file mode 100644 index 00000000000..b3c9311afbb --- /dev/null +++ b/queue-5.15/nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch @@ -0,0 +1,86 @@ +From cda19056669d2cc6f083c1eb4361b36d6fe0a4b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 15:20:36 +0900 +Subject: nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() + +From: Damien Le Moal + +[ Upstream commit ab76e7206b672b2e8818cb121a04506956d6b223 ] + +Nvme specifications state that: + +If the I/O Command Set associated with the namespace identified by the +NSID field does not support the Identify Namespace data structure +specified by the CSI field, the controller shall abort the command with +a status code of Invalid Field in Command. + +In other words, if nvmet_execute_identify_cns_cs_ns() is called for a +target with a block device that is not zoned, we should not return any +data and set the status to NVME_SC_INVALID_FIELD. + +While at it, it is also better to revalidate the ns block devie *before* +checking if the block device is zoned, to ensure that +nvmet_execute_identify_cns_cs_ns() operates against updated device +characteristics. + +Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") +Signed-off-by: Damien Le Moal +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/zns.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c +index ad608bd6515a7..f4f8598cbdc15 100644 +--- a/drivers/nvme/target/zns.c ++++ b/drivers/nvme/target/zns.c +@@ -97,7 +97,7 @@ void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req) + + void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + { +- struct nvme_id_ns_zns *id_zns; ++ struct nvme_id_ns_zns *id_zns = NULL; + u64 zsze; + u16 status; + u32 mar, mor; +@@ -118,16 +118,18 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + if (status) + goto done; + +- if (!bdev_is_zoned(req->ns->bdev)) { +- req->error_loc = offsetof(struct nvme_identify, nsid); +- goto done; +- } +- + if (nvmet_ns_revalidate(req->ns)) { + mutex_lock(&req->ns->subsys->lock); + nvmet_ns_changed(req->ns->subsys, req->ns->nsid); + mutex_unlock(&req->ns->subsys->lock); + } ++ ++ if (!bdev_is_zoned(req->ns->bdev)) { ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; ++ req->error_loc = offsetof(struct nvme_identify, nsid); ++ goto out; ++ } ++ + zsze = (bdev_zone_sectors(req->ns->bdev) << 9) >> + req->ns->blksize_shift; + id_zns->lbafe[0].zsze = cpu_to_le64(zsze); +@@ -148,8 +150,8 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + + done: + status = nvmet_copy_to_sgl(req, 0, id_zns, sizeof(*id_zns)); +- kfree(id_zns); + out: ++ kfree(id_zns); + nvmet_req_complete(req, status); + } + +-- +2.39.2 + diff --git a/queue-5.15/nvmet-fix-i-o-command-set-specific-identify-controll.patch b/queue-5.15/nvmet-fix-i-o-command-set-specific-identify-controll.patch new file mode 100644 index 00000000000..4c1f94b18c2 --- /dev/null +++ b/queue-5.15/nvmet-fix-i-o-command-set-specific-identify-controll.patch @@ -0,0 +1,115 @@ +From ace86a66837dc37250140b39bdf124070dc10383 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:38 +0900 +Subject: nvmet: fix I/O Command Set specific Identify Controller + +From: Damien Le Moal + +[ Upstream commit a5a6ab0950b46ab1ef4a5c83c80234018b81b38a ] + +For an identify command with cns set to NVME_ID_CNS_CS_CTRL, the NVMe +2.0 specification states that: + +If the I/O Command Set specified by the CSI field does not have an +Identify Controller data structure, then the controller shall return +a zero filled data structure. If the host requests a data structure for +an I/O Command Set that the controller does not support, the controller +shall abort the command with a status code of Invalid Field in Command. + +However, the current implementation of this identify command in +nvmet_execute_identify() only handles the ZNS command set, returning an +error for the NVM command set, which is not compliant with the +specifications as we do support this command set. + +Fix this by: +1) Renaming nvmet_execute_identify_cns_cs_ctrl() to + nvmet_execute_identify_ctrl_zns() to continue handling the + ZNS command set as is. +2) Introduce a nvmet_execute_identify_ctrl_ns() helper to handle the + NVM command set, returning a zero filled nvme_id_ctrl_nvm data + structure. +3) Modify nvmet_execute_identify() to call these helpers based on + the csi specified, returning an error for unsupported command sets. + +Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 22 ++++++++++++++++------ + drivers/nvme/target/nvmet.h | 2 +- + drivers/nvme/target/zns.c | 2 +- + 3 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 2b8227259786c..ec13f568785e5 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -680,6 +680,13 @@ static bool nvmet_handle_identify_desclist(struct nvmet_req *req) + } + } + ++static void nvmet_execute_identify_ctrl_nvm(struct nvmet_req *req) ++{ ++ /* Not supported: return zeroes */ ++ nvmet_req_complete(req, ++ nvmet_zero_sgl(req, 0, sizeof(struct nvme_id_ctrl_nvm))); ++} ++ + static void nvmet_execute_identify(struct nvmet_req *req) + { + if (!nvmet_check_transfer_len(req, NVME_IDENTIFY_DATA_SIZE)) +@@ -703,13 +710,16 @@ static void nvmet_execute_identify(struct nvmet_req *req) + nvmet_execute_identify_ctrl(req); + return; + case NVME_ID_CNS_CS_CTRL: +- if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { +- switch (req->cmd->identify.csi) { +- case NVME_CSI_ZNS: +- return nvmet_execute_identify_cns_cs_ctrl(req); +- default: +- break; ++ switch (req->cmd->identify.csi) { ++ case NVME_CSI_NVM: ++ nvmet_execute_identify_ctrl_nvm(req); ++ return; ++ case NVME_CSI_ZNS: ++ if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { ++ nvmet_execute_identify_ctrl_zns(req); ++ return; + } ++ break; + } + break; + case NVME_ID_CNS_NS_ACTIVE_LIST: +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index abb5e78ab8919..17dd845514588 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -547,7 +547,7 @@ bool nvmet_ns_revalidate(struct nvmet_ns *ns); + u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts); + + bool nvmet_bdev_zns_enable(struct nvmet_ns *ns); +-void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req); ++void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req); + void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req); + void nvmet_bdev_execute_zone_mgmt_recv(struct nvmet_req *req); + void nvmet_bdev_execute_zone_mgmt_send(struct nvmet_req *req); +diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c +index f4f8598cbdc15..ae617d66b1378 100644 +--- a/drivers/nvme/target/zns.c ++++ b/drivers/nvme/target/zns.c +@@ -70,7 +70,7 @@ bool nvmet_bdev_zns_enable(struct nvmet_ns *ns) + return true; + } + +-void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req) ++void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req) + { + u8 zasl = req->sq->ctrl->subsys->zasl; + struct nvmet_ctrl *ctrl = req->sq->ctrl; +-- +2.39.2 + diff --git a/queue-5.15/nvmet-fix-identify-active-namespace-id-list-handling.patch b/queue-5.15/nvmet-fix-identify-active-namespace-id-list-handling.patch new file mode 100644 index 00000000000..e204446a5c0 --- /dev/null +++ b/queue-5.15/nvmet-fix-identify-active-namespace-id-list-handling.patch @@ -0,0 +1,48 @@ +From 17979aad6363e5cd3f03e391ed5c5769690f09cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:37 +0900 +Subject: nvmet: fix Identify Active Namespace ID list handling + +From: Damien Le Moal + +[ Upstream commit 97416f67d55fb8b866ff1815ca7ef26b6dfa6a5e ] + +The identify command with cns set to NVME_ID_CNS_NS_ACTIVE_LIST does +not depend on the command set. The execution of this command should +thus not look at the csi field specified in the command. Simplify +nvmet_execute_identify() to directly call +nvmet_execute_identify_nslist() without the csi switch-case. + +Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 0638be507a645..2b8227259786c 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -713,13 +713,8 @@ static void nvmet_execute_identify(struct nvmet_req *req) + } + break; + case NVME_ID_CNS_NS_ACTIVE_LIST: +- switch (req->cmd->identify.csi) { +- case NVME_CSI_NVM: +- return nvmet_execute_identify_nslist(req); +- default: +- break; +- } +- break; ++ nvmet_execute_identify_nslist(req); ++ return; + case NVME_ID_CNS_NS_DESC_LIST: + if (nvmet_handle_identify_desclist(req) == true) + return; +-- +2.39.2 + diff --git a/queue-5.15/nvmet-fix-identify-controller-handling.patch b/queue-5.15/nvmet-fix-identify-controller-handling.patch new file mode 100644 index 00000000000..51b4265806d --- /dev/null +++ b/queue-5.15/nvmet-fix-identify-controller-handling.patch @@ -0,0 +1,45 @@ +From 9a22bbc052f58e23a51ae3a09962163b6fd1b846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:36 +0900 +Subject: nvmet: fix Identify Controller handling + +From: Damien Le Moal + +[ Upstream commit 62904b3b333e7f3c0f879dc3513295eee5765c9f ] + +The identify command with cns set to NVME_ID_CNS_CTRL does not depend on +the command set. The execution of this command should thus not look at +the csi specified in the command. Simplify nvmet_execute_identify() to +directly call nvmet_execute_identify_ctrl() without the csi switch-case. + +Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 4911de26d7343..0638be507a645 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -700,11 +700,8 @@ static void nvmet_execute_identify(struct nvmet_req *req) + } + break; + case NVME_ID_CNS_CTRL: +- switch (req->cmd->identify.csi) { +- case NVME_CSI_NVM: +- return nvmet_execute_identify_ctrl(req); +- } +- break; ++ nvmet_execute_identify_ctrl(req); ++ return; + case NVME_ID_CNS_CS_CTRL: + if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { + switch (req->cmd->identify.csi) { +-- +2.39.2 + diff --git a/queue-5.15/nvmet-fix-identify-namespace-handling.patch b/queue-5.15/nvmet-fix-identify-namespace-handling.patch new file mode 100644 index 00000000000..ac727ff6125 --- /dev/null +++ b/queue-5.15/nvmet-fix-identify-namespace-handling.patch @@ -0,0 +1,56 @@ +From 5219c70f05b8dd1d26663eda10d48243b6b4dd50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:35 +0900 +Subject: nvmet: fix Identify Namespace handling + +From: Damien Le Moal + +[ Upstream commit 8c098aa00118c35108f0c19bd3cdc45e11574948 ] + +The identify command with cns set to NVME_ID_CNS_NS does not directly +depend on the command set. The NVMe specifications is rather confusing +here as it appears that this command only applies to the NVM command +set. However, footnote 8 of Figure 273 in the NVMe 2.0 base +specifications clearly state that this command applies to NVM command +sets that support logical blocks, that is, NVM and ZNS. Both the NVM and +ZNS command set specifications also list this identify as mandatory. + +The command handling should thus not look at the csi field since it is +defined as unused for this command. Given that we do not support the +KV command set, simply remove the csi switch-case for that command +handling and call directly nvmet_execute_identify_ns() in +nvmet_execute_identify(). + +Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index da873a7f8ff90..4911de26d7343 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -687,13 +687,8 @@ static void nvmet_execute_identify(struct nvmet_req *req) + + switch (req->cmd->identify.cns) { + case NVME_ID_CNS_NS: +- switch (req->cmd->identify.csi) { +- case NVME_CSI_NVM: +- return nvmet_execute_identify_ns(req); +- default: +- break; +- } +- break; ++ nvmet_execute_identify_ns(req); ++ return; + case NVME_ID_CNS_CS_NS: + if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { + switch (req->cmd->identify.csi) { +-- +2.39.2 + diff --git a/queue-5.15/nvmet-move-the-call-to-nvmet_ns_changed-out-of-nvmet.patch b/queue-5.15/nvmet-move-the-call-to-nvmet_ns_changed-out-of-nvmet.patch new file mode 100644 index 00000000000..dd40ea9eb4a --- /dev/null +++ b/queue-5.15/nvmet-move-the-call-to-nvmet_ns_changed-out-of-nvmet.patch @@ -0,0 +1,123 @@ +From 5192c9e5e9ada097b7505ab513347fdc15a77c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 08:13:04 +0100 +Subject: nvmet: move the call to nvmet_ns_changed out of nvmet_ns_revalidate + +From: Christoph Hellwig + +[ Upstream commit da7837339641601f202f27515771dc0646083938 ] + +nvmet_ns_changed states via lockdep that the ns->subsys->lock must be +held. The only caller of nvmet_ns_changed which does not acquire that +lock is nvmet_ns_revalidate. nvmet_ns_revalidate has 3 callers, +of which 2 do not acquire that lock: nvmet_execute_identify_cns_cs_ns +and nvmet_execute_identify_ns. The other caller +nvmet_ns_revalidate_size_store does acquire the lock. + +Move the call to nvmet_ns_changed from nvmet_ns_revalidate to the callers +so that they can perform the correct locking as needed. + +This issue was found using a static type-based analyser and manually +verified. + +Reported-by: Niels Dossche +Signed-off-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Stable-dep-of: ab76e7206b67 ("nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns()") +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 6 +++++- + drivers/nvme/target/configfs.c | 3 ++- + drivers/nvme/target/core.c | 5 ++--- + drivers/nvme/target/nvmet.h | 2 +- + drivers/nvme/target/zns.c | 6 +++++- + 5 files changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index bf78c58ed41d4..da873a7f8ff90 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -508,7 +508,11 @@ static void nvmet_execute_identify_ns(struct nvmet_req *req) + goto done; + } + +- nvmet_ns_revalidate(req->ns); ++ if (nvmet_ns_revalidate(req->ns)) { ++ mutex_lock(&req->ns->subsys->lock); ++ nvmet_ns_changed(req->ns->subsys, req->ns->nsid); ++ mutex_unlock(&req->ns->subsys->lock); ++ } + + /* + * nuse = ncap = nsze isn't always true, but we have no way to find +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 625038057a762..5bdc3ba51f7ef 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -586,7 +586,8 @@ static ssize_t nvmet_ns_revalidate_size_store(struct config_item *item, + mutex_unlock(&ns->subsys->lock); + return -EINVAL; + } +- nvmet_ns_revalidate(ns); ++ if (nvmet_ns_revalidate(ns)) ++ nvmet_ns_changed(ns->subsys, ns->nsid); + mutex_unlock(&ns->subsys->lock); + return count; + } +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 4c6d56dd29adc..2c44d5a95c8d6 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -535,7 +535,7 @@ static void nvmet_p2pmem_ns_add_p2p(struct nvmet_ctrl *ctrl, + ns->nsid); + } + +-void nvmet_ns_revalidate(struct nvmet_ns *ns) ++bool nvmet_ns_revalidate(struct nvmet_ns *ns) + { + loff_t oldsize = ns->size; + +@@ -544,8 +544,7 @@ void nvmet_ns_revalidate(struct nvmet_ns *ns) + else + nvmet_file_ns_revalidate(ns); + +- if (oldsize != ns->size) +- nvmet_ns_changed(ns->subsys, ns->nsid); ++ return oldsize != ns->size; + } + + int nvmet_ns_enable(struct nvmet_ns *ns) +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index f3e42d2c85c6c..abb5e78ab8919 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -543,7 +543,7 @@ u16 nvmet_file_flush(struct nvmet_req *req); + void nvmet_ns_changed(struct nvmet_subsys *subsys, u32 nsid); + void nvmet_bdev_ns_revalidate(struct nvmet_ns *ns); + void nvmet_file_ns_revalidate(struct nvmet_ns *ns); +-void nvmet_ns_revalidate(struct nvmet_ns *ns); ++bool nvmet_ns_revalidate(struct nvmet_ns *ns); + u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts); + + bool nvmet_bdev_zns_enable(struct nvmet_ns *ns); +diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c +index 1466698751c55..ad608bd6515a7 100644 +--- a/drivers/nvme/target/zns.c ++++ b/drivers/nvme/target/zns.c +@@ -123,7 +123,11 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + goto done; + } + +- nvmet_ns_revalidate(req->ns); ++ if (nvmet_ns_revalidate(req->ns)) { ++ mutex_lock(&req->ns->subsys->lock); ++ nvmet_ns_changed(req->ns->subsys, req->ns->nsid); ++ mutex_unlock(&req->ns->subsys->lock); ++ } + zsze = (bdev_zone_sectors(req->ns->bdev) << 9) >> + req->ns->blksize_shift; + id_zns->lbafe[0].zsze = cpu_to_le64(zsze); +-- +2.39.2 + diff --git a/queue-5.15/nvmet-use-i_size_read-to-set-size-for-file-ns.patch b/queue-5.15/nvmet-use-i_size_read-to-set-size-for-file-ns.patch new file mode 100644 index 00000000000..be08ea2a4ae --- /dev/null +++ b/queue-5.15/nvmet-use-i_size_read-to-set-size-for-file-ns.patch @@ -0,0 +1,85 @@ +From 15600ec4dec5e820c78b7067c9b7d88f7b4e65b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Feb 2022 01:04:44 -0800 +Subject: nvmet: use i_size_read() to set size for file-ns + +From: Chaitanya Kulkarni + +[ Upstream commit 2caecd62ea5160803b25d96cb1a14ce755c2c259 ] + +Instead of calling vfs_getattr() use i_size_read() to read the size of +file so we can read the size of not only file type but also block type +with one call. This is needed to implement buffered_io support for the +NVMeOF block device backend. + +We also change return type of function nvmet_file_ns_revalidate() from +int to void, since this function does not return any meaning value. + +Signed-off-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Stable-dep-of: ab76e7206b67 ("nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns()") +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/io-cmd-file.c | 17 ++++------------- + drivers/nvme/target/nvmet.h | 2 +- + 2 files changed, 5 insertions(+), 14 deletions(-) + +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index eadba13b276de..098b6bf12cd0a 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -13,16 +13,9 @@ + + #define NVMET_MIN_MPOOL_OBJ 16 + +-int nvmet_file_ns_revalidate(struct nvmet_ns *ns) ++void nvmet_file_ns_revalidate(struct nvmet_ns *ns) + { +- struct kstat stat; +- int ret; +- +- ret = vfs_getattr(&ns->file->f_path, &stat, STATX_SIZE, +- AT_STATX_FORCE_SYNC); +- if (!ret) +- ns->size = stat.size; +- return ret; ++ ns->size = i_size_read(ns->file->f_mapping->host); + } + + void nvmet_file_ns_disable(struct nvmet_ns *ns) +@@ -40,7 +33,7 @@ void nvmet_file_ns_disable(struct nvmet_ns *ns) + int nvmet_file_ns_enable(struct nvmet_ns *ns) + { + int flags = O_RDWR | O_LARGEFILE; +- int ret; ++ int ret = 0; + + if (!ns->buffered_io) + flags |= O_DIRECT; +@@ -54,9 +47,7 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns) + return ret; + } + +- ret = nvmet_file_ns_revalidate(ns); +- if (ret) +- goto err; ++ nvmet_file_ns_revalidate(ns); + + /* + * i_blkbits can be greater than the universally accepted upper bound, +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index fdb06a9d430d2..f3e42d2c85c6c 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -542,7 +542,7 @@ u16 nvmet_bdev_flush(struct nvmet_req *req); + u16 nvmet_file_flush(struct nvmet_req *req); + void nvmet_ns_changed(struct nvmet_subsys *subsys, u32 nsid); + void nvmet_bdev_ns_revalidate(struct nvmet_ns *ns); +-int nvmet_file_ns_revalidate(struct nvmet_ns *ns); ++void nvmet_file_ns_revalidate(struct nvmet_ns *ns); + void nvmet_ns_revalidate(struct nvmet_ns *ns); + u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts); + +-- +2.39.2 + diff --git a/queue-5.15/of-fix-modalias-string-generation.patch b/queue-5.15/of-fix-modalias-string-generation.patch new file mode 100644 index 00000000000..e0b070ebd32 --- /dev/null +++ b/queue-5.15/of-fix-modalias-string-generation.patch @@ -0,0 +1,80 @@ +From 77a7897969bf4f6e5aed4b8bbe7b25b34da92588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 18:21:09 +0100 +Subject: of: Fix modalias string generation + +From: Miquel Raynal + +[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ] + +The helper generating an OF based modalias (of_device_get_modalias()) +works fine, but due to the use of snprintf() internally it needs a +buffer one byte longer than what should be needed just for the entire +string (excluding the '\0'). Most users of this helper are sysfs hooks +providing the modalias string to users. They all provide a PAGE_SIZE +buffer which is way above the number of bytes required to fit the +modalias string and hence do not suffer from this issue. + +There is another user though, of_device_request_module(), which is only +called by drivers/usb/common/ulpi.c. This request module function is +faulty, but maybe because in most cases there is an alternative, ULPI +driver users have not noticed it. + +In this function, of_device_get_modalias() is called twice. The first +time without buffer just to get the number of bytes required by the +modalias string (excluding the null byte), and a second time, after +buffer allocation, to fill the buffer. The allocation asks for an +additional byte, in order to store the trailing '\0'. However, the +buffer *length* provided to of_device_get_modalias() excludes this extra +byte. The internal use of snprintf() with a length that is exactly the +number of bytes to be written has the effect of using the last available +byte to store a '\0', which then smashes the last character of the +modalias string. + +Provide the actual size of the buffer to of_device_get_modalias() to fix +this issue. + +Note: the "str[size - 1] = '\0';" line is not really needed as snprintf +will anyway end the string with a null byte, but there is a possibility +that this function might be called on a struct device_node without +compatible, in this case snprintf() would not be executed. So we keep it +just to avoid possible unbounded strings. + +Cc: Stephen Boyd +Cc: Peter Chen +Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") +Signed-off-by: Miquel Raynal +Reviewed-by: Rob Herring +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/of/device.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 45335fe523f7d..19c42a9dcba91 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -290,12 +290,15 @@ int of_device_request_module(struct device *dev) + if (size < 0) + return size; + +- str = kmalloc(size + 1, GFP_KERNEL); ++ /* Reserve an additional byte for the trailing '\0' */ ++ size++; ++ ++ str = kmalloc(size, GFP_KERNEL); + if (!str) + return -ENOMEM; + + of_device_get_modalias(dev, str, size); +- str[size] = '\0'; ++ str[size - 1] = '\0'; + ret = request_module(str); + kfree(str); + +-- +2.39.2 + diff --git a/queue-5.15/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch b/queue-5.15/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch new file mode 100644 index 00000000000..dc6528aac8c --- /dev/null +++ b/queue-5.15/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch @@ -0,0 +1,56 @@ +From 287c8d027903e48e3770bb0a5f8c4b2495e78d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 19:14:06 +0900 +Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions + +From: Stafford Horne + +[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ] + +In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on +exception") the unhandled exception path was changed to do an early +store of r30 instead of r31. The entry code was not updated and r31 is +not getting stored to pt_regs. + +This patch updates the entry handler to store r31 instead of r30. We +also remove some misleading commented out store r30 and r31 +instructrions. + +I noticed this while working on adding floating point exception +handling, This issue probably would never impact anything since we kill +the process or Oops right away on unhandled exceptions. + +Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/entry.S | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index c68f3349c1741..d32906e89aafd 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -173,7 +173,6 @@ handler: ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ + /* r30 already save */ ;\ +-/* l.sw PT_GPR30(r1),r30*/ ;\ + l.sw PT_GPR31(r1),r31 ;\ + TRACE_IRQS_OFF_ENTRY ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ +@@ -211,9 +210,8 @@ handler: ;\ + l.sw PT_GPR27(r1),r27 ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ +- /* r31 already saved */ ;\ +- l.sw PT_GPR30(r1),r30 ;\ +-/* l.sw PT_GPR31(r1),r31 */ ;\ ++ /* r30 already saved */ ;\ ++ l.sw PT_GPR31(r1),r31 ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ + l.addi r30,r0,-1 ;\ + l.sw PT_ORIG_GPR11(r1),r30 ;\ +-- +2.39.2 + diff --git a/queue-5.15/pci-edr-clear-device-status-after-edr-error-recovery.patch b/queue-5.15/pci-edr-clear-device-status-after-edr-error-recovery.patch new file mode 100644 index 00000000000..175a480c41c --- /dev/null +++ b/queue-5.15/pci-edr-clear-device-status-after-edr-error-recovery.patch @@ -0,0 +1,56 @@ +From 03fdf911d269bdbb680c7460c3db243030b67dd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 16:54:49 -0700 +Subject: PCI/EDR: Clear Device Status after EDR error recovery + +From: Kuppuswamy Sathyanarayanan + +[ Upstream commit c441b1e03da6c680a3e12da59c554f454f2ccf5e ] + +During EDR recovery, the OS must clear error status of the port that +triggered DPC even if firmware retains control of DPC and AER (see the +implementation note in the PCI Firmware spec r3.3, sec 4.6.12). + +Prior to 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if +OS owns AER"), the port Device Status was cleared in this path: + + edr_handle_event + dpc_process_error(dev) # "dev" triggered DPC + pcie_do_recovery(dev, dpc_reset_link) + dpc_reset_link # exit DPC + pcie_clear_device_status(dev) # clear Device Status + +After 068c29a248b6, pcie_do_recovery() no longer clears Device Status when +firmware controls AER, so the error bit remains set even after recovery. + +Per the "Downstream Port Containment configuration control" bit in the +returned _OSC Control Field (sec 4.5.1), the OS is allowed to clear error +status until it evaluates _OST, so clear Device Status in +edr_handle_event() if the error recovery was successful. + +[bhelgaas: commit log] +Fixes: 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if OS owns AER") +Link: https://lore.kernel.org/r/20230315235449.1279209-1-sathyanarayanan.kuppuswamy@linux.intel.com +Reported-by: Tsaur Erwin +Signed-off-by: Kuppuswamy Sathyanarayanan +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/edr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/pcie/edr.c b/drivers/pci/pcie/edr.c +index a6b9b479b97ad..87734e4c3c204 100644 +--- a/drivers/pci/pcie/edr.c ++++ b/drivers/pci/pcie/edr.c +@@ -193,6 +193,7 @@ static void edr_handle_event(acpi_handle handle, u32 event, void *data) + */ + if (estate == PCI_ERS_RESULT_RECOVERED) { + pci_dbg(edev, "DPC port successfully recovered\n"); ++ pcie_clear_device_status(edev); + acpi_send_edr_status(pdev, edev, EDR_OST_SUCCESS); + } else { + pci_dbg(edev, "DPC port recovery failed\n"); +-- +2.39.2 + diff --git a/queue-5.15/pci-imx6-install-the-fault-handler-only-on-compatibl.patch b/queue-5.15/pci-imx6-install-the-fault-handler-only-on-compatibl.patch new file mode 100644 index 00000000000..50da0ae97e8 --- /dev/null +++ b/queue-5.15/pci-imx6-install-the-fault-handler-only-on-compatibl.patch @@ -0,0 +1,78 @@ +From 954b18ee7143ea0f61b6366c3033b767e24716d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 17:56:31 +0100 +Subject: PCI: imx6: Install the fault handler only on compatible match + +From: H. Nikolaus Schaller + +[ Upstream commit 5f5ac460dfe7f4e11f99de9870f240e39189cf72 ] + +commit bb38919ec56e ("PCI: imx6: Add support for i.MX6 PCIe controller") +added a fault hook to this driver in the probe function. So it was only +installed if needed. + +commit bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO") +moved it from probe to driver init which installs the hook unconditionally +as soon as the driver is compiled into a kernel. + +When this driver is compiled as a module, the hook is not registered +until after the driver has been matched with a .compatible and +loaded. + +commit 415b6185c541 ("PCI: imx6: Fix config read timeout handling") +extended the fault handling code. + +commit 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +added some protection for non-ARM architectures, but this does not +protect non-i.MX ARM architectures. + +Since fault handlers can be triggered on any architecture for different +reasons, there is no guarantee that they will be triggered only for the +assumed situation, leading to improper error handling (i.MX6-specific +imx6q_pcie_abort_handler) on foreign systems. + +I had seen strange L3 imprecise external abort messages several times on +OMAP4 and OMAP5 devices and couldn't make sense of them until I realized +they were related to this unused imx6q driver because I had +CONFIG_PCI_IMX6=y. + +Note that CONFIG_PCI_IMX6=y is useful for kernel binaries that are designed +to run on different ARM SoC and be differentiated only by device tree +binaries. So turning off CONFIG_PCI_IMX6 is not a solution. + +Therefore we check the compatible in the init function before registering +the fault handler. + +Link: https://lore.kernel.org/r/e1bcfc3078c82b53aa9b78077a89955abe4ea009.1678380991.git.hns@goldelico.com +Fixes: bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO") +Fixes: 415b6185c541 ("PCI: imx6: Fix config read timeout handling") +Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Richard Zhu +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 67dbf9d88d222..6a3336f2105b8 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1258,6 +1258,13 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, 0xabcd, + static int __init imx6_pcie_init(void) + { + #ifdef CONFIG_ARM ++ struct device_node *np; ++ ++ np = of_find_matching_node(NULL, imx6_pcie_of_match); ++ if (!np) ++ return -ENODEV; ++ of_node_put(np); ++ + /* + * Since probe() can be deferred we need to make sure that + * hook_fault_code is not called after __init memory is freed +-- +2.39.2 + diff --git a/queue-5.15/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch b/queue-5.15/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch new file mode 100644 index 00000000000..c247117db03 --- /dev/null +++ b/queue-5.15/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch @@ -0,0 +1,51 @@ +From 4a1cf9f81ed414a8c75dadd5df6a239327dbce96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 10:35:08 +0800 +Subject: perf/core: Fix hardlockup failure caused by perf throttle + +From: Yang Jihong + +[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ] + +commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling") +introduces a change in throttling threshold judgment. Before this, +compare hwc->interrupts and max_samples_per_tick, then increase +hwc->interrupts by 1, but this commit reverses order of these two +behaviors, causing the semantics of max_samples_per_tick to change. +In literal sense of "max_samples_per_tick", if hwc->interrupts == +max_samples_per_tick, it should not be throttled, therefore, the judgment +condition should be changed to "hwc->interrupts > max_samples_per_tick". + +In fact, this may cause the hardlockup to fail, The minimum value of +max_samples_per_tick may be 1, in this case, the return value of +__perf_event_account_interrupt function is 1. +As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86 +architecture as an example, see x86_pmu_handle_irq). + +Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling") +Signed-off-by: Yang Jihong +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index dc57835e70966..97052b2dff7ea 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9271,8 +9271,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) + hwc->interrupts = 1; + } else { + hwc->interrupts++; +- if (unlikely(throttle +- && hwc->interrupts >= max_samples_per_tick)) { ++ if (unlikely(throttle && ++ hwc->interrupts > max_samples_per_tick)) { + __this_cpu_inc(perf_throttled_count); + tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS); + hwc->interrupts = MAX_INTERRUPTS; +-- +2.39.2 + diff --git a/queue-5.15/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch b/queue-5.15/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch new file mode 100644 index 00000000000..3703e721305 --- /dev/null +++ b/queue-5.15/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch @@ -0,0 +1,47 @@ +From 3a9d2a44f3873df8f5d198b0119117e5d40155ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 19:16:34 +0800 +Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for + usb2_port and ulpi_port + +From: Gaosheng Cui + +[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ] + +The tegra_xusb_port_unregister should be called when usb2_port +and ulpi_port map fails in tegra_xusb_add_usb2_port() or in +tegra_xusb_add_ulpi_port(), fix it. + +Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Gaosheng Cui +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index 963de5913e505..71271af39ad61 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -781,6 +781,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl, + usb2->base.lane = usb2->base.ops->map(&usb2->base); + if (IS_ERR(usb2->base.lane)) { + err = PTR_ERR(usb2->base.lane); ++ tegra_xusb_port_unregister(&usb2->base); + goto out; + } + +@@ -847,6 +848,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl, + ulpi->base.lane = ulpi->base.ops->map(&ulpi->base); + if (IS_ERR(ulpi->base.lane)) { + err = PTR_ERR(ulpi->base.lane); ++ tegra_xusb_port_unregister(&ulpi->base); + goto out; + } + +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch b/queue-5.15/pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch new file mode 100644 index 00000000000..bbd47b08945 --- /dev/null +++ b/queue-5.15/pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch @@ -0,0 +1,50 @@ +From 3066cc69e158e3d6b15dba12c2b95d30861a3ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:10:31 +0100 +Subject: pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux + configuration + +From: Hai Pham + +[ Upstream commit a145c9a8674ac8fbfa1595276e1b6cbfc5139038 ] + +AVB[01]_{MAGIC,MDC,MDIO,TXCREFCLK} are registered as both +PINMUX_SINGLE(fn) and PINMUX_IPSR_GPSR(fn) in the pinmux_data array. + +The latter are correct, hence remove the former. +Without this fix, the Ethernet PHY is not operational on the MDIO bus. + +Signed-off-by: Hai Pham +Signed-off-by: LUU HOAI +Fixes: 741a7370fc3b8b54 ("pinctrl: renesas: Initial R8A779A0 (V3U) PFC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/6fd217b71e83ba9a8157513ed671a1fa218b23b6.1674824958.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779a0.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779a0.c b/drivers/pinctrl/renesas/pfc-r8a779a0.c +index a480677dd03d1..aa4fd56e0250d 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779a0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779a0.c +@@ -710,16 +710,8 @@ static const u16 pinmux_data[] = { + PINMUX_SINGLE(PCIE0_CLKREQ_N), + + PINMUX_SINGLE(AVB0_PHY_INT), +- PINMUX_SINGLE(AVB0_MAGIC), +- PINMUX_SINGLE(AVB0_MDC), +- PINMUX_SINGLE(AVB0_MDIO), +- PINMUX_SINGLE(AVB0_TXCREFCLK), + + PINMUX_SINGLE(AVB1_PHY_INT), +- PINMUX_SINGLE(AVB1_MAGIC), +- PINMUX_SINGLE(AVB1_MDC), +- PINMUX_SINGLE(AVB1_MDIO), +- PINMUX_SINGLE(AVB1_TXCREFCLK), + + PINMUX_SINGLE(AVB2_AVTP_PPS), + PINMUX_SINGLE(AVB2_AVTP_CAPTURE), +-- +2.39.2 + diff --git a/queue-5.15/platform-provide-a-remove-callback-that-returns-no-v.patch b/queue-5.15/platform-provide-a-remove-callback-that-returns-no-v.patch new file mode 100644 index 00000000000..f580e178f4a --- /dev/null +++ b/queue-5.15/platform-provide-a-remove-callback-that-returns-no-v.patch @@ -0,0 +1,86 @@ +From a93d2c7eebaf6919e67fab0374980237bc1f5fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 16:09:14 +0100 +Subject: platform: Provide a remove callback that returns no value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 5c5a7680e67ba6fbbb5f4d79fa41485450c1985c ] + +struct platform_driver::remove returning an integer made driver authors +expect that returning an error code was proper error handling. However +the driver core ignores the error and continues to remove the device +because there is nothing the core could do anyhow and reentering the +remove callback again is only calling for trouble. + +So this is an source for errors typically yielding resource leaks in the +error path. + +As there are too many platform drivers to neatly convert them all to +return void in a single go, do it in several steps after this patch: + + a) Convert all drivers to implement .remove_new() returning void instead + of .remove() returning int; + b) Change struct platform_driver::remove() to return void and so make + it identical to .remove_new(); + c) Change all drivers back to .remove() now with the better prototype; + d) drop struct platform_driver::remove_new(). + +While this touches all drivers eventually twice, steps a) and c) can be +done one driver after another and so reduces coordination efforts +immensely and simplifies review. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20221209150914.3557650-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/base/platform.c | 4 +++- + include/linux/platform_device.h | 11 +++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index 652531f67135a..ac5cf1a8d79ab 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -1427,7 +1427,9 @@ static void platform_remove(struct device *_dev) + struct platform_driver *drv = to_platform_driver(_dev->driver); + struct platform_device *dev = to_platform_device(_dev); + +- if (drv->remove) { ++ if (drv->remove_new) { ++ drv->remove_new(dev); ++ } else if (drv->remove) { + int ret = drv->remove(dev); + + if (ret) +diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h +index 7c96f169d2740..8aefdc0099c86 100644 +--- a/include/linux/platform_device.h ++++ b/include/linux/platform_device.h +@@ -203,7 +203,18 @@ extern void platform_device_put(struct platform_device *pdev); + + struct platform_driver { + int (*probe)(struct platform_device *); ++ ++ /* ++ * Traditionally the remove callback returned an int which however is ++ * ignored by the driver core. This led to wrong expectations by driver ++ * authors who thought returning an error code was a valid error ++ * handling strategy. To convert to a callback returning void, new ++ * drivers should implement .remove_new() until the conversion it done ++ * that eventually makes .remove() return void. ++ */ + int (*remove)(struct platform_device *); ++ void (*remove_new)(struct platform_device *); ++ + void (*shutdown)(struct platform_device *); + int (*suspend)(struct platform_device *, pm_message_t state); + int (*resume)(struct platform_device *); +-- +2.39.2 + diff --git a/queue-5.15/power-supply-generic-adc-battery-fix-unit-scaling.patch b/queue-5.15/power-supply-generic-adc-battery-fix-unit-scaling.patch new file mode 100644 index 00000000000..e9325c301ee --- /dev/null +++ b/queue-5.15/power-supply-generic-adc-battery-fix-unit-scaling.patch @@ -0,0 +1,42 @@ +From 277faf4b95f907433a7be30ec830a8791e506a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 23:56:57 +0100 +Subject: power: supply: generic-adc-battery: fix unit scaling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Reichel + +[ Upstream commit 44263f50065969f2344808388bd589740f026167 ] + +power-supply properties are reported in µV, µA and µW. +The IIO API provides mV, mA, mW, so the values need to +be multiplied by 1000. + +Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO") +Reviewed-by: Linus Walleij +Reviewed-by: Matti Vaittinen +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/generic-adc-battery.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index 66039c665dd1e..0af536f4932f1 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -135,6 +135,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp, + result); + if (ret < 0) + pr_err("read channel error\n"); ++ else ++ *result *= 1000; ++ + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/powerpc-mpc512x-fix-resource-printk-format-warning.patch b/queue-5.15/powerpc-mpc512x-fix-resource-printk-format-warning.patch new file mode 100644 index 00000000000..60973498cee --- /dev/null +++ b/queue-5.15/powerpc-mpc512x-fix-resource-printk-format-warning.patch @@ -0,0 +1,46 @@ +From ab6cbd1f5217c1a6c91aec8484bb2c2913a4dc3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:13 -0800 +Subject: powerpc/mpc512x: fix resource printk format warning + +From: Randy Dunlap + +[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + +../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat': +../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] + 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ + | ^~~~~~~~~ ~~~~~~~~~ + | | + | resource_size_t {aka long long unsigned int} + +Prevents 24 such warnings. + +Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/512x/clock-commonclk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c +index 30342b60aa63f..42c3d40355d90 100644 +--- a/arch/powerpc/platforms/512x/clock-commonclk.c ++++ b/arch/powerpc/platforms/512x/clock-commonclk.c +@@ -984,7 +984,7 @@ static void mpc5121_clk_provide_migration_support(void) + + #define NODE_PREP do { \ + of_address_to_resource(np, 0, &res); \ +- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ ++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \ + } while (0) + + #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \ +-- +2.39.2 + diff --git a/queue-5.15/powerpc-rtas-use-memmove-for-potentially-overlapping.patch b/queue-5.15/powerpc-rtas-use-memmove-for-potentially-overlapping.patch new file mode 100644 index 00000000000..c5f21925204 --- /dev/null +++ b/queue-5.15/powerpc-rtas-use-memmove-for-potentially-overlapping.patch @@ -0,0 +1,56 @@ +From 826afc21b012025966716b1d7f9d1b73c3c26fbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:33:41 -0600 +Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy + +From: Nathan Lynch + +[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ] + +Using memcpy() isn't safe when buf is identical to rtas_err_buf, which +can happen during boot before slab is up. Full context which may not +be obvious from the diff: + + if (altbuf) { + buf = altbuf; + } else { + buf = rtas_err_buf; + if (slab_is_available()) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) + memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + +This was found by inspection and I'm not aware of it causing problems +in practice. It appears to have been introduced by commit +033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the +old ppc64 version of this code did not have this problem. + +Use memmove() instead. + +Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel") +Signed-off-by: Nathan Lynch +Reviewed-by: Andrew Donnellan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index 2dae702e7a5a7..a4cd2484dbca2 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -415,7 +415,7 @@ static char *__fetch_rtas_last_error(char *altbuf) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) +- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); ++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + } + + return buf; +-- +2.39.2 + diff --git a/queue-5.15/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch b/queue-5.15/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch new file mode 100644 index 00000000000..f7260ba1f7f --- /dev/null +++ b/queue-5.15/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch @@ -0,0 +1,45 @@ +From 26f238b9dcc6a065fd1a2b62c4ef00d4221374d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:16 -0800 +Subject: powerpc/sysdev/tsi108: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + + arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci': + include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' + +Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree") +Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function") +Signed-off-by: Randy Dunlap +[mpe: Use pr_info() and unsplit string] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/tsi108_pci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c +index 042bb38fa5c24..a06297aa3f1be 100644 +--- a/arch/powerpc/sysdev/tsi108_pci.c ++++ b/arch/powerpc/sysdev/tsi108_pci.c +@@ -216,9 +216,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary) + + (hose)->ops = &tsi108_direct_pci_ops; + +- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. " +- "Firmware bus number: %d->%d\n", +- rsrc.start, hose->first_busno, hose->last_busno); ++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n", ++ &rsrc.start, hose->first_busno, hose->last_busno); + + /* Interpret the "ranges" property */ + /* This also maps the I/O region and sets isa_io/mem_base */ +-- +2.39.2 + diff --git a/queue-5.15/powerpc-wii-fix-resource-printk-format-warnings.patch b/queue-5.15/powerpc-wii-fix-resource-printk-format-warnings.patch new file mode 100644 index 00000000000..808e01bcdca --- /dev/null +++ b/queue-5.15/powerpc-wii-fix-resource-printk-format-warnings.patch @@ -0,0 +1,87 @@ +From 95d2aa1ea3d7d912c611345e0ff17b025a495995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:14 -0800 +Subject: powerpc/wii: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ] + +Use "%pa" format specifier for resource_size_t to avoid compiler +printk format warnings. + +../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info' + 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info' + 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info' + 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name, + | ^~~~~~~ + +Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support") +Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support") +Fixes: 5a7ee3198dfa ("powerpc: wii: platform support") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/wii.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +index 609bda2ad5dd2..4d9200bdba78c 100644 +--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +@@ -145,7 +145,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np) + } + io_base = ioremap(res.start, resource_size(&res)); + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __flipper_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +index a4b020e4b6af0..132e5c175e2d6 100644 +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -171,7 +171,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np) + return NULL; + } + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __hlwd_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c +index a802ef957d63e..458a63a30e803 100644 +--- a/arch/powerpc/platforms/embedded6xx/wii.c ++++ b/arch/powerpc/platforms/embedded6xx/wii.c +@@ -89,8 +89,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible) + + hw_regs = ioremap(res.start, resource_size(&res)); + if (hw_regs) { +- pr_info("%s at 0x%08x mapped to 0x%p\n", name, +- res.start, hw_regs); ++ pr_info("%s at 0x%pa mapped to 0x%p\n", name, ++ &res.start, hw_regs); + } + + out_put: +-- +2.39.2 + diff --git a/queue-5.15/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch b/queue-5.15/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch new file mode 100644 index 00000000000..812d5c0f7dd --- /dev/null +++ b/queue-5.15/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch @@ -0,0 +1,100 @@ +From 93ed1e1e84818559999406a96c063e2b35b6a3d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 20:40:43 +0000 +Subject: pstore: Revert pmsg_lock back to a normal mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Stultz + +[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ] + +This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721. + +So while priority inversion on the pmsg_lock is an occasional +problem that an rt_mutex would help with, in uses where logging +is writing to pmsg heavily from multiple threads, the pmsg_lock +can be heavily contended. + +After this change landed, it was reported that cases where the +mutex locking overhead was commonly adding on the order of 10s +of usecs delay had suddenly jumped to ~msec delay with rtmutex. + +It seems the slight differences in the locks under this level +of contention causes the normal mutexes to utilize the spinning +optimizations, while the rtmutexes end up in the sleeping +slowpath (which allows additional threads to pile on trying +to take the lock). + +In this case, it devolves to a worse case senerio where the lock +acquisition and scheduling overhead dominates, and each thread +is waiting on the order of ~ms to do ~us of work. + +Obviously, having tons of threads all contending on a single +lock for logging is non-optimal, so the proper fix is probably +reworking pstore pmsg to have per-cpu buffers so we don't have +contention. + +Additionally, Steven Rostedt has provided some furhter +optimizations for rtmutexes that improves the rtmutex spinning +path, but at least in my testing, I still see the test tripping +into the sleeping path on rtmutexes while utilizing the spinning +path with mutexes. + +But in the short term, lets revert the change to the rt_mutex +and go back to normal mutexes to avoid a potentially major +performance regression. And we can work on optimizations to both +rtmutexes and finer-grained locking for pstore pmsg in the +future. + +Cc: Wei Wang +Cc: Midas Chien +Cc: "Chunhui Li (李春辉)" +Cc: Steven Rostedt +Cc: Kees Cook +Cc: Anton Vorontsov +Cc: "Guilherme G. Piccoli" +Cc: Tony Luck +Cc: kernel-team@android.com +Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") +Reported-by: "Chunhui Li (李春辉)" +Signed-off-by: John Stultz +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com +Signed-off-by: Sasha Levin +--- + fs/pstore/pmsg.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c +index 18cf94b597e05..d8542ec2f38c6 100644 +--- a/fs/pstore/pmsg.c ++++ b/fs/pstore/pmsg.c +@@ -7,10 +7,9 @@ + #include + #include + #include +-#include + #include "internal.h" + +-static DEFINE_RT_MUTEX(pmsg_lock); ++static DEFINE_MUTEX(pmsg_lock); + + static ssize_t write_pmsg(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) +@@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf, + if (!access_ok(buf, count)) + return -EFAULT; + +- rt_mutex_lock(&pmsg_lock); ++ mutex_lock(&pmsg_lock); + ret = psinfo->write_user(&record, buf); +- rt_mutex_unlock(&pmsg_lock); ++ mutex_unlock(&pmsg_lock); + return ret ? ret : count; + } + +-- +2.39.2 + diff --git a/queue-5.15/pwm-mtk-disp-configure-double-buffering-before-readi.patch b/queue-5.15/pwm-mtk-disp-configure-double-buffering-before-readi.patch new file mode 100644 index 00000000000..361ecd72325 --- /dev/null +++ b/queue-5.15/pwm-mtk-disp-configure-double-buffering-before-readi.patch @@ -0,0 +1,73 @@ +From ba7e0287c8041aa20da9d85292de56017c33141e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:30:54 +0200 +Subject: pwm: mtk-disp: Configure double buffering before reading in + .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit b16c310115f2084b8826a35b77ef42bab6786d9f ] + +The DISP_PWM controller's default behavior is to always use register +double buffering: all reads/writes are then performed on shadow +registers instead of working registers and this becomes an issue +in case our chosen configuration in Linux is different from the +default (or from the one that was pre-applied by the bootloader). + +An example of broken behavior is when the controller is configured +to use shadow registers, but this driver wants to configure it +otherwise: what happens is that the .get_state() callback is called +right after registering the pwmchip and checks whether the PWM is +enabled by reading the DISP_PWM_EN register; +At this point, if shadow registers are enabled but their content +was not committed before booting Linux, we are *not* reading the +current PWM enablement status, leading to the kernel knowing that +the hardware is actually enabled when, in reality, it's not. + +The aforementioned issue emerged since this driver was fixed with +commit 0b5ef3429d8f ("pwm: mtk-disp: Fix the parameters calculated +by the enabled flag of disp_pwm") making it to read the enablement +status from the right register. + +Configure the controller in the .get_state() callback to avoid +this desync issue and get the backlight properly working again. + +Fixes: 3f2b16734914 ("pwm: mtk-disp: Implement atomic API .get_state()") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: Alexandre Mergnat +Tested-by: Alexandre Mergnat +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 9e91a51472493..92ba02cfec92f 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -196,6 +196,16 @@ static void mtk_disp_pwm_get_state(struct pwm_chip *chip, + return; + } + ++ /* ++ * Apply DISP_PWM_DEBUG settings to choose whether to enable or disable ++ * registers double buffer and manual commit to working register before ++ * performing any read/write operation ++ */ ++ if (mdp->data->bls_debug) ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ + rate = clk_get_rate(mdp->clk_main); + con0 = readl(mdp->base + mdp->data->con0); + con1 = readl(mdp->base + mdp->data->con1); +-- +2.39.2 + diff --git a/queue-5.15/pwm-mtk-disp-disable-shadow-registers-before-setting.patch b/queue-5.15/pwm-mtk-disp-disable-shadow-registers-before-setting.patch new file mode 100644 index 00000000000..8fa5ef077fd --- /dev/null +++ b/queue-5.15/pwm-mtk-disp-disable-shadow-registers-before-setting.patch @@ -0,0 +1,74 @@ +From 873b7ac726334d30308b871812b1ecceeefceffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:30:53 +0200 +Subject: pwm: mtk-disp: Disable shadow registers before setting backlight + values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ] + +If shadow registers usage is not desired, disable that before performing +any write to CON0/1 registers in the .apply() callback, otherwise we may +lose clkdiv or period/width updates. + +Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: Alexandre Mergnat +Tested-by: Alexandre Mergnat +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 3fbb4bae93a4e..9e91a51472493 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -138,6 +138,19 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + high_width = mul_u64_u64_div_u64(state->duty_cycle, rate, div); + value = period | (high_width << PWM_HIGH_WIDTH_SHIFT); + ++ if (mdp->data->bls_debug && !mdp->data->has_commit) { ++ /* ++ * For MT2701, disable double buffer before writing register ++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. ++ */ ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0, ++ mdp->data->con0_sel, ++ mdp->data->con0_sel); ++ } ++ + mtk_disp_pwm_update_bits(mdp, mdp->data->con0, + PWM_CLKDIV_MASK, + clk_div << PWM_CLKDIV_SHIFT); +@@ -152,17 +165,6 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + mtk_disp_pwm_update_bits(mdp, mdp->data->commit, + mdp->data->commit_mask, + 0x0); +- } else { +- /* +- * For MT2701, disable double buffer before writing register +- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. +- */ +- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, +- mdp->data->bls_debug_mask, +- mdp->data->bls_debug_mask); +- mtk_disp_pwm_update_bits(mdp, mdp->data->con0, +- mdp->data->con0_sel, +- mdp->data->con0_sel); + } + + mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, +-- +2.39.2 + diff --git a/queue-5.15/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch b/queue-5.15/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch new file mode 100644 index 00000000000..947c8cf1530 --- /dev/null +++ b/queue-5.15/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch @@ -0,0 +1,63 @@ +From e6300fc6b668e83b33c7122ca9460803a1bbb2fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 22:16:25 +0800 +Subject: rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check + +From: Zqiang + +[ Upstream commit db7b464df9d820186e98a65aa6a10f0d51fbf8ce ] + +This commit adds checks for the TICK_DEP_MASK_RCU_EXP bit, thus enabling +RCU expedited grace periods to actually force-enable scheduling-clock +interrupts on holdout CPUs. + +Fixes: df1e849ae455 ("rcu: Enable tick for nohz_full CPUs slow to provide expedited QS") +Signed-off-by: Zqiang +Cc: Steven Rostedt +Cc: Masami Hiramatsu +Cc: Frederic Weisbecker +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: Anna-Maria Behnsen +Acked-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Joel Fernandes (Google) +Signed-off-by: Sasha Levin +--- + include/trace/events/timer.h | 3 ++- + kernel/time/tick-sched.c | 5 +++++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h +index 6ad031c71be74..1cf012de6442e 100644 +--- a/include/trace/events/timer.h ++++ b/include/trace/events/timer.h +@@ -368,7 +368,8 @@ TRACE_EVENT(itimer_expire, + tick_dep_name(PERF_EVENTS) \ + tick_dep_name(SCHED) \ + tick_dep_name(CLOCK_UNSTABLE) \ +- tick_dep_name_end(RCU) ++ tick_dep_name(RCU) \ ++ tick_dep_name_end(RCU_EXP) + + #undef tick_dep_name + #undef tick_dep_mask_name +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 63e3e8ebcd643..e014927c82e76 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -264,6 +264,11 @@ static bool check_tick_dependency(atomic_t *dep) + return true; + } + ++ if (val & TICK_DEP_MASK_RCU_EXP) { ++ trace_tick_stop(0, TICK_DEP_MASK_RCU_EXP); ++ return true; ++ } ++ + return false; + } + +-- +2.39.2 + diff --git a/queue-5.15/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch b/queue-5.15/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch new file mode 100644 index 00000000000..03b550b73bb --- /dev/null +++ b/queue-5.15/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch @@ -0,0 +1,49 @@ +From fb8039b5db4bc3b8d05dd41fb2f76cd4a9795936 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 10:23:51 +0300 +Subject: RDMA/cm: Trace icm_send_rej event before the cm state is reset + +From: Mark Zhang + +[ Upstream commit bd9de1badac7e4ff6780365d4aa38983f5e2a436 ] + +Trace icm_send_rej event before the cm state is reset to idle, so that +correct cm state will be logged. For example when an incoming request is +rejected, the old trace log was: + icm_send_rej: local_id=961102742 remote_id=3829151631 state=IDLE reason=REJ_CONSUMER_DEFINED +With this patch: + icm_send_rej: local_id=312971016 remote_id=3778819983 state=MRA_REQ_SENT reason=REJ_CONSUMER_DEFINED + +Fixes: 8dc105befe16 ("RDMA/cm: Add tracepoints to track MAD send operations") +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/20230330072351.481200-1-markzhang@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 5c910f5c01b35..680c3ac8cd4c0 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -2914,6 +2914,8 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv, + (ari && ari_length > IB_CM_REJ_ARI_LENGTH)) + return -EINVAL; + ++ trace_icm_send_rej(&cm_id_priv->id, reason); ++ + switch (state) { + case IB_CM_REQ_SENT: + case IB_CM_MRA_REQ_RCVD: +@@ -2944,7 +2946,6 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv, + return -EINVAL; + } + +- trace_icm_send_rej(&cm_id_priv->id, reason); + ret = ib_post_send_mad(msg, NULL); + if (ret) { + cm_free_msg(msg); +-- +2.39.2 + diff --git a/queue-5.15/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch b/queue-5.15/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch new file mode 100644 index 00000000000..bb4063e9b9e --- /dev/null +++ b/queue-5.15/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch @@ -0,0 +1,46 @@ +From 4fb5573bcbf85107bedfb6bfc3c1d13b45efff17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 12:51:27 +0300 +Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() + +From: Dan Carpenter + +[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ] + +The ucmd->log_sq_bb_count variable is controlled by the user so this +shift can wrap. Fix it by using check_shl_overflow() in the same way +that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined +behavior in hns_roce_set_user_sq_size()"). + +Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/qp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 3a1a4ac9dd33d..ec545b8858cc0 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -412,9 +412,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev, + struct mlx4_ib_qp *qp, + struct mlx4_ib_create_qp *ucmd) + { ++ u32 cnt; ++ + /* Sanity check SQ size before proceeding */ +- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes || +- ucmd->log_sq_stride > ++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) || ++ cnt > dev->dev->caps.max_wqes) ++ return -EINVAL; ++ if (ucmd->log_sq_stride > + ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) || + ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.15/rdma-mlx5-fix-flow-counter-query-via-devx.patch b/queue-5.15/rdma-mlx5-fix-flow-counter-query-via-devx.patch new file mode 100644 index 00000000000..7f110c5dca0 --- /dev/null +++ b/queue-5.15/rdma-mlx5-fix-flow-counter-query-via-devx.patch @@ -0,0 +1,93 @@ +From 8241320498e5cba629c5f723fc489e8acb3c6235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 12:23:09 +0300 +Subject: RDMA/mlx5: Fix flow counter query via DEVX + +From: Mark Bloch + +[ Upstream commit 3e358ea8614ddfbc59ca7a3f5dff5dde2b350b2c ] + +Commit cited in "fixes" tag added bulk support for flow counters but it +didn't account that's also possible to query a counter using a non-base id +if the counter was allocated as bulk. + +When a user performs a query, validate the flow counter id given in the +mailbox is inside the valid range taking bulk value into account. + +Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters") +Signed-off-by: Mark Bloch +Reviewed-by: Maor Gottlieb +Link: https://lore.kernel.org/r/79d7fbe291690128e44672418934256254d93115.1681377114.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++----- + include/linux/mlx5/mlx5_ifc.h | 3 ++- + 2 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 21beded40066d..104e5cbba066b 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -666,7 +666,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + obj_id; + + case MLX5_IB_OBJECT_DEVX_OBJ: +- return ((struct devx_obj *)uobj->object)->obj_id == obj_id; ++ { ++ u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode); ++ struct devx_obj *devx_uobj = uobj->object; ++ ++ if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER && ++ devx_uobj->flow_counter_bulk_size) { ++ u64 end; ++ ++ end = devx_uobj->obj_id + ++ devx_uobj->flow_counter_bulk_size; ++ return devx_uobj->obj_id <= obj_id && end > obj_id; ++ } ++ ++ return devx_uobj->obj_id == obj_id; ++ } + + default: + return false; +@@ -1515,10 +1529,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)( + goto obj_free; + + if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) { +- u8 bulk = MLX5_GET(alloc_flow_counter_in, +- cmd_in, +- flow_counter_bulk); +- obj->flow_counter_bulk_size = 128UL * bulk; ++ u32 bulk = MLX5_GET(alloc_flow_counter_in, ++ cmd_in, ++ flow_counter_bulk_log_size); ++ ++ if (bulk) ++ bulk = 1 << bulk; ++ else ++ bulk = 128UL * MLX5_GET(alloc_flow_counter_in, ++ cmd_in, ++ flow_counter_bulk); ++ obj->flow_counter_bulk_size = bulk; + } + + uobj->object = obj; +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index 49ea0004109e1..442b6ac8a66c1 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -8508,7 +8508,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits { + u8 reserved_at_20[0x10]; + u8 op_mod[0x10]; + +- u8 reserved_at_40[0x38]; ++ u8 reserved_at_40[0x33]; ++ u8 flow_counter_bulk_log_size[0x5]; + u8 flow_counter_bulk[0x8]; + }; + +-- +2.39.2 + diff --git a/queue-5.15/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch b/queue-5.15/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch new file mode 100644 index 00000000000..9bea956ad39 --- /dev/null +++ b/queue-5.15/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch @@ -0,0 +1,39 @@ +From a14c43de4cb30929d2175956c40ae0dafbf1be89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 04:39:06 +0300 +Subject: RDMA/mlx5: Use correct device num_ports when modify DC + +From: Mark Zhang + +[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ] + +Just like other QP types, when modify DC, the port_num should be compared +with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port +vHCA on DC may not work. + +Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") +Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 55b05a3e31b8e..1080daf3a546f 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -4406,7 +4406,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, + return -EINVAL; + + if (attr->port_num == 0 || +- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) { ++ attr->port_num > dev->num_ports) { + mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n", + attr->port_num, dev->num_ports); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.15/rdma-rdmavt-delete-unnecessary-null-check.patch b/queue-5.15/rdma-rdmavt-delete-unnecessary-null-check.patch new file mode 100644 index 00000000000..f1e6a153f80 --- /dev/null +++ b/queue-5.15/rdma-rdmavt-delete-unnecessary-null-check.patch @@ -0,0 +1,41 @@ +From 9790a7ae5bd29952568638dab4923b73552eb173 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 15:44:08 +0300 +Subject: RDMA/rdmavt: Delete unnecessary NULL check + +From: Natalia Petrova + +[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ] + +There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev' +is created in rvt_register_device() which will fail if the 'qp_dev' +allocation fails in rvt_driver_qp_init(). Overwise this pointer +doesn't changed and passed to rvt_qp_exit() by the next step. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table") +Signed-off-by: Natalia Petrova +Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rdmavt/qp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index 3acab569fbb94..2bdc4486c3daa 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -464,8 +464,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi) + if (qps_inuse) + rvt_pr_err(rdi, "QP memory leak! %u still in use\n", + qps_inuse); +- if (!rdi->qp_dev) +- return; + + kfree(rdi->qp_dev->qp_table); + free_qpn_table(&rdi->qp_dev->qpn_table); +-- +2.39.2 + diff --git a/queue-5.15/rdma-siw-fix-potential-page_array-out-of-range-acces.patch b/queue-5.15/rdma-siw-fix-potential-page_array-out-of-range-acces.patch new file mode 100644 index 00000000000..16218755c9c --- /dev/null +++ b/queue-5.15/rdma-siw-fix-potential-page_array-out-of-range-acces.patch @@ -0,0 +1,39 @@ +From a38dc62b4b7a5dd14177334f0f6a11945b9cb1ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 01:17:51 -0800 +Subject: RDMA/siw: Fix potential page_array out of range access + +From: Daniil Dulov + +[ Upstream commit 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 ] + +When seg is equal to MAX_ARRAY, the loop should break, otherwise +it will result in out of range access. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b9be6f18cf9e ("rdma/siw: transmit path") +Signed-off-by: Daniil Dulov +Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c +index 05052b49107f2..6bb9e9e81ff4c 100644 +--- a/drivers/infiniband/sw/siw/siw_qp_tx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c +@@ -558,7 +558,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s) + data_len -= plen; + fp_off = 0; + +- if (++seg > (int)MAX_ARRAY) { ++ if (++seg >= (int)MAX_ARRAY) { + siw_dbg_qp(tx_qp(c_tx), "to many fragments\n"); + siw_unmap_pages(iov, kmap_mask, seg-1); + wqe->processed -= c_tx->bytes_unsent; +-- +2.39.2 + diff --git a/queue-5.15/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch b/queue-5.15/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch new file mode 100644 index 00000000000..df3d9e98f94 --- /dev/null +++ b/queue-5.15/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch @@ -0,0 +1,44 @@ +From 70db394a3074e316f5b39a84e50ca65cd6d0b775 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Apr 2023 14:10:13 +0900 +Subject: RDMA/siw: Remove namespace check from siw_netdev_event() + +From: Tetsuo Handa + +[ Upstream commit 266e9b3475ba82212062771fdbc40be0e3c06ec8 ] + +syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy +siw_device created after unshare(CLONE_NEWNET) due to net namespace check. +It seems that this check was by error there and should be removed. + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b +Suggested-by: Jason Gunthorpe +Suggested-by: Leon Romanovsky +Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") +Signed-off-by: Tetsuo Handa +Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp +Reviewed-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index 9093e6a80b260..f853f3c23540a 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -437,9 +437,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event, + + dev_dbg(&netdev->dev, "siw: event %lu\n", event); + +- if (dev_net(netdev) != &init_net) +- return NOTIFY_OK; +- + base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW); + if (!base_dev) + return NOTIFY_OK; +-- +2.39.2 + diff --git a/queue-5.15/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch b/queue-5.15/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch new file mode 100644 index 00000000000..b3c2ab01b79 --- /dev/null +++ b/queue-5.15/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch @@ -0,0 +1,112 @@ +From a1edbeea177e762751e6f9cb882c17227a40a717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 21:25:49 -0700 +Subject: RDMA/srpt: Add a check for valid 'mad_agent' pointer + +From: Saravanan Vajravel + +[ Upstream commit eca5cd9474cd26d62f9756f536e2e656d3f62f3a ] + +When unregistering MAD agent, srpt module has a non-null check +for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). +This check can pass if 'mad_agent' variable holds an error value. +The 'mad_agent' can have an error value for a short window when +srpt_add_one() and srpt_remove_one() is executed simultaneously. + +In srpt module, added a valid pointer check for 'sport->mad_agent' +before unregistering MAD agent. + +This issue can hit when RoCE driver unregisters ib_device + +Stack Trace: +------------ +BUG: kernel NULL pointer dereference, address: 000000000000004d +PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 +Oops: 0002 [#1] PREEMPT SMP NOPTI +CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P +Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 +Workqueue: bnxt_re bnxt_re_task [bnxt_re] +RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 +Call Trace: + ib_unregister_mad_agent+0x46/0x2f0 [ib_core] + IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready + ? __schedule+0x20b/0x560 + srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt] + srpt_remove_one+0x20/0x150 [ib_srpt] + remove_client_context+0x88/0xd0 [ib_core] + bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex + disable_device+0x8a/0x160 [ib_core] + bond0: active interface up! + ? kernfs_name_hash+0x12/0x80 + (NULL device *): Bonding Info Received: rdev: 000000006c0b8247 + __ib_unregister_device+0x42/0xb0 [ib_core] + (NULL device *): Master: mode: 4 num_slaves:2 + ib_unregister_device+0x22/0x30 [ib_core] + (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 + bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re] + bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re] + +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Reviewed-by: Selvin Xavier +Reviewed-by: Kashyap Desai +Signed-off-by: Saravanan Vajravel +Link: https://lore.kernel.org/r/20230406042549.507328-1-saravanan.vajravel@broadcom.com +Reviewed-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 7b69b0c9e48d9..38494943bd748 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -549,6 +549,7 @@ static int srpt_format_guid(char *buf, unsigned int size, const __be64 *guid) + */ + static int srpt_refresh_port(struct srpt_port *sport) + { ++ struct ib_mad_agent *mad_agent; + struct ib_mad_reg_req reg_req; + struct ib_port_modify port_modify; + struct ib_port_attr port_attr; +@@ -593,24 +594,26 @@ static int srpt_refresh_port(struct srpt_port *sport) + set_bit(IB_MGMT_METHOD_GET, reg_req.method_mask); + set_bit(IB_MGMT_METHOD_SET, reg_req.method_mask); + +- sport->mad_agent = ib_register_mad_agent(sport->sdev->device, +- sport->port, +- IB_QPT_GSI, +- ®_req, 0, +- srpt_mad_send_handler, +- srpt_mad_recv_handler, +- sport, 0); +- if (IS_ERR(sport->mad_agent)) { ++ mad_agent = ib_register_mad_agent(sport->sdev->device, ++ sport->port, ++ IB_QPT_GSI, ++ ®_req, 0, ++ srpt_mad_send_handler, ++ srpt_mad_recv_handler, ++ sport, 0); ++ if (IS_ERR(mad_agent)) { + pr_err("%s-%d: MAD agent registration failed (%ld). Note: this is expected if SR-IOV is enabled.\n", + dev_name(&sport->sdev->device->dev), sport->port, +- PTR_ERR(sport->mad_agent)); ++ PTR_ERR(mad_agent)); + sport->mad_agent = NULL; + memset(&port_modify, 0, sizeof(port_modify)); + port_modify.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP; + ib_modify_port(sport->sdev->device, sport->port, 0, + &port_modify); +- ++ return 0; + } ++ ++ sport->mad_agent = mad_agent; + } + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/regulator-core-avoid-lockdep-reports-when-resolving-.patch b/queue-5.15/regulator-core-avoid-lockdep-reports-when-resolving-.patch new file mode 100644 index 00000000000..5cd1d6abb96 --- /dev/null +++ b/queue-5.15/regulator-core-avoid-lockdep-reports-when-resolving-.patch @@ -0,0 +1,266 @@ +From 75d97b2bac4dbef739a834ee2592cc6a3c7c1e77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:33:54 -0700 +Subject: regulator: core: Avoid lockdep reports when resolving supplies + +From: Douglas Anderson + +[ Upstream commit cba6cfdc7c3f1516f0d08ddfb24e689af0932573 ] + +An automated bot told me that there was a potential lockdep problem +with regulators. This was on the chromeos-5.15 kernel, but I see +nothing that would be different downstream compared to upstream. The +bot said: + ============================================ + WARNING: possible recursive locking detected + 5.15.104-lockdep-17461-gc1e499ed6604 #1 Not tainted + -------------------------------------------- + kworker/u16:4/115 is trying to acquire lock: + ffffff8083110170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: create_regulator+0x398/0x7ec + + but task is already holding lock: + ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(regulator_ww_class_mutex); + lock(regulator_ww_class_mutex); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 4 locks held by kworker/u16:4/115: + #0: ffffff808006a948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x520/0x1348 + #1: ffffffc00e0a7cc0 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x55c/0x1348 + #2: ffffff80828a2260 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0xd0/0x2a4 + #3: ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8 + + stack backtrace: + CPU: 2 PID: 115 Comm: kworker/u16:4 Not tainted 5.15.104-lockdep-17461-gc1e499ed6604 #1 9292e52fa83c0e23762b2b3aa1bacf5787a4d5da + Hardware name: Google Quackingstick (rev0+) (DT) + Workqueue: events_unbound async_run_entry_fn + Call trace: + dump_backtrace+0x0/0x4ec + show_stack+0x34/0x50 + dump_stack_lvl+0xdc/0x11c + dump_stack+0x1c/0x48 + __lock_acquire+0x16d4/0x6c74 + lock_acquire+0x208/0x750 + __mutex_lock_common+0x11c/0x11f8 + ww_mutex_lock+0xc0/0x440 + create_regulator+0x398/0x7ec + regulator_resolve_supply+0x654/0x7c4 + regulator_register_resolve_supply+0x30/0x120 + class_for_each_device+0x1b8/0x230 + regulator_register+0x17a4/0x1f40 + devm_regulator_register+0x60/0xd0 + reg_fixed_voltage_probe+0x728/0xaec + platform_probe+0x150/0x1c8 + really_probe+0x274/0xa20 + __driver_probe_device+0x1dc/0x3f4 + driver_probe_device+0x78/0x1c0 + __device_attach_driver+0x1ac/0x2c8 + bus_for_each_drv+0x11c/0x190 + __device_attach_async_helper+0x1e4/0x2a4 + async_run_entry_fn+0xa0/0x3ac + process_one_work+0x638/0x1348 + worker_thread+0x4a8/0x9c4 + kthread+0x2e4/0x3a0 + ret_from_fork+0x10/0x20 + +The problem was first reported soon after we made many of the +regulators probe asynchronously, though nothing I've seen implies that +the problems couldn't have also happened even without that. + +I haven't personally been able to reproduce the lockdep issue, but the +issue does look somewhat legitimate. Specifically, it looks like in +regulator_resolve_supply() we are holding a "rdev" lock while calling +set_supply() -> create_regulator() which grabs the lock of a +_different_ "rdev" (the one for our supply). This is not necessarily +safe from a lockdep perspective since there is no documented ordering +between these two locks. + +In reality, we should always be locking a regulator before the +supplying regulator, so I don't expect there to be any real deadlocks +in practice. However, the regulator framework in general doesn't +express this to lockdep. + +Let's fix the issue by simply grabbing the two locks involved in the +same way we grab multiple locks elsewhere in the regulator framework: +using the "wound/wait" mechanisms. + +Fixes: eaa7995c529b ("regulator: core: avoid regulator_resolve_supply() race condition") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230329143317.RFC.v2.2.I30d8e1ca10cfbe5403884cdd192253a2e063eb9e@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 91 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 83 insertions(+), 8 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 48db0735e3dba..9ddb80d10dee3 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -206,6 +206,78 @@ static void regulator_unlock(struct regulator_dev *rdev) + mutex_unlock(®ulator_nesting_mutex); + } + ++/** ++ * regulator_lock_two - lock two regulators ++ * @rdev1: first regulator ++ * @rdev2: second regulator ++ * @ww_ctx: w/w mutex acquire context ++ * ++ * Locks both rdevs using the regulator_ww_class. ++ */ ++static void regulator_lock_two(struct regulator_dev *rdev1, ++ struct regulator_dev *rdev2, ++ struct ww_acquire_ctx *ww_ctx) ++{ ++ struct regulator_dev *tmp; ++ int ret; ++ ++ ww_acquire_init(ww_ctx, ®ulator_ww_class); ++ ++ /* Try to just grab both of them */ ++ ret = regulator_lock_nested(rdev1, ww_ctx); ++ WARN_ON(ret); ++ ret = regulator_lock_nested(rdev2, ww_ctx); ++ if (ret != -EDEADLOCK) { ++ WARN_ON(ret); ++ goto exit; ++ } ++ ++ while (true) { ++ /* ++ * Start of loop: rdev1 was locked and rdev2 was contended. ++ * Need to unlock rdev1, slowly lock rdev2, then try rdev1 ++ * again. ++ */ ++ regulator_unlock(rdev1); ++ ++ ww_mutex_lock_slow(&rdev2->mutex, ww_ctx); ++ rdev2->ref_cnt++; ++ rdev2->mutex_owner = current; ++ ret = regulator_lock_nested(rdev1, ww_ctx); ++ ++ if (ret == -EDEADLOCK) { ++ /* More contention; swap which needs to be slow */ ++ tmp = rdev1; ++ rdev1 = rdev2; ++ rdev2 = tmp; ++ } else { ++ WARN_ON(ret); ++ break; ++ } ++ } ++ ++exit: ++ ww_acquire_done(ww_ctx); ++} ++ ++/** ++ * regulator_unlock_two - unlock two regulators ++ * @rdev1: first regulator ++ * @rdev2: second regulator ++ * @ww_ctx: w/w mutex acquire context ++ * ++ * The inverse of regulator_lock_two(). ++ */ ++ ++static void regulator_unlock_two(struct regulator_dev *rdev1, ++ struct regulator_dev *rdev2, ++ struct ww_acquire_ctx *ww_ctx) ++{ ++ regulator_unlock(rdev2); ++ regulator_unlock(rdev1); ++ ww_acquire_fini(ww_ctx); ++} ++ + static bool regulator_supply_is_couple(struct regulator_dev *rdev) + { + struct regulator_dev *c_rdev; +@@ -1583,8 +1655,8 @@ static int set_machine_constraints(struct regulator_dev *rdev) + + /** + * set_supply - set regulator supply regulator +- * @rdev: regulator name +- * @supply_rdev: supply regulator name ++ * @rdev: regulator (locked) ++ * @supply_rdev: supply regulator (locked)) + * + * Called by platform initialisation code to set the supply regulator for this + * regulator. This ensures that a regulators supply will also be enabled by the +@@ -1756,6 +1828,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + struct regulator *regulator; + int err = 0; + ++ lockdep_assert_held_once(&rdev->mutex.base); ++ + if (dev) { + char buf[REG_STR_SIZE]; + int size; +@@ -1783,9 +1857,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + regulator->rdev = rdev; + regulator->supply_name = supply_name; + +- regulator_lock(rdev); + list_add(®ulator->list, &rdev->consumer_list); +- regulator_unlock(rdev); + + if (dev) { + regulator->dev = dev; +@@ -1951,6 +2023,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) + { + struct regulator_dev *r; + struct device *dev = rdev->dev.parent; ++ struct ww_acquire_ctx ww_ctx; + int ret = 0; + + /* No supply to resolve? */ +@@ -2017,23 +2090,23 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) + * between rdev->supply null check and setting rdev->supply in + * set_supply() from concurrent tasks. + */ +- regulator_lock(rdev); ++ regulator_lock_two(rdev, r, &ww_ctx); + + /* Supply just resolved by a concurrent task? */ + if (rdev->supply) { +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + put_device(&r->dev); + goto out; + } + + ret = set_supply(rdev, r); + if (ret < 0) { +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + put_device(&r->dev); + goto out; + } + +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + + /* + * In set_machine_constraints() we may have turned this regulator on +@@ -2146,7 +2219,9 @@ struct regulator *_regulator_get(struct device *dev, const char *id, + return regulator; + } + ++ regulator_lock(rdev); + regulator = create_regulator(rdev, dev, id); ++ regulator_unlock(rdev); + if (regulator == NULL) { + regulator = ERR_PTR(-ENOMEM); + module_put(rdev->owner); +-- +2.39.2 + diff --git a/queue-5.15/regulator-core-consistently-set-mutex_owner-when-usi.patch b/queue-5.15/regulator-core-consistently-set-mutex_owner-when-usi.patch new file mode 100644 index 00000000000..7437dc57637 --- /dev/null +++ b/queue-5.15/regulator-core-consistently-set-mutex_owner-when-usi.patch @@ -0,0 +1,54 @@ +From e33268859e91fbf13dce52814ca235408a5d9eda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:33:53 -0700 +Subject: regulator: core: Consistently set mutex_owner when using + ww_mutex_lock_slow() + +From: Douglas Anderson + +[ Upstream commit b83a1772be854f87602de14726737d3e5b06e1f4 ] + +When a codepath locks a rdev using ww_mutex_lock_slow() directly then +that codepath is responsible for incrementing the "ref_cnt" and also +setting the "mutex_owner" to "current". + +The regulator core consistently got that right for "ref_cnt" but +didn't always get it right for "mutex_owner". Let's fix this. + +It's unlikely that this truly matters because the "mutex_owner" is +only needed if we're going to do subsequent locking of the same +rdev. However, even though it's not truly needed it seems less +surprising if we consistently set "mutex_owner" properly. + +Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230329143317.RFC.v2.1.I4e9d433ea26360c06dd1381d091c82bb1a4ce843@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index e876702d6ef36..48db0735e3dba 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -333,6 +333,7 @@ static void regulator_lock_dependent(struct regulator_dev *rdev, + ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx); + old_contended_rdev = new_contended_rdev; + old_contended_rdev->ref_cnt++; ++ old_contended_rdev->mutex_owner = current; + } + + err = regulator_lock_recursive(rdev, +@@ -5966,6 +5967,7 @@ static void regulator_summary_lock(struct ww_acquire_ctx *ww_ctx) + ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx); + old_contended_rdev = new_contended_rdev; + old_contended_rdev->ref_cnt++; ++ old_contended_rdev->mutex_owner = current; + } + + err = regulator_summary_lock_all(ww_ctx, +-- +2.39.2 + diff --git a/queue-5.15/regulator-core-shorten-off-on-delay-us-for-always-on.patch b/queue-5.15/regulator-core-shorten-off-on-delay-us-for-always-on.patch new file mode 100644 index 00000000000..9ab691c0886 --- /dev/null +++ b/queue-5.15/regulator-core-shorten-off-on-delay-us-for-always-on.patch @@ -0,0 +1,114 @@ +From 58888a37b9313e0a8904e653c1b8d7d5c65e1eb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 11:18:19 -0700 +Subject: regulator: core: Shorten off-on-delay-us for always-on/boot-on by + time since booted +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Douglas Anderson + +[ Upstream commit 691c1fcda5351ed98a44610b7dccc0e3ee920020 ] + +This is very close to a straight revert of commit 218320fec294 +("regulator: core: Fix off-on-delay-us for always-on/boot-on +regulators"). We've identified that patch as causing a boot speed +regression on sc7180-trogdor boards. While boot speed certainly isn't +more important than making sure that power sequencing is correct, +looking closely at the original change it doesn't seem to have been +fully justified. It mentions "cycling issues" without describing +exactly what the issues were. That means it's possible that the +cycling issues were really a problem that should be fixed in a +different way. + +Let's take a careful look at how we should handle regulators that have +an off-on-delay and that are boot-on or always-on. Linux currently +doesn't have any way to identify whether a GPIO regulator was already +on when the kernel booted. That means that when the kernel boots we +probe a regulator, see that it wants boot-on / always-on we, and then +turn the regulator on. We could be in one of two cases when we do +this: + +a) The regulator might have been left on by the bootloader and we're + ensuring that it stays on. +b) The regulator might have been left off by the bootloader and we're + just now turning it on. + +For case a) we definitely don't need any sort of delay. For case b) we +_might_ need some delay in case the bootloader turned the regulator +off _right_ before booting the kernel. To get the proper delay for +case b) then we can just assume a `last_off` of 0, which is what it +gets initialized to by default. + +As per above, we can't tell whether we're in case a) or case b) so +we'll assume the longer delay (case b). This basically puts the code +to how it was before commit 218320fec294 ("regulator: core: Fix +off-on-delay-us for always-on/boot-on regulators"). However, we add +one important change: we make sure that the delay is actually honored +if `last_off` is 0. Though the original "cycling issues" cited were +vague, I'm hopeful that this important extra change will be enough to +fix the issues that the initial commit mentioned. + +With this fix, I've confined that on a sc7180-trogdor board the delay +at boot goes down from 500 ms to ~250 ms. That's not as good as the 0 +ms that we had prior to commit 218320fec294 ("regulator: core: Fix +off-on-delay-us for always-on/boot-on regulators"), but it's probably +safer because we don't know if the bootloader turned the regulator off +right before booting. + +One note is that it's possible that we could be in a state that's not +a) or b) if there are other issues in the kernel. The only one I can +think of is related to pinctrl. If the pinctrl driver being used on a +board isn't careful about avoiding glitches when setting up a pin then +it's possible that setting up a pin could cause the regulator to "turn +off" briefly immediately before the regulator probes. If this is +indeed causing problems then the pinctrl driver should be fixed, +perhaps in a similar way to what was done in commit d21f4b7ffc22 +("pinctrl: qcom: Avoid glitching lines when we first mux to output") + +Fixes: 218320fec294 ("regulator: core: Fix off-on-delay-us for always-on/boot-on regulators") +Cc: Christian Kohlschütter +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230313111806.1.I2eaad872be0932a805c239a7c7a102233fb0b03b@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index cd10880378a6d..e876702d6ef36 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1539,9 +1539,6 @@ static int set_machine_constraints(struct regulator_dev *rdev) + rdev->constraints->always_on = true; + } + +- if (rdev->desc->off_on_delay) +- rdev->last_off = ktime_get_boottime(); +- + /* If the constraints say the regulator should be on at this point + * and we have control then make sure it is enabled. + */ +@@ -1575,6 +1572,8 @@ static int set_machine_constraints(struct regulator_dev *rdev) + + if (rdev->constraints->always_on) + rdev->use_count++; ++ } else if (rdev->desc->off_on_delay) { ++ rdev->last_off = ktime_get(); + } + + print_constraints(rdev); +@@ -2624,7 +2623,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev) + + trace_regulator_enable(rdev_get_name(rdev)); + +- if (rdev->desc->off_on_delay && rdev->last_off) { ++ if (rdev->desc->off_on_delay) { + /* if needed, keep a distance of off_on_delay from last time + * this regulator was disabled. + */ +-- +2.39.2 + diff --git a/queue-5.15/regulator-stm32-pwr-fix-of_iomap-leak.patch b/queue-5.15/regulator-stm32-pwr-fix-of_iomap-leak.patch new file mode 100644 index 00000000000..8aed5f1a180 --- /dev/null +++ b/queue-5.15/regulator-stm32-pwr-fix-of_iomap-leak.patch @@ -0,0 +1,69 @@ +From c2b6b83bd1117ef839701144f1bf6cd301525b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 11:35:29 +0800 +Subject: regulator: stm32-pwr: fix of_iomap leak + +From: YAN SHI + +[ Upstream commit c4a413e56d16a2ae84e6d8992f215c4dcc7fac20 ] + +Smatch reports: +drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: +'base' from of_iomap() not released on lines: 151,166. + +In stm32_pwr_regulator_probe(), base is not released +when devm_kzalloc() fails to allocate memory or +devm_regulator_register() fails to register a new regulator device, +which may cause a leak. + +To fix this issue, replace of_iomap() with +devm_platform_ioremap_resource(). devm_platform_ioremap_resource() +is a specialized function for platform devices. +It allows 'base' to be automatically released whether the probe +function succeeds or fails. + +Besides, use IS_ERR(base) instead of !base +as the return value of devm_platform_ioremap_resource() +can either be a pointer to the remapped memory or +an ERR_PTR() encoded error code if the operation fails. + +Fixes: dc62f951a6a8 ("regulator: stm32-pwr: Fix return value check in stm32_pwr_regulator_probe()") +Signed-off-by: YAN SHI +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202304111750.o2643eJN-lkp@intel.com/ +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230412033529.18890-1-m202071378@hust.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/stm32-pwr.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/stm32-pwr.c b/drivers/regulator/stm32-pwr.c +index 2a42acb7c24e9..e5dd4db6403b2 100644 +--- a/drivers/regulator/stm32-pwr.c ++++ b/drivers/regulator/stm32-pwr.c +@@ -129,17 +129,16 @@ static const struct regulator_desc stm32_pwr_desc[] = { + + static int stm32_pwr_regulator_probe(struct platform_device *pdev) + { +- struct device_node *np = pdev->dev.of_node; + struct stm32_pwr_reg *priv; + void __iomem *base; + struct regulator_dev *rdev; + struct regulator_config config = { }; + int i, ret = 0; + +- base = of_iomap(np, 0); +- if (!base) { ++ base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(base)) { + dev_err(&pdev->dev, "Unable to map IO memory\n"); +- return -ENOMEM; ++ return PTR_ERR(base); + } + + config.dev = &pdev->dev; +-- +2.39.2 + diff --git a/queue-5.15/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch b/queue-5.15/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch new file mode 100644 index 00000000000..ed21fe16f3d --- /dev/null +++ b/queue-5.15/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch @@ -0,0 +1,39 @@ +From 934a7dd5c64d221e1afe300dedb3afa5351d13db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 18:30:06 +0800 +Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove + due to unfinished work" + +From: Liu Jian + +[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ] + +This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. + +This patch introduces a possible null-ptr-def problem. Revert it. And the +fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth: +btsdio: fix use after free bug in btsdio_remove due to race condition"). + +Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work") +Signed-off-by: Liu Jian +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btsdio.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index 7050a16e7efeb..199e8f7d426d9 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -352,7 +352,6 @@ static void btsdio_remove(struct sdio_func *func) + + BT_DBG("func %p", func); + +- cancel_work_sync(&data->work); + if (!data) + return; + +-- +2.39.2 + diff --git a/queue-5.15/revert-objtool-support-addition-to-set-cfa-base.patch b/queue-5.15/revert-objtool-support-addition-to-set-cfa-base.patch new file mode 100644 index 00000000000..98c93034f5e --- /dev/null +++ b/queue-5.15/revert-objtool-support-addition-to-set-cfa-base.patch @@ -0,0 +1,53 @@ +From ad291b91892c53007bb37e29cb6e814c576fb482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 10:29:01 -0700 +Subject: Revert "objtool: Support addition to set CFA base" + +From: Josh Poimboeuf + +[ Upstream commit e18398e80c73e3cc7d9c3d2e0bc06a4af8f4f1cb ] + +Commit 468af56a7bba ("objtool: Support addition to set CFA base") was +added as a preparatory patch for arm64 support, but that support never +came. It triggers a false positive warning on x86, so just revert it +for now. + +Fixes the following warning: + + vmlinux.o: warning: objtool: cdce925_regmap_i2c_write+0xdb: stack state mismatch: cfa1=4+120 cfa2=5+40 + +Fixes: 468af56a7bba ("objtool: Support addition to set CFA base") +Reported-by: kernel test robot +Signed-off-by: Josh Poimboeuf +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/oe-kbuild-all/202304080538.j5G6h1AB-lkp@intel.com/ +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 32f119e8c3b2c..f331780f04252 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2481,17 +2481,6 @@ static int update_cfi_state(struct instruction *insn, + break; + } + +- if (!cfi->drap && op->src.reg == CFI_SP && +- op->dest.reg == CFI_BP && cfa->base == CFI_SP && +- check_reg_frame_pos(®s[CFI_BP], -cfa->offset + op->src.offset)) { +- +- /* lea disp(%rsp), %rbp */ +- cfa->base = CFI_BP; +- cfa->offset -= op->src.offset; +- cfi->bp_scratch = false; +- break; +- } +- + if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { + + /* drap: lea disp(%rsp), %drap */ +-- +2.39.2 + diff --git a/queue-5.15/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch b/queue-5.15/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch new file mode 100644 index 00000000000..b59dc43f082 --- /dev/null +++ b/queue-5.15/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch @@ -0,0 +1,60 @@ +From c2ed98603c1993810a104649f9ec41705900c50f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 22:21:42 +0100 +Subject: rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time + +From: Martin Blumenstingl + +[ Upstream commit 0e6255fa3f649170da6bd1a544680589cfae1131 ] + +The VRTC alarm register can be programmed with an amount of seconds +after which the SoC will be woken up by the VRTC timer again. We are +already converting the alarm time from meson_vrtc_set_alarm() to +"seconds since 1970". This means we also need to use "seconds since +1970" for the current time. + +This fixes a problem where setting the alarm to one minute in the future +results in the firmware (which handles wakeup) to output (on the serial +console) that the system will be woken up in billions of seconds. +ktime_get_raw_ts64() returns the time since boot, not since 1970. Switch +to ktime_get_real_ts64() to fix the calculation of the alarm time and to +make the SoC wake up at the specified date/time. Also the firmware +(which manages suspend) now prints either 59 or 60 seconds until wakeup +(depending on how long it takes for the system to enter suspend). + +Fixes: 6ef35398e827 ("rtc: Add Amlogic Virtual Wake RTC") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Reviewed-by: Kevin Hilman +Link: https://lore.kernel.org/r/20230320212142.2355062-1-martin.blumenstingl@googlemail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-meson-vrtc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-meson-vrtc.c b/drivers/rtc/rtc-meson-vrtc.c +index 1463c86215615..648fa362ec447 100644 +--- a/drivers/rtc/rtc-meson-vrtc.c ++++ b/drivers/rtc/rtc-meson-vrtc.c +@@ -23,7 +23,7 @@ static int meson_vrtc_read_time(struct device *dev, struct rtc_time *tm) + struct timespec64 time; + + dev_dbg(dev, "%s\n", __func__); +- ktime_get_raw_ts64(&time); ++ ktime_get_real_ts64(&time); + rtc_time64_to_tm(time.tv_sec, tm); + + return 0; +@@ -96,7 +96,7 @@ static int __maybe_unused meson_vrtc_suspend(struct device *dev) + long alarm_secs; + struct timespec64 time; + +- ktime_get_raw_ts64(&time); ++ ktime_get_real_ts64(&time); + local_time = time.tv_sec; + + dev_dbg(dev, "alarm_time = %lus, local_time=%lus\n", +-- +2.39.2 + diff --git a/queue-5.15/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch b/queue-5.15/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch new file mode 100644 index 00000000000..2e5741f0a5f --- /dev/null +++ b/queue-5.15/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch @@ -0,0 +1,40 @@ +From 63175e44661837a51c10f491fe8d00257de2e3e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Mar 2023 10:40:21 +0100 +Subject: rtc: omap: include header for omap_rtc_power_off_program prototype +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit f69c2b5420497b7a54181ce170d682cbeb1f119f ] + +Non-static functions should have a prototype: + + drivers/rtc/rtc-omap.c:410:5: error: no previous prototype for ‘omap_rtc_power_off_program’ [-Werror=missing-prototypes] + +Fixes: 6256f7f7f217 ("rtc: OMAP: Add support for rtc-only mode") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230311094021.79730-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-omap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c +index d46e0f0cc5020..3ff832a5af37c 100644 +--- a/drivers/rtc/rtc-omap.c ++++ b/drivers/rtc/rtc-omap.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + /* + * The OMAP RTC is a year/month/day/hours/minutes/seconds BCD clock +-- +2.39.2 + diff --git a/queue-5.15/sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch b/queue-5.15/sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch new file mode 100644 index 00000000000..431365f68a5 --- /dev/null +++ b/queue-5.15/sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch @@ -0,0 +1,46 @@ +From a33d1333acacce023c60a6d8208bcd0dc646f997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Aug 2022 15:33:13 -0700 +Subject: sched/fair: Fix inaccurate tally of ttwu_move_affine + +From: Libo Chen + +[ Upstream commit 39afe5d6fc59237ff7738bf3ede5a8856822d59d ] + +There are scenarios where non-affine wakeups are incorrectly counted as +affine wakeups by schedstats. + +When wake_affine_idle() returns prev_cpu which doesn't equal to +nr_cpumask_bits, it will slip through the check: target == nr_cpumask_bits +in wake_affine() and be counted as if target == this_cpu in schedstats. + +Replace target == nr_cpumask_bits with target != this_cpu to make sure +affine wakeups are accurately tallied. + +Fixes: 806486c377e33 (sched/fair: Do not migrate if the prev_cpu is idle) +Suggested-by: Daniel Jordan +Signed-off-by: Libo Chen +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Gautham R. Shenoy +Link: https://lore.kernel.org/r/20220810223313.386614-1-libo.chen@oracle.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 2dd67e212f0ac..646a6ae4b2509 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6207,7 +6207,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, + target = wake_affine_weight(sd, p, this_cpu, prev_cpu, sync); + + schedstat_inc(p->stats.nr_wakeups_affine_attempts); +- if (target == nr_cpumask_bits) ++ if (target != this_cpu) + return prev_cpu; + + schedstat_inc(sd->ttwu_move_affine); +-- +2.39.2 + diff --git a/queue-5.15/sched-fair-use-__schedstat_set-in-set_next_entity.patch b/queue-5.15/sched-fair-use-__schedstat_set-in-set_next_entity.patch new file mode 100644 index 00000000000..202d40ee234 --- /dev/null +++ b/queue-5.15/sched-fair-use-__schedstat_set-in-set_next_entity.patch @@ -0,0 +1,42 @@ +From db7e0e0bf775b2d483fdcea95eb9d6c545129b37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 14:35:40 +0000 +Subject: sched/fair: Use __schedstat_set() in set_next_entity() + +From: Yafang Shao + +[ Upstream commit a2dcb276ff9287fcea103ca1a2436383e8583751 ] + +schedstat_enabled() has been already checked, so we can use +__schedstat_set() directly. + +Signed-off-by: Yafang Shao +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Mel Gorman +Link: https://lore.kernel.org/r/20210905143547.4668-2-laoar.shao@gmail.com +Stable-dep-of: 39afe5d6fc59 ("sched/fair: Fix inaccurate tally of ttwu_move_affine") +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 591fdc81378e0..70f7a3896a90c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4691,9 +4691,9 @@ set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se) + */ + if (schedstat_enabled() && + rq_of(cfs_rq)->cfs.load.weight >= 2*se->load.weight) { +- schedstat_set(se->statistics.slice_max, +- max((u64)schedstat_val(se->statistics.slice_max), +- se->sum_exec_runtime - se->prev_sum_exec_runtime)); ++ __schedstat_set(se->statistics.slice_max, ++ max((u64)se->statistics.slice_max, ++ se->sum_exec_runtime - se->prev_sum_exec_runtime)); + } + + se->prev_sum_exec_runtime = se->sum_exec_runtime; +-- +2.39.2 + diff --git a/queue-5.15/sched-make-struct-sched_statistics-independent-of-fa.patch b/queue-5.15/sched-make-struct-sched_statistics-independent-of-fa.patch new file mode 100644 index 00000000000..a0287821bcd --- /dev/null +++ b/queue-5.15/sched-make-struct-sched_statistics-independent-of-fa.patch @@ -0,0 +1,645 @@ +From 761659b26e57227251b0646c398754727d007d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 14:35:41 +0000 +Subject: sched: Make struct sched_statistics independent of fair sched class + +From: Yafang Shao + +[ Upstream commit ceeadb83aea28372e54857bf88ab7e17af48ab7b ] + +If we want to use the schedstats facility to trace other sched classes, we +should make it independent of fair sched class. The struct sched_statistics +is the schedular statistics of a task_struct or a task_group. So we can +move it into struct task_struct and struct task_group to achieve the goal. + +After the patch, schestats are orgnized as follows, + + struct task_struct { + ... + struct sched_entity se; + struct sched_rt_entity rt; + struct sched_dl_entity dl; + ... + struct sched_statistics stats; + ... + }; + +Regarding the task group, schedstats is only supported for fair group +sched, and a new struct sched_entity_stats is introduced, suggested by +Peter - + + struct sched_entity_stats { + struct sched_entity se; + struct sched_statistics stats; + } __no_randomize_layout; + +Then with the se in a task_group, we can easily get the stats. + +The sched_statistics members may be frequently modified when schedstats is +enabled, in order to avoid impacting on random data which may in the same +cacheline with them, the struct sched_statistics is defined as cacheline +aligned. + +As this patch changes the core struct of scheduler, so I verified the +performance it may impact on the scheduler with 'perf bench sched +pipe', suggested by Mel. Below is the result, in which all the values +are in usecs/op. + Before After + kernel.sched_schedstats=0 5.2~5.4 5.2~5.4 + kernel.sched_schedstats=1 5.3~5.5 5.3~5.5 +[These data is a little difference with the earlier version, that is + because my old test machine is destroyed so I have to use a new + different test machine.] + +Almost no impact on the sched performance. + +No functional change. + +[lkp@intel.com: reported build failure in earlier version] + +Signed-off-by: Yafang Shao +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Mel Gorman +Link: https://lore.kernel.org/r/20210905143547.4668-3-laoar.shao@gmail.com +Stable-dep-of: 39afe5d6fc59 ("sched/fair: Fix inaccurate tally of ttwu_move_affine") +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 6 +-- + kernel/sched/core.c | 25 ++++++----- + kernel/sched/deadline.c | 4 +- + kernel/sched/debug.c | 92 +++++++++++++++++++++------------------- + kernel/sched/fair.c | 89 ++++++++++++++++++++++---------------- + kernel/sched/rt.c | 4 +- + kernel/sched/stats.h | 19 +++++++++ + kernel/sched/stop_task.c | 4 +- + 8 files changed, 143 insertions(+), 100 deletions(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index e418935f8db6a..7c17742d359cd 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -522,7 +522,7 @@ struct sched_statistics { + u64 nr_wakeups_passive; + u64 nr_wakeups_idle; + #endif +-}; ++} ____cacheline_aligned; + + struct sched_entity { + /* For load-balancing: */ +@@ -538,8 +538,6 @@ struct sched_entity { + + u64 nr_migrations; + +- struct sched_statistics statistics; +- + #ifdef CONFIG_FAIR_GROUP_SCHED + int depth; + struct sched_entity *parent; +@@ -803,6 +801,8 @@ struct task_struct { + struct uclamp_se uclamp[UCLAMP_CNT]; + #endif + ++ struct sched_statistics stats; ++ + #ifdef CONFIG_PREEMPT_NOTIFIERS + /* List of struct preempt_notifier: */ + struct hlist_head preempt_notifiers; +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ed57d8358f243..d34a56f16d13b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -3522,11 +3522,11 @@ ttwu_stat(struct task_struct *p, int cpu, int wake_flags) + #ifdef CONFIG_SMP + if (cpu == rq->cpu) { + __schedstat_inc(rq->ttwu_local); +- __schedstat_inc(p->se.statistics.nr_wakeups_local); ++ __schedstat_inc(p->stats.nr_wakeups_local); + } else { + struct sched_domain *sd; + +- __schedstat_inc(p->se.statistics.nr_wakeups_remote); ++ __schedstat_inc(p->stats.nr_wakeups_remote); + rcu_read_lock(); + for_each_domain(rq->cpu, sd) { + if (cpumask_test_cpu(cpu, sched_domain_span(sd))) { +@@ -3538,14 +3538,14 @@ ttwu_stat(struct task_struct *p, int cpu, int wake_flags) + } + + if (wake_flags & WF_MIGRATED) +- __schedstat_inc(p->se.statistics.nr_wakeups_migrate); ++ __schedstat_inc(p->stats.nr_wakeups_migrate); + #endif /* CONFIG_SMP */ + + __schedstat_inc(rq->ttwu_count); +- __schedstat_inc(p->se.statistics.nr_wakeups); ++ __schedstat_inc(p->stats.nr_wakeups); + + if (wake_flags & WF_SYNC) +- __schedstat_inc(p->se.statistics.nr_wakeups_sync); ++ __schedstat_inc(p->stats.nr_wakeups_sync); + } + + /* +@@ -4241,7 +4241,7 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p) + + #ifdef CONFIG_SCHEDSTATS + /* Even if schedstat is disabled, there should not be garbage */ +- memset(&p->se.statistics, 0, sizeof(p->se.statistics)); ++ memset(&p->stats, 0, sizeof(p->stats)); + #endif + + RB_CLEAR_NODE(&p->dl.rb_node); +@@ -9706,9 +9706,9 @@ void normalize_rt_tasks(void) + continue; + + p->se.exec_start = 0; +- schedstat_set(p->se.statistics.wait_start, 0); +- schedstat_set(p->se.statistics.sleep_start, 0); +- schedstat_set(p->se.statistics.block_start, 0); ++ schedstat_set(p->stats.wait_start, 0); ++ schedstat_set(p->stats.sleep_start, 0); ++ schedstat_set(p->stats.block_start, 0); + + if (!dl_task(p) && !rt_task(p)) { + /* +@@ -10576,11 +10576,14 @@ static int cpu_cfs_stat_show(struct seq_file *sf, void *v) + seq_printf(sf, "throttled_time %llu\n", cfs_b->throttled_time); + + if (schedstat_enabled() && tg != &root_task_group) { ++ struct sched_statistics *stats; + u64 ws = 0; + int i; + +- for_each_possible_cpu(i) +- ws += schedstat_val(tg->se[i]->statistics.wait_sum); ++ for_each_possible_cpu(i) { ++ stats = __schedstats_from_se(tg->se[i]); ++ ws += schedstat_val(stats->wait_sum); ++ } + + seq_printf(sf, "wait_sum %llu\n", ws); + } +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 226c814368d1b..3aad381f42ed4 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1265,8 +1265,8 @@ static void update_curr_dl(struct rq *rq) + return; + } + +- schedstat_set(curr->se.statistics.exec_max, +- max(curr->se.statistics.exec_max, delta_exec)); ++ schedstat_set(curr->stats.exec_max, ++ max(curr->stats.exec_max, delta_exec)); + + curr->se.sum_exec_runtime += delta_exec; + account_group_exec_runtime(curr, delta_exec); +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 34c5ff3a0669b..652499c388287 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -448,9 +448,11 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group + struct sched_entity *se = tg->se[cpu]; + + #define P(F) SEQ_printf(m, " .%-30s: %lld\n", #F, (long long)F) +-#define P_SCHEDSTAT(F) SEQ_printf(m, " .%-30s: %lld\n", #F, (long long)schedstat_val(F)) ++#define P_SCHEDSTAT(F) SEQ_printf(m, " .%-30s: %lld\n", \ ++ #F, (long long)schedstat_val(stats->F)) + #define PN(F) SEQ_printf(m, " .%-30s: %lld.%06ld\n", #F, SPLIT_NS((long long)F)) +-#define PN_SCHEDSTAT(F) SEQ_printf(m, " .%-30s: %lld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(F))) ++#define PN_SCHEDSTAT(F) SEQ_printf(m, " .%-30s: %lld.%06ld\n", \ ++ #F, SPLIT_NS((long long)schedstat_val(stats->F))) + + if (!se) + return; +@@ -460,16 +462,18 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group + PN(se->sum_exec_runtime); + + if (schedstat_enabled()) { +- PN_SCHEDSTAT(se->statistics.wait_start); +- PN_SCHEDSTAT(se->statistics.sleep_start); +- PN_SCHEDSTAT(se->statistics.block_start); +- PN_SCHEDSTAT(se->statistics.sleep_max); +- PN_SCHEDSTAT(se->statistics.block_max); +- PN_SCHEDSTAT(se->statistics.exec_max); +- PN_SCHEDSTAT(se->statistics.slice_max); +- PN_SCHEDSTAT(se->statistics.wait_max); +- PN_SCHEDSTAT(se->statistics.wait_sum); +- P_SCHEDSTAT(se->statistics.wait_count); ++ struct sched_statistics *stats = __schedstats_from_se(se); ++ ++ PN_SCHEDSTAT(wait_start); ++ PN_SCHEDSTAT(sleep_start); ++ PN_SCHEDSTAT(block_start); ++ PN_SCHEDSTAT(sleep_max); ++ PN_SCHEDSTAT(block_max); ++ PN_SCHEDSTAT(exec_max); ++ PN_SCHEDSTAT(slice_max); ++ PN_SCHEDSTAT(wait_max); ++ PN_SCHEDSTAT(wait_sum); ++ P_SCHEDSTAT(wait_count); + } + + P(se->load.weight); +@@ -536,9 +540,9 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p) + p->prio); + + SEQ_printf(m, "%9Ld.%06ld %9Ld.%06ld %9Ld.%06ld", +- SPLIT_NS(schedstat_val_or_zero(p->se.statistics.wait_sum)), ++ SPLIT_NS(schedstat_val_or_zero(p->stats.wait_sum)), + SPLIT_NS(p->se.sum_exec_runtime), +- SPLIT_NS(schedstat_val_or_zero(p->se.statistics.sum_sleep_runtime))); ++ SPLIT_NS(schedstat_val_or_zero(p->stats.sum_sleep_runtime))); + + #ifdef CONFIG_NUMA_BALANCING + SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p)); +@@ -944,8 +948,8 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, + "---------------------------------------------------------" + "----------\n"); + +-#define P_SCHEDSTAT(F) __PS(#F, schedstat_val(p->F)) +-#define PN_SCHEDSTAT(F) __PSN(#F, schedstat_val(p->F)) ++#define P_SCHEDSTAT(F) __PS(#F, schedstat_val(p->stats.F)) ++#define PN_SCHEDSTAT(F) __PSN(#F, schedstat_val(p->stats.F)) + + PN(se.exec_start); + PN(se.vruntime); +@@ -958,33 +962,33 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, + if (schedstat_enabled()) { + u64 avg_atom, avg_per_cpu; + +- PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); +- PN_SCHEDSTAT(se.statistics.wait_start); +- PN_SCHEDSTAT(se.statistics.sleep_start); +- PN_SCHEDSTAT(se.statistics.block_start); +- PN_SCHEDSTAT(se.statistics.sleep_max); +- PN_SCHEDSTAT(se.statistics.block_max); +- PN_SCHEDSTAT(se.statistics.exec_max); +- PN_SCHEDSTAT(se.statistics.slice_max); +- PN_SCHEDSTAT(se.statistics.wait_max); +- PN_SCHEDSTAT(se.statistics.wait_sum); +- P_SCHEDSTAT(se.statistics.wait_count); +- PN_SCHEDSTAT(se.statistics.iowait_sum); +- P_SCHEDSTAT(se.statistics.iowait_count); +- P_SCHEDSTAT(se.statistics.nr_migrations_cold); +- P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); +- P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); +- P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); +- P_SCHEDSTAT(se.statistics.nr_forced_migrations); +- P_SCHEDSTAT(se.statistics.nr_wakeups); +- P_SCHEDSTAT(se.statistics.nr_wakeups_sync); +- P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); +- P_SCHEDSTAT(se.statistics.nr_wakeups_local); +- P_SCHEDSTAT(se.statistics.nr_wakeups_remote); +- P_SCHEDSTAT(se.statistics.nr_wakeups_affine); +- P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); +- P_SCHEDSTAT(se.statistics.nr_wakeups_passive); +- P_SCHEDSTAT(se.statistics.nr_wakeups_idle); ++ PN_SCHEDSTAT(sum_sleep_runtime); ++ PN_SCHEDSTAT(wait_start); ++ PN_SCHEDSTAT(sleep_start); ++ PN_SCHEDSTAT(block_start); ++ PN_SCHEDSTAT(sleep_max); ++ PN_SCHEDSTAT(block_max); ++ PN_SCHEDSTAT(exec_max); ++ PN_SCHEDSTAT(slice_max); ++ PN_SCHEDSTAT(wait_max); ++ PN_SCHEDSTAT(wait_sum); ++ P_SCHEDSTAT(wait_count); ++ PN_SCHEDSTAT(iowait_sum); ++ P_SCHEDSTAT(iowait_count); ++ P_SCHEDSTAT(nr_migrations_cold); ++ P_SCHEDSTAT(nr_failed_migrations_affine); ++ P_SCHEDSTAT(nr_failed_migrations_running); ++ P_SCHEDSTAT(nr_failed_migrations_hot); ++ P_SCHEDSTAT(nr_forced_migrations); ++ P_SCHEDSTAT(nr_wakeups); ++ P_SCHEDSTAT(nr_wakeups_sync); ++ P_SCHEDSTAT(nr_wakeups_migrate); ++ P_SCHEDSTAT(nr_wakeups_local); ++ P_SCHEDSTAT(nr_wakeups_remote); ++ P_SCHEDSTAT(nr_wakeups_affine); ++ P_SCHEDSTAT(nr_wakeups_affine_attempts); ++ P_SCHEDSTAT(nr_wakeups_passive); ++ P_SCHEDSTAT(nr_wakeups_idle); + + avg_atom = p->se.sum_exec_runtime; + if (nr_switches) +@@ -1050,7 +1054,7 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, + void proc_sched_set_task(struct task_struct *p) + { + #ifdef CONFIG_SCHEDSTATS +- memset(&p->se.statistics, 0, sizeof(p->se.statistics)); ++ memset(&p->stats, 0, sizeof(p->stats)); + #endif + } + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 70f7a3896a90c..2dd67e212f0ac 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -837,8 +837,13 @@ static void update_curr(struct cfs_rq *cfs_rq) + + curr->exec_start = now; + +- schedstat_set(curr->statistics.exec_max, +- max(delta_exec, curr->statistics.exec_max)); ++ if (schedstat_enabled()) { ++ struct sched_statistics *stats; ++ ++ stats = __schedstats_from_se(curr); ++ __schedstat_set(stats->exec_max, ++ max(delta_exec, stats->exec_max)); ++ } + + curr->sum_exec_runtime += delta_exec; + schedstat_add(cfs_rq->exec_clock, delta_exec); +@@ -866,39 +871,45 @@ static inline void + update_stats_wait_start(struct cfs_rq *cfs_rq, struct sched_entity *se) + { + u64 wait_start, prev_wait_start; ++ struct sched_statistics *stats; + + if (!schedstat_enabled()) + return; + ++ stats = __schedstats_from_se(se); ++ + wait_start = rq_clock(rq_of(cfs_rq)); +- prev_wait_start = schedstat_val(se->statistics.wait_start); ++ prev_wait_start = schedstat_val(stats->wait_start); + + if (entity_is_task(se) && task_on_rq_migrating(task_of(se)) && + likely(wait_start > prev_wait_start)) + wait_start -= prev_wait_start; + +- __schedstat_set(se->statistics.wait_start, wait_start); ++ __schedstat_set(stats->wait_start, wait_start); + } + + static inline void + update_stats_wait_end(struct cfs_rq *cfs_rq, struct sched_entity *se) + { +- struct task_struct *p; ++ struct sched_statistics *stats; ++ struct task_struct *p = NULL; + u64 delta; + + if (!schedstat_enabled()) + return; + ++ stats = __schedstats_from_se(se); ++ + /* + * When the sched_schedstat changes from 0 to 1, some sched se + * maybe already in the runqueue, the se->statistics.wait_start + * will be 0.So it will let the delta wrong. We need to avoid this + * scenario. + */ +- if (unlikely(!schedstat_val(se->statistics.wait_start))) ++ if (unlikely(!schedstat_val(stats->wait_start))) + return; + +- delta = rq_clock(rq_of(cfs_rq)) - schedstat_val(se->statistics.wait_start); ++ delta = rq_clock(rq_of(cfs_rq)) - schedstat_val(stats->wait_start); + + if (entity_is_task(se)) { + p = task_of(se); +@@ -908,30 +919,33 @@ update_stats_wait_end(struct cfs_rq *cfs_rq, struct sched_entity *se) + * time stamp can be adjusted to accumulate wait time + * prior to migration. + */ +- __schedstat_set(se->statistics.wait_start, delta); ++ __schedstat_set(stats->wait_start, delta); + return; + } + trace_sched_stat_wait(p, delta); + } + +- __schedstat_set(se->statistics.wait_max, +- max(schedstat_val(se->statistics.wait_max), delta)); +- __schedstat_inc(se->statistics.wait_count); +- __schedstat_add(se->statistics.wait_sum, delta); +- __schedstat_set(se->statistics.wait_start, 0); ++ __schedstat_set(stats->wait_max, ++ max(schedstat_val(stats->wait_max), delta)); ++ __schedstat_inc(stats->wait_count); ++ __schedstat_add(stats->wait_sum, delta); ++ __schedstat_set(stats->wait_start, 0); + } + + static inline void + update_stats_enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se) + { ++ struct sched_statistics *stats; + struct task_struct *tsk = NULL; + u64 sleep_start, block_start; + + if (!schedstat_enabled()) + return; + +- sleep_start = schedstat_val(se->statistics.sleep_start); +- block_start = schedstat_val(se->statistics.block_start); ++ stats = __schedstats_from_se(se); ++ ++ sleep_start = schedstat_val(stats->sleep_start); ++ block_start = schedstat_val(stats->block_start); + + if (entity_is_task(se)) + tsk = task_of(se); +@@ -942,11 +956,11 @@ update_stats_enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se) + if ((s64)delta < 0) + delta = 0; + +- if (unlikely(delta > schedstat_val(se->statistics.sleep_max))) +- __schedstat_set(se->statistics.sleep_max, delta); ++ if (unlikely(delta > schedstat_val(stats->sleep_max))) ++ __schedstat_set(stats->sleep_max, delta); + +- __schedstat_set(se->statistics.sleep_start, 0); +- __schedstat_add(se->statistics.sum_sleep_runtime, delta); ++ __schedstat_set(stats->sleep_start, 0); ++ __schedstat_add(stats->sum_sleep_runtime, delta); + + if (tsk) { + account_scheduler_latency(tsk, delta >> 10, 1); +@@ -959,16 +973,16 @@ update_stats_enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se) + if ((s64)delta < 0) + delta = 0; + +- if (unlikely(delta > schedstat_val(se->statistics.block_max))) +- __schedstat_set(se->statistics.block_max, delta); ++ if (unlikely(delta > schedstat_val(stats->block_max))) ++ __schedstat_set(stats->block_max, delta); + +- __schedstat_set(se->statistics.block_start, 0); +- __schedstat_add(se->statistics.sum_sleep_runtime, delta); ++ __schedstat_set(stats->block_start, 0); ++ __schedstat_add(stats->sum_sleep_runtime, delta); + + if (tsk) { + if (tsk->in_iowait) { +- __schedstat_add(se->statistics.iowait_sum, delta); +- __schedstat_inc(se->statistics.iowait_count); ++ __schedstat_add(stats->iowait_sum, delta); ++ __schedstat_inc(stats->iowait_count); + trace_sched_stat_iowait(tsk, delta); + } + +@@ -1030,10 +1044,10 @@ update_stats_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags) + /* XXX racy against TTWU */ + state = READ_ONCE(tsk->__state); + if (state & TASK_INTERRUPTIBLE) +- __schedstat_set(se->statistics.sleep_start, ++ __schedstat_set(tsk->stats.sleep_start, + rq_clock(rq_of(cfs_rq))); + if (state & TASK_UNINTERRUPTIBLE) +- __schedstat_set(se->statistics.block_start, ++ __schedstat_set(tsk->stats.block_start, + rq_clock(rq_of(cfs_rq))); + } + } +@@ -4691,8 +4705,11 @@ set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se) + */ + if (schedstat_enabled() && + rq_of(cfs_rq)->cfs.load.weight >= 2*se->load.weight) { +- __schedstat_set(se->statistics.slice_max, +- max((u64)se->statistics.slice_max, ++ struct sched_statistics *stats; ++ ++ stats = __schedstats_from_se(se); ++ __schedstat_set(stats->slice_max, ++ max((u64)stats->slice_max, + se->sum_exec_runtime - se->prev_sum_exec_runtime)); + } + +@@ -6189,12 +6206,12 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, + if (sched_feat(WA_WEIGHT) && target == nr_cpumask_bits) + target = wake_affine_weight(sd, p, this_cpu, prev_cpu, sync); + +- schedstat_inc(p->se.statistics.nr_wakeups_affine_attempts); ++ schedstat_inc(p->stats.nr_wakeups_affine_attempts); + if (target == nr_cpumask_bits) + return prev_cpu; + + schedstat_inc(sd->ttwu_move_affine); +- schedstat_inc(p->se.statistics.nr_wakeups_affine); ++ schedstat_inc(p->stats.nr_wakeups_affine); + return target; + } + +@@ -8030,7 +8047,7 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + if (!cpumask_test_cpu(env->dst_cpu, p->cpus_ptr)) { + int cpu; + +- schedstat_inc(p->se.statistics.nr_failed_migrations_affine); ++ schedstat_inc(p->stats.nr_failed_migrations_affine); + + env->flags |= LBF_SOME_PINNED; + +@@ -8064,7 +8081,7 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + env->flags &= ~LBF_ALL_PINNED; + + if (task_running(env->src_rq, p)) { +- schedstat_inc(p->se.statistics.nr_failed_migrations_running); ++ schedstat_inc(p->stats.nr_failed_migrations_running); + return 0; + } + +@@ -8086,12 +8103,12 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + env->sd->nr_balance_failed > env->sd->cache_nice_tries) { + if (tsk_cache_hot == 1) { + schedstat_inc(env->sd->lb_hot_gained[env->idle]); +- schedstat_inc(p->se.statistics.nr_forced_migrations); ++ schedstat_inc(p->stats.nr_forced_migrations); + } + return 1; + } + +- schedstat_inc(p->se.statistics.nr_failed_migrations_hot); ++ schedstat_inc(p->stats.nr_failed_migrations_hot); + return 0; + } + +@@ -11774,7 +11791,7 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent) + if (!cfs_rq) + goto err; + +- se = kzalloc_node(sizeof(struct sched_entity), ++ se = kzalloc_node(sizeof(struct sched_entity_stats), + GFP_KERNEL, cpu_to_node(i)); + if (!se) + goto err_free_rq; +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 08af6076c8097..8d170b5bdae92 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1021,8 +1021,8 @@ static void update_curr_rt(struct rq *rq) + if (unlikely((s64)delta_exec <= 0)) + return; + +- schedstat_set(curr->se.statistics.exec_max, +- max(curr->se.statistics.exec_max, delta_exec)); ++ schedstat_set(curr->stats.exec_max, ++ max(curr->stats.exec_max, delta_exec)); + + curr->se.sum_exec_runtime += delta_exec; + account_group_exec_runtime(curr, delta_exec); +diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h +index 606a3982d13a5..975703572bc0d 100644 +--- a/kernel/sched/stats.h ++++ b/kernel/sched/stats.h +@@ -41,6 +41,7 @@ rq_sched_info_dequeue(struct rq *rq, unsigned long long delta) + #define schedstat_val_or_zero(var) ((schedstat_enabled()) ? (var) : 0) + + #else /* !CONFIG_SCHEDSTATS: */ ++ + static inline void rq_sched_info_arrive (struct rq *rq, unsigned long long delta) { } + static inline void rq_sched_info_dequeue(struct rq *rq, unsigned long long delta) { } + static inline void rq_sched_info_depart (struct rq *rq, unsigned long long delta) { } +@@ -53,8 +54,26 @@ static inline void rq_sched_info_depart (struct rq *rq, unsigned long long delt + # define schedstat_set(var, val) do { } while (0) + # define schedstat_val(var) 0 + # define schedstat_val_or_zero(var) 0 ++ + #endif /* CONFIG_SCHEDSTATS */ + ++#ifdef CONFIG_FAIR_GROUP_SCHED ++struct sched_entity_stats { ++ struct sched_entity se; ++ struct sched_statistics stats; ++} __no_randomize_layout; ++#endif ++ ++static inline struct sched_statistics * ++__schedstats_from_se(struct sched_entity *se) ++{ ++#ifdef CONFIG_FAIR_GROUP_SCHED ++ if (!entity_is_task(se)) ++ return &container_of(se, struct sched_entity_stats, se)->stats; ++#endif ++ return &task_of(se)->stats; ++} ++ + #ifdef CONFIG_PSI + /* + * PSI tracks state that persists across sleeps, such as iowaits and +diff --git a/kernel/sched/stop_task.c b/kernel/sched/stop_task.c +index f988ebe3febb9..0b165a25f22f8 100644 +--- a/kernel/sched/stop_task.c ++++ b/kernel/sched/stop_task.c +@@ -78,8 +78,8 @@ static void put_prev_task_stop(struct rq *rq, struct task_struct *prev) + if (unlikely((s64)delta_exec < 0)) + delta_exec = 0; + +- schedstat_set(curr->se.statistics.exec_max, +- max(curr->se.statistics.exec_max, delta_exec)); ++ schedstat_set(curr->stats.exec_max, ++ max(curr->stats.exec_max, delta_exec)); + + curr->se.sum_exec_runtime += delta_exec; + account_group_exec_runtime(curr, delta_exec); +-- +2.39.2 + diff --git a/queue-5.15/sched-rt-fix-bad-task-migration-for-rt-tasks.patch b/queue-5.15/sched-rt-fix-bad-task-migration-for-rt-tasks.patch new file mode 100644 index 00000000000..f9d43367fb0 --- /dev/null +++ b/queue-5.15/sched-rt-fix-bad-task-migration-for-rt-tasks.patch @@ -0,0 +1,85 @@ +From 27d44e2e15e08ab48ac9291e4257cdde06971c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 01:03:02 +0800 +Subject: sched/rt: Fix bad task migration for rt tasks + +From: Schspa Shi + +[ Upstream commit feffe5bb274dd3442080ef0e4053746091878799 ] + +Commit 95158a89dd50 ("sched,rt: Use the full cpumask for balancing") +allows find_lock_lowest_rq() to pick a task with migration disabled. +The purpose of the commit is to push the current running task on the +CPU that has the migrate_disable() task away. + +However, there is a race which allows a migrate_disable() task to be +migrated. Consider: + + CPU0 CPU1 + push_rt_task + check is_migration_disabled(next_task) + + task not running and + migration_disabled == 0 + + find_lock_lowest_rq(next_task, rq); + _double_lock_balance(this_rq, busiest); + raw_spin_rq_unlock(this_rq); + double_rq_lock(this_rq, busiest); + <> + + task become running + migrate_disable(); + + deactivate_task(rq, next_task, 0); + set_task_cpu(next_task, lowest_rq->cpu); + WARN_ON_ONCE(is_migration_disabled(p)); + +Fixes: 95158a89dd50 ("sched,rt: Use the full cpumask for balancing") +Signed-off-by: Schspa Shi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Steven Rostedt (Google) +Reviewed-by: Dietmar Eggemann +Reviewed-by: Valentin Schneider +Tested-by: Dwaine Gonyier +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 1 + + kernel/sched/rt.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 3aad381f42ed4..b3e2064983952 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2084,6 +2084,7 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) + !cpumask_test_cpu(later_rq->cpu, &task->cpus_mask) || + task_running(rq, task) || + !dl_task(task) || ++ is_migration_disabled(task) || + !task_on_rq_queued(task))) { + double_unlock_balance(rq, later_rq); + later_rq = NULL; +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 8d170b5bdae92..4b9281e6b1ccd 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1842,11 +1842,15 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq) + * the mean time, task could have + * migrated already or had its affinity changed. + * Also make sure that it wasn't scheduled on its rq. ++ * It is possible the task was scheduled, set ++ * "migrate_disabled" and then got preempted, so we must ++ * check the task migration disable flag here too. + */ + if (unlikely(task_rq(task) != rq || + !cpumask_test_cpu(lowest_rq->cpu, &task->cpus_mask) || + task_running(rq, task) || + !rt_task(task) || ++ is_migration_disabled(task) || + !task_on_rq_queued(task))) { + + double_unlock_balance(rq, lowest_rq); +-- +2.39.2 + diff --git a/queue-5.15/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch b/queue-5.15/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch new file mode 100644 index 00000000000..306c2fa0ff5 --- /dev/null +++ b/queue-5.15/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch @@ -0,0 +1,77 @@ +From 0cec2e9b6b9718b41da85e787bcf2700895c518c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 12:32:11 +0100 +Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC + +From: Alexander Mikhalitsyn + +[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ] + +Currently, kernel would set MSG_CTRUNC flag if msg_control buffer +wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS. + +For some reason we have no corresponding check for SO_PASSSEC. + +In the recvmsg(2) doc we have: + MSG_CTRUNC + indicates that some control data was discarded due to lack + of space in the buffer for ancillary data. + +So, we need to set MSG_CTRUNC flag for all types of SCM. + +This change can break applications those don't check MSG_CTRUNC flag. + +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Leon Romanovsky +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexander Mikhalitsyn + +v2: +- commit message was rewritten according to Eric's suggestion +Acked-by: Paul Moore + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/scm.h | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/include/net/scm.h b/include/net/scm.h +index 1ce365f4c2560..585adc1346bd0 100644 +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc + } + } + } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return test_bit(SOCK_PASSSEC, &sock->flags); ++} + #else + static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) + { } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return false; ++} + #endif /* CONFIG_SECURITY_NETWORK */ + + static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, + struct scm_cookie *scm, int flags) + { + if (!msg->msg_control) { +- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) ++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp || ++ scm_has_secdata(sock)) + msg->msg_flags |= MSG_CTRUNC; + scm_destroy(scm); + return; +-- +2.39.2 + diff --git a/queue-5.15/scripts-gdb-bail-early-if-there-are-no-clocks.patch b/queue-5.15/scripts-gdb-bail-early-if-there-are-no-clocks.patch new file mode 100644 index 00000000000..dcfad6bfcc1 --- /dev/null +++ b/queue-5.15/scripts-gdb-bail-early-if-there-are-no-clocks.patch @@ -0,0 +1,48 @@ +From cbf6fea3bcced9ef7ac58aa1789bf4819d0f0bcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 15:52:45 -0700 +Subject: scripts/gdb: bail early if there are no clocks + +From: Florian Fainelli + +[ Upstream commit 1d7adbc74c009057ed9dc3112f388e91a9c79acc ] + +Avoid generating an exception if there are no clocks registered: + +(gdb) lx-clk-summary + enable prepare protect + clock count count count rate +------------------------------------------------------------------------ +Python Exception : No symbol "clk_root_list" in +current context. +Error occurred in Python: No symbol "clk_root_list" in current context. + +Link: https://lkml.kernel.org/r/20230323225246.3302977-1-f.fainelli@gmail.com +Fixes: d1e9710b63d8 ("scripts/gdb: initial clk support: lx-clk-summary") +Signed-off-by: Florian Fainelli +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Leonard Crestez +Cc: Stephen Boyd +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/clk.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/gdb/linux/clk.py b/scripts/gdb/linux/clk.py +index 061aecfa294e6..7a01fdc3e8446 100644 +--- a/scripts/gdb/linux/clk.py ++++ b/scripts/gdb/linux/clk.py +@@ -41,6 +41,8 @@ are cached and potentially out of date""" + self.show_subtree(child, level + 1) + + def invoke(self, arg, from_tty): ++ if utils.gdb_eval_or_none("clk_root_list") is None: ++ raise gdb.GdbError("No clocks registered") + gdb.write(" enable prepare protect \n") + gdb.write(" clock count count count rate \n") + gdb.write("------------------------------------------------------------------------\n") +-- +2.39.2 + diff --git a/queue-5.15/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch b/queue-5.15/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch new file mode 100644 index 00000000000..a8fa9b9f2f6 --- /dev/null +++ b/queue-5.15/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch @@ -0,0 +1,60 @@ +From 1a6346e74cdd511a6e92e4ebb245816b59c27c59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 16:16:57 -0700 +Subject: scripts/gdb: bail early if there are no generic PD + +From: Florian Fainelli + +[ Upstream commit f19c3c2959e465209ade1a7a699e6cbf4359ce78 ] + +Avoid generating an exception if there are no generic power domain(s) +registered: + +(gdb) lx-genpd-summary +domain status children + /device runtime status +---------------------------------------------------------------------- +Python Exception : No symbol "gpd_list" in current context. +Error occurred in Python: No symbol "gpd_list" in current context. +(gdb) quit + +[f.fainelli@gmail.com: correctly invoke gdb_eval_or_none] + Link: https://lkml.kernel.org/r/20230327185746.3856407-1-f.fainelli@gmail.com +Link: https://lkml.kernel.org/r/20230323231659.3319941-1-f.fainelli@gmail.com +Fixes: 8207d4a88e1e ("scripts/gdb: add lx-genpd-summary command") +Signed-off-by: Florian Fainelli +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Leonard Crestez +Cc: Stephen Boyd +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/genpd.py | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py +index 39cd1abd85590..b53649c0a77a6 100644 +--- a/scripts/gdb/linux/genpd.py ++++ b/scripts/gdb/linux/genpd.py +@@ -5,7 +5,7 @@ + import gdb + import sys + +-from linux.utils import CachedType ++from linux.utils import CachedType, gdb_eval_or_none + from linux.lists import list_for_each_entry + + generic_pm_domain_type = CachedType('struct generic_pm_domain') +@@ -70,6 +70,8 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary''' + gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev))) + + def invoke(self, arg, from_tty): ++ if gdb_eval_or_none("&gpd_list") is None: ++ raise gdb.GdbError("No power domain(s) registered") + gdb.write('domain status children\n'); + gdb.write(' /device runtime status\n'); + gdb.write('----------------------------------------------------------------------\n'); +-- +2.39.2 + diff --git a/queue-5.15/scripts-gdb-raise-error-with-reduced-debugging-infor.patch b/queue-5.15/scripts-gdb-raise-error-with-reduced-debugging-infor.patch new file mode 100644 index 00000000000..60014380e1a --- /dev/null +++ b/queue-5.15/scripts-gdb-raise-error-with-reduced-debugging-infor.patch @@ -0,0 +1,78 @@ +From dbfdc81905cc92cbf49c9769ca55644fbfc58ffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 14:52:51 -0700 +Subject: scripts/gdb: raise error with reduced debugging information + +From: Florian Fainelli + +[ Upstream commit 8af055ae25bff48f57227f5e3d48a4306f3dd1c4 ] + +If CONFIG_DEBUG_INFO_REDUCED is enabled in the kernel configuration, we +will typically not be able to load vmlinux-gdb.py and will fail with: + +Traceback (most recent call last): + File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/vmlinux-gdb.py", line 25, in + import linux.utils + File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/scripts/gdb/linux/utils.py", line 131, in + atomic_long_counter_offset = atomic_long_type.get_type()['counter'].bitpos +KeyError: 'counter' + +Rather be left wondering what is happening only to find out that reduced +debug information is the cause, raise an eror. This was not typically a +problem until e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch") +but it has since then. + +Link: https://lkml.kernel.org/r/20230406215252.1580538-1-f.fainelli@gmail.com +Fixes: e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch") +Signed-off-by: Florian Fainelli +Cc: Antonio Borneo +Cc: Jan Kiszka +Cc: John Ogness +Cc: Kieran Bingham +Cc: Petr Mladek +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/constants.py.in | 2 ++ + scripts/gdb/vmlinux-gdb.py | 5 ++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/constants.py.in b/scripts/gdb/linux/constants.py.in +index 2efbec6b6b8db..08f0587d15ea1 100644 +--- a/scripts/gdb/linux/constants.py.in ++++ b/scripts/gdb/linux/constants.py.in +@@ -39,6 +39,8 @@ + + import gdb + ++LX_CONFIG(CONFIG_DEBUG_INFO_REDUCED) ++ + /* linux/clk-provider.h */ + if IS_BUILTIN(CONFIG_COMMON_CLK): + LX_GDBPARSED(CLK_GET_RATE_NOCACHE) +diff --git a/scripts/gdb/vmlinux-gdb.py b/scripts/gdb/vmlinux-gdb.py +index 4136dc2c59df2..cd03de50c3bec 100644 +--- a/scripts/gdb/vmlinux-gdb.py ++++ b/scripts/gdb/vmlinux-gdb.py +@@ -22,6 +22,10 @@ except: + gdb.write("NOTE: gdb 7.2 or later required for Linux helper scripts to " + "work.\n") + else: ++ import linux.constants ++ if linux.constants.LX_CONFIG_DEBUG_INFO_REDUCED: ++ raise gdb.GdbError("Reduced debug information will prevent GDB " ++ "from having complete types.\n") + import linux.utils + import linux.symbols + import linux.modules +@@ -32,7 +36,6 @@ else: + import linux.lists + import linux.rbtree + import linux.proc +- import linux.constants + import linux.timerlist + import linux.clk + import linux.genpd +-- +2.39.2 + diff --git a/queue-5.15/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch b/queue-5.15/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch new file mode 100644 index 00000000000..1c1b131d979 --- /dev/null +++ b/queue-5.15/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch @@ -0,0 +1,70 @@ +From 000ba14a283f0831b44c2ce2eb8dd96862cd32ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 15:21:32 +0800 +Subject: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() + +From: Shuchang Li + +[ Upstream commit 91a0c0c1413239d0548b5aac4c82f38f6d53a91e ] + +When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) +returns false, drbl_regs_memmap_p is not remapped. This passes a NULL +pointer to iounmap(), which can trigger a WARN() on certain arches. + +When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4) +returns true, drbl_regs_memmap_p may has been remapped and +ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a +NULL pointer to iounmap(). + +To fix these issues, we need to add null checks before iounmap(), and +change some goto labels. + +Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4") +Signed-off-by: Shuchang Li +Link: https://lore.kernel.org/r/20230404072133.1022-1-lishuchang@hust.edu.cn +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_init.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index f79299f6178cd..2ca4cf1b58c4f 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -11738,7 +11738,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + goto out_iounmap_all; + } else { + error = -ENOMEM; +- goto out_iounmap_all; ++ goto out_iounmap_ctrl; + } + } + +@@ -11756,7 +11756,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + dev_err(&pdev->dev, + "ioremap failed for SLI4 HBA dpp registers.\n"); + error = -ENOMEM; +- goto out_iounmap_ctrl; ++ goto out_iounmap_all; + } + phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p; + } +@@ -11781,9 +11781,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + return 0; + + out_iounmap_all: +- iounmap(phba->sli4_hba.drbl_regs_memmap_p); ++ if (phba->sli4_hba.drbl_regs_memmap_p) ++ iounmap(phba->sli4_hba.drbl_regs_memmap_p); + out_iounmap_ctrl: +- iounmap(phba->sli4_hba.ctrl_regs_memmap_p); ++ if (phba->sli4_hba.ctrl_regs_memmap_p) ++ iounmap(phba->sli4_hba.ctrl_regs_memmap_p); + out_iounmap_conf: + iounmap(phba->sli4_hba.conf_regs_memmap_p); + +-- +2.39.2 + diff --git a/queue-5.15/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch b/queue-5.15/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch new file mode 100644 index 00000000000..b684dc8968d --- /dev/null +++ b/queue-5.15/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch @@ -0,0 +1,38 @@ +From e0283e08ac2ffb59ada8df7f9febdfb2554189f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 17:51:09 +0000 +Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS + +From: Danila Chernetsov + +[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ] + +When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is +dereferenced below. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling") +Signed-off-by: Danila Chernetsov +Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index 7dd6dd74d2bc2..6122cc60a8b3d 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -1443,6 +1443,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status) + */ + if (cmdid == CMDID_INT_CMDS) { + scb = &adapter->int_scb; ++ cmd = scb->cmd; + + list_del_init(&scb->list); + scb->state = SCB_FREE; +-- +2.39.2 + diff --git a/queue-5.15/scsi-target-fix-multiple-lun_reset-handling.patch b/queue-5.15/scsi-target-fix-multiple-lun_reset-handling.patch new file mode 100644 index 00000000000..223c9ef88ec --- /dev/null +++ b/queue-5.15/scsi-target-fix-multiple-lun_reset-handling.patch @@ -0,0 +1,142 @@ +From eaa7268d0d532571099a2379039247ea9f81b527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:18 -0500 +Subject: scsi: target: Fix multiple LUN_RESET handling + +From: Mike Christie + +[ Upstream commit 673db054d7a2b5a470d7a25baf65956d005ad729 ] + +This fixes a bug where an initiator thinks a LUN_RESET has cleaned up +running commands when it hasn't. The bug was added in commit 51ec502a3266 +("target: Delete tmr from list before processing"). + +The problem occurs when: + + 1. We have N I/O cmds running in the target layer spread over 2 sessions. + + 2. The initiator sends a LUN_RESET for each session. + + 3. session1's LUN_RESET loops over all the running commands from both + sessions and moves them to its local drain_task_list. + + 4. session2's LUN_RESET does not see the LUN_RESET from session1 because + the commit above has it remove itself. session2 also does not see any + commands since the other reset moved them off the state lists. + + 5. sessions2's LUN_RESET will then complete with a successful response. + + 6. sessions2's inititor believes the running commands on its session are + now cleaned up due to the successful response and cleans up the running + commands from its side. It then restarts them. + + 7. The commands do eventually complete on the backend and the target + starts to return aborted task statuses for them. The initiator will + either throw a invalid ITT error or might accidentally lookup a new + task if the ITT has been reallocated already. + +Fix the bug by reverting the patch, and serialize the execution of +LUN_RESETs and Preempt and Aborts. + +Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list, +because it turns out the original patch fixed a bug that was not +mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second +LUN_RESET and wait on it. Then the second reset will run +core_tmr_drain_tmr_list and see the first reset and wait on it resulting in +a deadlock. + +Fixes: 51ec502a3266 ("target: Delete tmr from list before processing") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-8-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 1 + + drivers/target/target_core_tmr.c | 26 +++++++++++++++++++++++--- + include/target/target_core_base.h | 1 + + 3 files changed, 25 insertions(+), 3 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index fa866acef5bb2..e18617371a9b2 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -773,6 +773,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + spin_lock_init(&dev->t10_alua.lba_map_lock); + + INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ mutex_init(&dev->lun_reset_mutex); + + dev->t10_wwn.t10_dev = dev; + /* +diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c +index 2b95b4550a637..4718db628222b 100644 +--- a/drivers/target/target_core_tmr.c ++++ b/drivers/target/target_core_tmr.c +@@ -188,14 +188,23 @@ static void core_tmr_drain_tmr_list( + * LUN_RESET tmr.. + */ + spin_lock_irqsave(&dev->se_tmr_lock, flags); +- if (tmr) +- list_del_init(&tmr->tmr_list); + list_for_each_entry_safe(tmr_p, tmr_pp, &dev->dev_tmr_list, tmr_list) { ++ if (tmr_p == tmr) ++ continue; ++ + cmd = tmr_p->task_cmd; + if (!cmd) { + pr_err("Unable to locate struct se_cmd for TMR\n"); + continue; + } ++ ++ /* ++ * We only execute one LUN_RESET at a time so we can't wait ++ * on them below. ++ */ ++ if (tmr_p->function == TMR_LUN_RESET) ++ continue; ++ + /* + * If this function was called with a valid pr_res_key + * parameter (eg: for PROUT PREEMPT_AND_ABORT service action +@@ -379,14 +388,25 @@ int core_tmr_lun_reset( + tmr_nacl->initiatorname); + } + } ++ ++ ++ /* ++ * We only allow one reset or preempt and abort to execute at a time ++ * to prevent one call from claiming all the cmds causing a second ++ * call from returning while cmds it should have waited on are still ++ * running. ++ */ ++ mutex_lock(&dev->lun_reset_mutex); ++ + pr_debug("LUN_RESET: %s starting for [%s], tas: %d\n", + (preempt_and_abort_list) ? "Preempt" : "TMR", + dev->transport->name, tas); +- + core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list); + core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas, + preempt_and_abort_list); + ++ mutex_unlock(&dev->lun_reset_mutex); ++ + /* + * Clear any legacy SPC-2 reservation when called during + * LOGICAL UNIT RESET +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 2121a323fd6c3..c83bb58bfcd1f 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -865,6 +865,7 @@ struct se_device { + struct rcu_head rcu_head; + int queue_cnt; + struct se_device_queue *queues; ++ struct mutex lun_reset_mutex; + }; + + struct se_hba { +-- +2.39.2 + diff --git a/queue-5.15/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch b/queue-5.15/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch new file mode 100644 index 00000000000..ab8441c4f0e --- /dev/null +++ b/queue-5.15/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch @@ -0,0 +1,67 @@ +From 3a0de47913d9269210da866c40e143f084eb0499 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:19 -0500 +Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup + +From: Mike Christie + +[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ] + +Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort +fabric stop race"). + +If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the +last put on the cmd and free it, because the connection is down and we will +not up sending the response and doing the put from the normal I/O +path. + +Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now +detect this case and run iscsit_free_cmd(). + +Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 2c54c5d8412d8..9c6b98438f98f 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4086,9 +4086,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + +- if (se_cmd->se_tfo != NULL) { +- spin_lock_irq(&se_cmd->t_state_lock); +- if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!se_cmd->se_tfo) ++ continue; ++ ++ spin_lock_irq(&se_cmd->t_state_lock); ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!(se_cmd->transport_state & CMD_T_TAS)) + /* + * LIO's abort path owns the cleanup for this, + * so put it back on the list and let +@@ -4096,11 +4099,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + */ + list_move_tail(&cmd->i_conn_node, + &conn->conn_cmd_list); +- } else { +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; +- } +- spin_unlock_irq(&se_cmd->t_state_lock); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; + } ++ spin_unlock_irq(&se_cmd->t_state_lock); + } + spin_unlock_bh(&conn->cmd_lock); + +-- +2.39.2 + diff --git a/queue-5.15/selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch b/queue-5.15/selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch new file mode 100644 index 00000000000..da5d0c5b617 --- /dev/null +++ b/queue-5.15/selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch @@ -0,0 +1,40 @@ +From c416676da310a1022e7957a226fa49d0b4f88ec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 17:07:26 -0700 +Subject: selftests/bpf: Fix a fd leak in an error path in network_helpers.c + +From: Martin KaFai Lau + +[ Upstream commit 226efec2b0efad60d4a6c4b2c3a8710dafc4dc21 ] + +In __start_server, it leaks a fd when setsockopt(SO_REUSEPORT) fails. +This patch fixes it. + +Fixes: eed92afdd14c ("bpf: selftest: Test batching and bpf_(get|set)sockopt in bpf tcp iter") +Reported-by: Andrii Nakryiko +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20230316000726.1016773-2-martin.lau@linux.dev +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/network_helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c +index 6db1af8fdee78..c57e1e47e52f2 100644 +--- a/tools/testing/selftests/bpf/network_helpers.c ++++ b/tools/testing/selftests/bpf/network_helpers.c +@@ -84,7 +84,7 @@ static int __start_server(int type, const struct sockaddr *addr, + if (reuseport && + setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &on, sizeof(on))) { + log_err("Failed to set SO_REUSEPORT"); +- return -1; ++ goto error_close; + } + + if (bind(fd, addr, addrlen) < 0) { +-- +2.39.2 + diff --git a/queue-5.15/selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch b/queue-5.15/selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch new file mode 100644 index 00000000000..2838aa9188d --- /dev/null +++ b/queue-5.15/selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch @@ -0,0 +1,57 @@ +From 8994b14500c02fad61f8086878a69ef113f08c66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 14:04:22 -0700 +Subject: selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach + +From: Song Liu + +[ Upstream commit c1e07a80cf23d3a6e96172bc9a73bfa912a9fcbc ] + +skel->links.oncpu is leaked in one case. This causes test perf_branches +fails when it runs after get_stackid_cannot_attach: + +./test_progs -t get_stackid_cannot_attach,perf_branches +84 get_stackid_cannot_attach:OK +test_perf_branches_common:PASS:test_perf_branches_load 0 nsec +test_perf_branches_common:PASS:attach_perf_event 0 nsec +test_perf_branches_common:PASS:set_affinity 0 nsec +check_good_sample:FAIL:output not valid no valid sample from prog +146/1 perf_branches/perf_branches_hw:FAIL +146/2 perf_branches/perf_branches_no_hw:OK +146 perf_branches:FAIL + +All error logs: +test_perf_branches_common:PASS:test_perf_branches_load 0 nsec +test_perf_branches_common:PASS:attach_perf_event 0 nsec +test_perf_branches_common:PASS:set_affinity 0 nsec +check_good_sample:FAIL:output not valid no valid sample from prog +146/1 perf_branches/perf_branches_hw:FAIL +146 perf_branches:FAIL +Summary: 1/1 PASSED, 0 SKIPPED, 1 FAILED + +Fix this by adding the missing bpf_link__destroy(). + +Fixes: 346938e9380c ("selftests/bpf: Add get_stackid_cannot_attach") +Signed-off-by: Song Liu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230412210423.900851-3-song@kernel.org +Signed-off-by: Sasha Levin +--- + .../testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c b/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c +index 8d5a6023a1bbf..4022c89ea268a 100644 +--- a/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c ++++ b/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c +@@ -65,6 +65,7 @@ void test_get_stackid_cannot_attach(void) + skel->links.oncpu = bpf_program__attach_perf_event(skel->progs.oncpu, + pmu_fd); + ASSERT_OK_PTR(skel->links.oncpu, "attach_perf_event_callchain"); ++ bpf_link__destroy(skel->links.oncpu); + close(pmu_fd); + + /* add exclude_callchain_kernel, attach should fail */ +-- +2.39.2 + diff --git a/queue-5.15/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch b/queue-5.15/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch new file mode 100644 index 00000000000..3409a38e77b --- /dev/null +++ b/queue-5.15/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch @@ -0,0 +1,68 @@ +From f61edb8919f385de78efea4d26caaaf0c00e038a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 19:33:54 +0000 +Subject: selftests/bpf: Wait for receive in cg_storage_multi test + +From: YiFei Zhu + +[ Upstream commit 5af607a861d43ffff830fc1890033e579ec44799 ] + +In some cases the loopback latency might be large enough, causing +the assertion on invocations to be run before ingress prog getting +executed. The assertion would fail and the test would flake. + +This can be reliably reproduced by arbitrarily increasing the +loopback latency (thanks to [1]): + tc qdisc add dev lo root handle 1: htb default 12 + tc class add dev lo parent 1:1 classid 1:12 htb rate 20kbps ceil 20kbps + tc qdisc add dev lo parent 1:12 netem delay 100ms + +Fix this by waiting on the receive end, instead of instantly +returning to the assert. The call to read() will wait for the +default SO_RCVTIMEO timeout of 3 seconds provided by +start_server(). + +[1] https://gist.github.com/kstevens715/4598301 + +Reported-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/9c5c8b7e-1d89-a3af-5400-14fde81f4429@linux.dev/ +Fixes: 3573f384014f ("selftests/bpf: Test CGROUP_STORAGE behavior on shared egress + ingress") +Acked-by: Stanislav Fomichev +Signed-off-by: YiFei Zhu +Link: https://lore.kernel.org/r/20230405193354.1956209-1-zhuyifei@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c +index 876be0ecb654f..a47ea4804766b 100644 +--- a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c ++++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c +@@ -56,8 +56,9 @@ static bool assert_storage_noexist(struct bpf_map *map, const void *key) + + static bool connect_send(const char *cgroup_path) + { +- bool res = true; + int server_fd = -1, client_fd = -1; ++ char message[] = "message"; ++ bool res = true; + + if (join_cgroup(cgroup_path)) + goto out_clean; +@@ -70,7 +71,10 @@ static bool connect_send(const char *cgroup_path) + if (client_fd < 0) + goto out_clean; + +- if (send(client_fd, "message", strlen("message"), 0) < 0) ++ if (send(client_fd, &message, sizeof(message), 0) < 0) ++ goto out_clean; ++ ++ if (read(server_fd, &message, sizeof(message)) < 0) + goto out_clean; + + res = false; +-- +2.39.2 + diff --git a/queue-5.15/selftests-resctrl-allow-setup-to-return-errors.patch b/queue-5.15/selftests-resctrl-allow-setup-to-return-errors.patch new file mode 100644 index 00000000000..28cb223c51b --- /dev/null +++ b/queue-5.15/selftests-resctrl-allow-setup-to-return-errors.patch @@ -0,0 +1,140 @@ +From efb32c497df0e5d7ebe71822f539094fb5aef508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:05:59 +0200 +Subject: selftests/resctrl: Allow ->setup() to return errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit fa10366cc6f4cc862871f8938426d85c2481f084 ] + +resctrl_val() assumes ->setup() always returns either 0 to continue +tests or < 0 in case of the normal termination of tests after x runs. +The latter overlaps with normal error returns. + +Define END_OF_TESTS (=1) to differentiate the normal termination of +tests and return errors as negative values. Alter callers of ->setup() +to handle errors properly. + +Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest") +Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test") +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/cache.c | 4 +++- + tools/testing/selftests/resctrl/cat_test.c | 2 +- + tools/testing/selftests/resctrl/cmt_test.c | 2 +- + tools/testing/selftests/resctrl/mba_test.c | 2 +- + tools/testing/selftests/resctrl/mbm_test.c | 2 +- + tools/testing/selftests/resctrl/resctrl.h | 2 ++ + tools/testing/selftests/resctrl/resctrl_val.c | 4 +++- + 7 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c +index 68ff856d36f0b..0485863a169f2 100644 +--- a/tools/testing/selftests/resctrl/cache.c ++++ b/tools/testing/selftests/resctrl/cache.c +@@ -244,10 +244,12 @@ int cat_val(struct resctrl_val_param *param) + while (1) { + if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { + ret = param->setup(1, param); +- if (ret) { ++ if (ret == END_OF_TESTS) { + ret = 0; + break; + } ++ if (ret < 0) ++ break; + ret = reset_enable_llc_perf(bm_pid, param->cpu_no); + if (ret) + break; +diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c +index 1c5e90c632548..2d3c7c77ab6cb 100644 +--- a/tools/testing/selftests/resctrl/cat_test.c ++++ b/tools/testing/selftests/resctrl/cat_test.c +@@ -40,7 +40,7 @@ static int cat_setup(int num, ...) + + /* Run NUM_OF_RUNS times */ + if (p->num_of_runs >= NUM_OF_RUNS) +- return -1; ++ return END_OF_TESTS; + + if (p->num_of_runs == 0) { + sprintf(schemata, "%lx", p->mask); +diff --git a/tools/testing/selftests/resctrl/cmt_test.c b/tools/testing/selftests/resctrl/cmt_test.c +index 8968e36db99d7..3b0454e7fc826 100644 +--- a/tools/testing/selftests/resctrl/cmt_test.c ++++ b/tools/testing/selftests/resctrl/cmt_test.c +@@ -32,7 +32,7 @@ static int cmt_setup(int num, ...) + + /* Run NUM_OF_RUNS times */ + if (p->num_of_runs >= NUM_OF_RUNS) +- return -1; ++ return END_OF_TESTS; + + p->num_of_runs++; + +diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c +index 1a1bdb6180cf2..f32289ae17aeb 100644 +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -41,7 +41,7 @@ static int mba_setup(int num, ...) + return 0; + + if (allocation < ALLOCATION_MIN || allocation > ALLOCATION_MAX) +- return -1; ++ return END_OF_TESTS; + + sprintf(allocation_str, "%d", allocation); + +diff --git a/tools/testing/selftests/resctrl/mbm_test.c b/tools/testing/selftests/resctrl/mbm_test.c +index 8392e5c55ed02..280187628054d 100644 +--- a/tools/testing/selftests/resctrl/mbm_test.c ++++ b/tools/testing/selftests/resctrl/mbm_test.c +@@ -95,7 +95,7 @@ static int mbm_setup(int num, ...) + + /* Run NUM_OF_RUNS times */ + if (num_of_runs++ >= NUM_OF_RUNS) +- return -1; ++ return END_OF_TESTS; + + va_start(param, num); + p = va_arg(param, struct resctrl_val_param *); +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index f0ded31fb3c7c..f44fa2de4d986 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -37,6 +37,8 @@ + #define ARCH_INTEL 1 + #define ARCH_AMD 2 + ++#define END_OF_TESTS 1 ++ + #define PARENT_EXIT(err_msg) \ + do { \ + perror(err_msg); \ +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index dd907809d0b29..02110e7ee6361 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -734,10 +734,12 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + /* Test runs until the callback setup() tells the test to stop. */ + while (1) { + ret = param->setup(1, param); +- if (ret) { ++ if (ret == END_OF_TESTS) { + ret = 0; + break; + } ++ if (ret < 0) ++ break; + + if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || + !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { +-- +2.39.2 + diff --git a/queue-5.15/selftests-resctrl-check-for-return-value-after-write.patch b/queue-5.15/selftests-resctrl-check-for-return-value-after-write.patch new file mode 100644 index 00000000000..b4faf8a15eb --- /dev/null +++ b/queue-5.15/selftests-resctrl-check-for-return-value-after-write.patch @@ -0,0 +1,56 @@ +From 0c75a418df46520616199b36cef551edffa0b7ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:06:00 +0200 +Subject: selftests/resctrl: Check for return value after write_schemata() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 0d45c83b95da414e98ad333e723141a94f6e2c64 ] + +MBA test case writes schemata but it does not check if the write is +successful or not. + +Add the error check and return error properly. + +Fixes: 01fee6b4d1f9 ("selftests/resctrl: Add MBA test") +Co-developed-by: Fenghua Yu +Signed-off-by: Fenghua Yu +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/mba_test.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c +index f32289ae17aeb..97dc98c0c9497 100644 +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -28,6 +28,7 @@ static int mba_setup(int num, ...) + struct resctrl_val_param *p; + char allocation_str[64]; + va_list param; ++ int ret; + + va_start(param, num); + p = va_arg(param, struct resctrl_val_param *); +@@ -45,7 +46,11 @@ static int mba_setup(int num, ...) + + sprintf(allocation_str, "%d", allocation); + +- write_schemata(p->ctrlgrp, allocation_str, p->cpu_no, p->resctrl_val); ++ ret = write_schemata(p->ctrlgrp, allocation_str, p->cpu_no, ++ p->resctrl_val); ++ if (ret < 0) ++ return ret; ++ + allocation -= ALLOCATION_STEP; + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/selftests-resctrl-extend-cpu-vendor-detection.patch b/queue-5.15/selftests-resctrl-extend-cpu-vendor-detection.patch new file mode 100644 index 00000000000..cc6ee755b77 --- /dev/null +++ b/queue-5.15/selftests-resctrl-extend-cpu-vendor-detection.patch @@ -0,0 +1,163 @@ +From d90f31daa0793f12ca00a97ea5b128a214c27e2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 17:09:27 +0900 +Subject: selftests/resctrl: Extend CPU vendor detection + +From: Shaopeng Tan + +[ Upstream commit 6220f69e72a534838cffd84dce6afd777777be03 ] + +Currently, the resctrl_tests only has a function to detect AMD vendor. +Since when the Intel Sub-NUMA Clustering feature is enabled, +Intel CMT and MBM counters may not be accurate, +the resctrl_tests also need a function to detect Intel vendor. +And in the future, resctrl_tests will need a function to detect different +vendors, such as Arm. + +Extend the function to detect Intel vendor as well. Also, +this function can be easily extended to detect other vendors. + +Signed-off-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shuah Khan +Signed-off-by: Shuah Khan +Stable-dep-of: fa10366cc6f4 ("selftests/resctrl: Allow ->setup() to return errors") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/cat_test.c | 2 +- + tools/testing/selftests/resctrl/resctrl.h | 5 ++- + .../testing/selftests/resctrl/resctrl_tests.c | 41 ++++++++++++------- + tools/testing/selftests/resctrl/resctrlfs.c | 2 +- + 4 files changed, 33 insertions(+), 17 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c +index cd4f68388e0f6..1c5e90c632548 100644 +--- a/tools/testing/selftests/resctrl/cat_test.c ++++ b/tools/testing/selftests/resctrl/cat_test.c +@@ -89,7 +89,7 @@ static int check_results(struct resctrl_val_param *param) + + return show_cache_info(sum_llc_perf_miss, no_of_bits, param->span / 64, + MAX_DIFF, MAX_DIFF_PERCENT, NUM_OF_RUNS, +- !is_amd, false); ++ get_vendor() == ARCH_INTEL, false); + } + + void cat_test_cleanup(void) +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index 1ad10c47e31d1..f0ded31fb3c7c 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -34,6 +34,9 @@ + #define L3_MON_PATH "/sys/fs/resctrl/info/L3_MON" + #define L3_MON_FEATURES_PATH "/sys/fs/resctrl/info/L3_MON/mon_features" + ++#define ARCH_INTEL 1 ++#define ARCH_AMD 2 ++ + #define PARENT_EXIT(err_msg) \ + do { \ + perror(err_msg); \ +@@ -75,8 +78,8 @@ struct resctrl_val_param { + extern pid_t bm_pid, ppid; + + extern char llc_occup_path[1024]; +-extern bool is_amd; + ++int get_vendor(void); + bool check_resctrlfs_support(void); + int filter_dmesg(void); + int remount_resctrlfs(bool mum_resctrlfs); +diff --git a/tools/testing/selftests/resctrl/resctrl_tests.c b/tools/testing/selftests/resctrl/resctrl_tests.c +index 973f09a66e1ee..3e7cdf1125df4 100644 +--- a/tools/testing/selftests/resctrl/resctrl_tests.c ++++ b/tools/testing/selftests/resctrl/resctrl_tests.c +@@ -13,25 +13,41 @@ + #define BENCHMARK_ARGS 64 + #define BENCHMARK_ARG_SIZE 64 + +-bool is_amd; +- +-void detect_amd(void) ++static int detect_vendor(void) + { + FILE *inf = fopen("/proc/cpuinfo", "r"); ++ int vendor_id = 0; ++ char *s = NULL; + char *res; + + if (!inf) +- return; ++ return vendor_id; + + res = fgrep(inf, "vendor_id"); + +- if (res) { +- char *s = strchr(res, ':'); ++ if (res) ++ s = strchr(res, ':'); ++ ++ if (s && !strcmp(s, ": GenuineIntel\n")) ++ vendor_id = ARCH_INTEL; ++ else if (s && !strcmp(s, ": AuthenticAMD\n")) ++ vendor_id = ARCH_AMD; + +- is_amd = s && !strcmp(s, ": AuthenticAMD\n"); +- free(res); +- } + fclose(inf); ++ free(res); ++ return vendor_id; ++} ++ ++int get_vendor(void) ++{ ++ static int vendor = -1; ++ ++ if (vendor == -1) ++ vendor = detect_vendor(); ++ if (vendor == 0) ++ ksft_print_msg("Can not get vendor info...\n"); ++ ++ return vendor; + } + + static void cmd_help(void) +@@ -207,9 +223,6 @@ int main(int argc, char **argv) + if (geteuid() != 0) + return ksft_exit_fail_msg("Not running as root, abort testing.\n"); + +- /* Detect AMD vendor */ +- detect_amd(); +- + if (has_ben) { + /* Extract benchmark command from command line. */ + for (i = ben_ind; i < argc; i++) { +@@ -241,10 +254,10 @@ int main(int argc, char **argv) + + ksft_set_plan(tests ? : 4); + +- if (!is_amd && mbm_test) ++ if ((get_vendor() == ARCH_INTEL) && mbm_test) + run_mbm_test(has_ben, benchmark_cmd, span, cpu_no, bw_report); + +- if (!is_amd && mba_test) ++ if ((get_vendor() == ARCH_INTEL) && mba_test) + run_mba_test(has_ben, benchmark_cmd, span, cpu_no, bw_report); + + if (cmt_test) +diff --git a/tools/testing/selftests/resctrl/resctrlfs.c b/tools/testing/selftests/resctrl/resctrlfs.c +index 5f5a166ade60a..6f543e470ad4a 100644 +--- a/tools/testing/selftests/resctrl/resctrlfs.c ++++ b/tools/testing/selftests/resctrl/resctrlfs.c +@@ -106,7 +106,7 @@ int get_resource_id(int cpu_no, int *resource_id) + char phys_pkg_path[1024]; + FILE *fp; + +- if (is_amd) ++ if (get_vendor() == ARCH_AMD) + sprintf(phys_pkg_path, "%s%d/cache/index3/id", + PHYS_ID_PATH, cpu_no); + else +-- +2.39.2 + diff --git a/queue-5.15/selftests-resctrl-move-setup-call-outside-of-test-sp.patch b/queue-5.15/selftests-resctrl-move-setup-call-outside-of-test-sp.patch new file mode 100644 index 00000000000..dd9159c7de9 --- /dev/null +++ b/queue-5.15/selftests-resctrl-move-setup-call-outside-of-test-sp.patch @@ -0,0 +1,75 @@ +From 31422a5456657c730b8435c6045dd8d3f1e8b1c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:05:58 +0200 +Subject: selftests/resctrl: Move ->setup() call outside of test specific + branches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit c90b3b588e369c20087699316259fa5ebbb16f2d ] + +resctrl_val() function is called only by MBM, MBA, and CMT tests which +means the else branch is never used. + +Both test branches call param->setup(). + +Remove the unused else branch and place the ->setup() call outside of +the test specific branches reducing code duplication. + +Co-developed-by: Fenghua Yu +Signed-off-by: Fenghua Yu +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Stable-dep-of: fa10366cc6f4 ("selftests/resctrl: Allow ->setup() to return errors") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl_val.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index 95224345c78e7..dd907809d0b29 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -733,29 +733,22 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + + /* Test runs until the callback setup() tells the test to stop. */ + while (1) { ++ ret = param->setup(1, param); ++ if (ret) { ++ ret = 0; ++ break; ++ } ++ + if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || + !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { +- ret = param->setup(1, param); +- if (ret) { +- ret = 0; +- break; +- } +- + ret = measure_vals(param, &bw_resc_start); + if (ret) + break; + } else if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { +- ret = param->setup(1, param); +- if (ret) { +- ret = 0; +- break; +- } + sleep(1); + ret = measure_cache_vals(param, bm_pid); + if (ret) + break; +- } else { +- break; + } + } + +-- +2.39.2 + diff --git a/queue-5.15/selftests-resctrl-return-null-if-malloc_and_init_mem.patch b/queue-5.15/selftests-resctrl-return-null-if-malloc_and_init_mem.patch new file mode 100644 index 00000000000..822fbac3326 --- /dev/null +++ b/queue-5.15/selftests-resctrl-return-null-if-malloc_and_init_mem.patch @@ -0,0 +1,46 @@ +From 0d672fea0557ba6f8edc85ad0a4bf1b13b642b74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:05:57 +0200 +Subject: selftests/resctrl: Return NULL if malloc_and_init_memory() did not + alloc mem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 22a8be280383812235131dda18a8212a59fadd2d ] + +malloc_and_init_memory() in fill_buf isn't checking if memalign() +successfully allocated memory or not before accessing the memory. + +Check the return value of memalign() and return NULL if allocating +aligned memory fails. + +Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark") +Co-developed-by: Fenghua Yu +Signed-off-by: Fenghua Yu +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/fill_buf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c +index 56ccbeae0638d..c20d0a7ecbe63 100644 +--- a/tools/testing/selftests/resctrl/fill_buf.c ++++ b/tools/testing/selftests/resctrl/fill_buf.c +@@ -68,6 +68,8 @@ static void *malloc_and_init_memory(size_t s) + size_t s64; + + void *p = memalign(PAGE_SIZE, s); ++ if (!p) ++ return NULL; + + p64 = (uint64_t *)p; + s64 = s / sizeof(uint64_t); +-- +2.39.2 + diff --git a/queue-5.15/selftests-xsk-disable-ipv6-on-veth1.patch b/queue-5.15/selftests-xsk-disable-ipv6-on-veth1.patch new file mode 100644 index 00000000000..7395ff39251 --- /dev/null +++ b/queue-5.15/selftests-xsk-disable-ipv6-on-veth1.patch @@ -0,0 +1,45 @@ +From 9f0f7edbd41a5299b7b24e5bb6ad9ea8a6e40d8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 10:29:04 +0200 +Subject: selftests: xsk: Disable IPv6 on VETH1 + +From: Kal Conley + +[ Upstream commit f2b50f17268390567bc0e95642170d88f336c8f4 ] + +This change fixes flakiness in the BIDIRECTIONAL test: + + # [is_pkt_valid] expected length [60], got length [90] + not ok 1 FAIL: SKB BUSY-POLL BIDIRECTIONAL + +When IPv6 is enabled, the interface will periodically send MLDv1 and +MLDv2 packets. These packets can cause the BIDIRECTIONAL test to fail +since it uses VETH0 for RX. + +For other tests, this was not a problem since they only receive on VETH1 +and IPv6 was already disabled on VETH0. + +Fixes: a89052572ebb ("selftests/bpf: Xsk selftests framework") +Signed-off-by: Kal Conley +Link: https://lore.kernel.org/r/20230405082905.6303-1-kal.conley@dectris.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_xsk.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh +index cd7bf32e6a173..661995af75602 100755 +--- a/tools/testing/selftests/bpf/test_xsk.sh ++++ b/tools/testing/selftests/bpf/test_xsk.sh +@@ -106,6 +106,7 @@ setup_vethPairs() { + ip link add ${VETH0} numtxqueues 4 numrxqueues 4 type veth peer name ${VETH1} numtxqueues 4 numrxqueues 4 + if [ -f /proc/net/if_inet6 ]; then + echo 1 > /proc/sys/net/ipv6/conf/${VETH0}/disable_ipv6 ++ echo 1 > /proc/sys/net/ipv6/conf/${VETH1}/disable_ipv6 + fi + if [[ $verbose -eq 1 ]]; then + echo "setting up ${VETH1}: namespace: ${NS1}" +-- +2.39.2 + diff --git a/queue-5.15/selinux-ensure-av_permissions.h-is-built-when-needed.patch b/queue-5.15/selinux-ensure-av_permissions.h-is-built-when-needed.patch new file mode 100644 index 00000000000..796c9815a5c --- /dev/null +++ b/queue-5.15/selinux-ensure-av_permissions.h-is-built-when-needed.patch @@ -0,0 +1,36 @@ +From 92f930f55973f7ef9ecd0fefa54d56ff100657b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:29:11 -0400 +Subject: selinux: ensure av_permissions.h is built when needed + +From: Paul Moore + +[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ] + +The Makefile rule responsible for building flask.h and +av_permissions.h only lists flask.h as a target which means that +av_permissions.h is only generated when flask.h needs to be +generated. This patch fixes this by adding av_permissions.h as a +target to the rule. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index 103c2776478a7..0aecf9334ec31 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -26,5 +26,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h + cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE ++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-5.15/selinux-fix-makefile-dependencies-of-flask.h.patch b/queue-5.15/selinux-fix-makefile-dependencies-of-flask.h.patch new file mode 100644 index 00000000000..23d1c469fcb --- /dev/null +++ b/queue-5.15/selinux-fix-makefile-dependencies-of-flask.h.patch @@ -0,0 +1,43 @@ +From 5795e2b0b4bb14d0ec64e67e8f2d13c85b8f2244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 15:59:19 +0200 +Subject: selinux: fix Makefile dependencies of flask.h + +From: Ondrej Mosnacek + +[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ] + +Make the flask.h target depend on the genheaders binary instead of +classmap.h to ensure that it is rebuilt if any of the dependencies of +genheaders are changed. + +Notably this fixes flask.h not being rebuilt when +initial_sid_to_string.h is modified. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Ondrej Mosnacek +Acked-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index 7761624448826..103c2776478a7 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -23,8 +23,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include + $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h + + quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h +- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h ++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: $(src)/include/classmap.h FORCE ++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-5.15/serial-8250-add-missing-wakeup-event-reporting.patch b/queue-5.15/serial-8250-add-missing-wakeup-event-reporting.patch new file mode 100644 index 00000000000..3fc875f591a --- /dev/null +++ b/queue-5.15/serial-8250-add-missing-wakeup-event-reporting.patch @@ -0,0 +1,53 @@ +From f950eb5b5321e3b8e6c2c4113daf893532951c0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 10:02:39 -0700 +Subject: serial: 8250: Add missing wakeup event reporting + +From: Florian Fainelli + +[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ] + +An 8250 UART configured as a wake-up source would not have reported +itself through sysfs as being the source of wake-up, correct that. + +Fixes: b3b708fa2780 ("wake up from a serial port") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 691e7a07565c5..5939f510cb0cf 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1904,6 +1905,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + { + unsigned char status; + struct uart_8250_port *up = up_to_u8250p(port); ++ struct tty_port *tport = &port->state->port; + bool skip_rx = false; + unsigned long flags; + +@@ -1928,6 +1930,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + skip_rx = true; + + if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) { ++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) ++ pm_wakeup_event(tport->tty->dev, 0); + if (!up->dma || handle_rx_dma(up, iir)) + status = serial8250_rx_chars(up, status); + } +-- +2.39.2 + diff --git a/queue-5.15/serial-8250_bcm7271-fix-arbitration-handling.patch b/queue-5.15/serial-8250_bcm7271-fix-arbitration-handling.patch new file mode 100644 index 00000000000..926828c1ab3 --- /dev/null +++ b/queue-5.15/serial-8250_bcm7271-fix-arbitration-handling.patch @@ -0,0 +1,93 @@ +From 00e9759115aefdf33c1ab75b7706581e00274118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 11:02:24 -0800 +Subject: serial: 8250_bcm7271: Fix arbitration handling + +From: Doug Berger + +[ Upstream commit 15ac1122fd6d4bf408a03e6f23c7ad4f60b22f9e ] + +The arbitration of the UART DMA is mishandled for a few +exceptional cases when probing and releasing the driver. + +It is possible that the DMA register spaces are not defined in +device tree for an instance of the driver, so attempts to access +the registers in brcmuart_arbitration() would use NULL pointers. + +It is also possible for the probe function to return an error +while still holding the UART DMA. This would prevent the UART +DMA from being claimed by an instance that could use it. + +These errors are addressed by only releasing the UART DMA if it +is held by this instance (i.e. priv->dma_enabled == 1) and +directing early error paths in probe to this common release_dma +handling. + +Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230309190224.687380-1-opendmb@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_bcm7271.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_bcm7271.c b/drivers/tty/serial/8250/8250_bcm7271.c +index 60b3ac1a03175..87ff28a3a94c5 100644 +--- a/drivers/tty/serial/8250/8250_bcm7271.c ++++ b/drivers/tty/serial/8250/8250_bcm7271.c +@@ -1018,14 +1018,16 @@ static int brcmuart_probe(struct platform_device *pdev) + /* See if a Baud clock has been specified */ + baud_mux_clk = of_clk_get_by_name(np, "sw_baud"); + if (IS_ERR(baud_mux_clk)) { +- if (PTR_ERR(baud_mux_clk) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(baud_mux_clk) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto release_dma; ++ } + dev_dbg(dev, "BAUD MUX clock not specified\n"); + } else { + dev_dbg(dev, "BAUD MUX clock found\n"); + ret = clk_prepare_enable(baud_mux_clk); + if (ret) +- return ret; ++ goto release_dma; + priv->baud_mux_clk = baud_mux_clk; + init_real_clk_rates(dev, priv); + clk_rate = priv->default_mux_rate; +@@ -1033,7 +1035,8 @@ static int brcmuart_probe(struct platform_device *pdev) + + if (clk_rate == 0) { + dev_err(dev, "clock-frequency or clk not defined\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto release_dma; + } + + dev_dbg(dev, "DMA is %senabled\n", priv->dma_enabled ? "" : "not "); +@@ -1120,7 +1123,9 @@ static int brcmuart_probe(struct platform_device *pdev) + serial8250_unregister_port(priv->line); + err: + brcmuart_free_bufs(dev, priv); +- brcmuart_arbitration(priv, 0); ++release_dma: ++ if (priv->dma_enabled) ++ brcmuart_arbitration(priv, 0); + return ret; + } + +@@ -1132,7 +1137,8 @@ static int brcmuart_remove(struct platform_device *pdev) + hrtimer_cancel(&priv->hrt); + serial8250_unregister_port(priv->line); + brcmuart_free_bufs(&pdev->dev, priv); +- brcmuart_arbitration(priv, 0); ++ if (priv->dma_enabled) ++ brcmuart_arbitration(priv, 0); + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch b/queue-5.15/serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch new file mode 100644 index 00000000000..9c91587b9ab --- /dev/null +++ b/queue-5.15/serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch @@ -0,0 +1,51 @@ +From 1bd387c12d9a31c544dafbf5914d450ba2998de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 05:22:52 +0100 +Subject: serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data + are transmitted + +From: Marek Vasut + +[ Upstream commit c47527cbcc3c50800f34b8c684f29721f75de246 ] + +The stm32_usart_transmit_chars() may be called with empty or stopped +transmit queue, and no XON/OFF character pending. This can happen at +the end of transmission, where this last call is used to either handle +the XON/XOFF x_char, or disable TX interrupt if queue is empty or +stopped. + +If that occurs, do not assert the RS485 RTS/DE GPIO anymore, as the +GPIO would remain asserted past the end of transmission and that would +block the RS485 bus after the transmission. + +Only assert the RS485 RTS/DE GPIO if there is either pending XON/XOFF +x_char, or at least one character in running transmit queue. + +Fixes: d7c76716169d ("serial: stm32: Use TC interrupt to deassert GPIO RTS in RS485 mode") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230223042252.95480-2-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 0e8158cfaf0f9..3b7d4481edbea 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -502,8 +502,9 @@ static void stm32_usart_transmit_chars(struct uart_port *port) + int ret; + + if (!stm32_port->hw_flow_control && +- port->rs485.flags & SER_RS485_ENABLED) { +- stm32_port->txdone = false; ++ port->rs485.flags & SER_RS485_ENABLED && ++ (port->x_char || ++ !(uart_circ_empty(xmit) || uart_tx_stopped(port)))) { + stm32_usart_tc_interrupt_disable(port); + stm32_usart_rs485_rts_enable(port); + } +-- +2.39.2 + diff --git a/queue-5.15/serial-stm32-re-introduce-an-irq-flag-condition-in-u.patch b/queue-5.15/serial-stm32-re-introduce-an-irq-flag-condition-in-u.patch new file mode 100644 index 00000000000..54f480c6d04 --- /dev/null +++ b/queue-5.15/serial-stm32-re-introduce-an-irq-flag-condition-in-u.patch @@ -0,0 +1,88 @@ +From 0913630062600bef4a7eeebe1ccc1428530e7294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 17:03:30 +0200 +Subject: serial: stm32: re-introduce an irq flag condition in + usart_receive_chars + +From: Erwan Le Ray + +[ Upstream commit cc58d0a3f0a4755b9c808e065d9227c6e984e7db ] + +Re-introduce an irq flag condition in usart_receive_chars. +This condition has been deleted by commit 75f4e830fa9c ("serial: do not +restore interrupt state in sysrq helper"). +This code was present to handle threaded case, and has been removed +because it is no more needed in this case. Nevertheless an irq safe lock +is still needed in some cases, when DMA should be stopped to receive errors +or breaks in PIO mode. +This patch is a precursor to the complete rework or stm32 serial driver +DMA implementation. + +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20211020150332.10214-2-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: c47527cbcc3c ("serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 5c60960e185d2..0e8158cfaf0f9 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -264,19 +264,22 @@ static unsigned long stm32_usart_get_char(struct uart_port *port, u32 *sr, + return c; + } + +-static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) ++static void stm32_usart_receive_chars(struct uart_port *port, bool irqflag) + { + struct tty_port *tport = &port->state->port; + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- unsigned long c; ++ unsigned long c, flags; + u32 sr; + char flag; + +- spin_lock(&port->lock); ++ if (irqflag) ++ spin_lock_irqsave(&port->lock, flags); ++ else ++ spin_lock(&port->lock); + + while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res, +- threaded)) { ++ irqflag)) { + sr |= USART_SR_DUMMY_RX; + flag = TTY_NORMAL; + +@@ -330,7 +333,10 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + uart_insert_char(port, sr, USART_SR_ORE, c, flag); + } + +- uart_unlock_and_check_sysrq(port); ++ if (irqflag) ++ uart_unlock_and_check_sysrq_irqrestore(port, irqflag); ++ else ++ uart_unlock_and_check_sysrq(port); + + tty_flip_buffer_push(tport); + } +@@ -599,10 +605,9 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) + { + struct uart_port *port = ptr; +- struct stm32_port *stm32_port = to_stm32_port(port); + +- if (stm32_port->rx_ch) +- stm32_usart_receive_chars(port, true); ++ /* Receiver timeout irq for DMA RX */ ++ stm32_usart_receive_chars(port, false); + + return IRQ_HANDLED; + } +-- +2.39.2 + diff --git a/queue-5.15/series b/queue-5.15/series index 56af4d82f06..4246299964b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -57,3 +57,299 @@ ubi-fix-return-value-overwrite-issue-in-try_write_vid_and_data.patch ubifs-free-memory-for-tmpfile-name.patch xfs-don-t-consider-future-format-versions-valid.patch sound-oss-dmasound-fix-build-when-drivers-are-mixed-y-m.patch +rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch +selftests-resctrl-return-null-if-malloc_and_init_mem.patch +selftests-resctrl-extend-cpu-vendor-detection.patch +selftests-resctrl-move-setup-call-outside-of-test-sp.patch +selftests-resctrl-allow-setup-to-return-errors.patch +selftests-resctrl-check-for-return-value-after-write.patch +selinux-fix-makefile-dependencies-of-flask.h.patch +selinux-ensure-av_permissions.h-is-built-when-needed.patch +tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch +tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch +tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch +tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch +tpm-tpm-implement-usage-counter-for-locality.patch +tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch +erofs-stop-parsing-non-compact-head-index-if-cluster.patch +erofs-fix-potential-overflow-calculating-xattr_isize.patch +drm-rockchip-drop-unbalanced-obj-unref.patch +drm-vgem-add-missing-mutex_destroy.patch +drm-probe-helper-cancel-previous-job-before-starting.patch +tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch +soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch +arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch +arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch +drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch +edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch +regulator-core-shorten-off-on-delay-us-for-always-on.patch +arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch +arm64-dts-broadcom-bcm4908-add-dt-for-netgear-raxe50.patch +arm64-dts-add-dts-files-for-bcmbca-soc-bcm63158.patch +arm64-dts-add-dts-files-for-bcmbca-soc-bcm4912.patch +arm64-dts-add-dts-files-for-bcmbca-soc-bcm6858.patch +arm64-dts-add-base-dts-file-for-bcmbca-device-asus-g.patch +arm64-dts-move-bcm4908-dts-to-bcmbca-folder.patch +arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch +arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch +arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch +arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch +arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-ipq6018-switch-tcsr-mutex-to-mmio.patch +arm64-dts-qcom-ipq6018-improve-pcie-phy-pcs-reg-tabl.patch +arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch +arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch +arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch +arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch +arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch +x86-mce-amd-use-an-u64-for-bank_map.patch +media-bdisp-add-missing-check-for-create_workqueue.patch +media-av7110-prevent-underflow-in-write_ts_to_decode.patch +firmware-qcom_scm-clear-download-bit-during-reboot.patch +drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch +media-max9286-free-control-handler.patch +drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch +drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch +drm-msm-adreno-disable-preemption-on-adreno-510.patch +drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch +acpi-processor-fix-evaluating-_pdc-method-when-runni.patch +mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch +drm-rcar-du-fix-a-null-vs-is_err-bug.patch +arm-dts-gta04-fix-excess-dma-channel-usage.patch +firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch +acpi-viot-initialize-the-correct-iommu-fwspec.patch +drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch +mailbox-mpfs-switch-to-txdone_poll.patch +arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch +arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch +arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch +arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch +arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch +arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch +arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch +arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch +arm64-dts-qcom-apq8096-db820c-add-missing-regulator-.patch +arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch +drm-ttm-optimize-pool-allocations-a-bit-v2.patch +drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch +regulator-core-consistently-set-mutex_owner-when-usi.patch +regulator-core-avoid-lockdep-reports-when-resolving-.patch +x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch +media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch +media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch +media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch +media-rcar_fdp1-make-use-of-the-helper-function-devm.patch +media-rcar_fdp1-fix-the-correct-variable-assignments.patch +platform-provide-a-remove-callback-that-returns-no-v.patch +media-rcar_fdp1-convert-to-platform-remove-callback-.patch +media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch +drm-amd-display-fix-potential-null-dereference.patch +media-rc-gpio-ir-recv-fix-support-for-wake-up.patch +media-venus-dec-fix-handling-of-the-start-cmd.patch +regulator-stm32-pwr-fix-of_iomap-leak.patch +x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch +arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch +debugobject-prevent-init-race-with-static-objects.patch +drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch +tick-common-align-tick-period-with-the-hz-tick.patch +cpufreq-use-correct-unit-when-verify-cur-freq.patch +hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch +wifi-ath6kl-minor-fix-for-allocation-size.patch +wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch +wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch +wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch +wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch +tools-bpftool-remove-invalid-json-escape.patch +wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch +wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch +bpf-take-into-account-liveness-when-propagating-prec.patch +bpf-fix-precision-propagation-verbose-logging.patch +scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch +selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch +bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch +net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch +vlan-partially-enable-siocshwtstamp-in-container.patch +net-packet-annotate-accesses-to-po-xmit.patch +net-packet-convert-po-origdev-to-an-atomic-flag.patch +net-packet-convert-po-auxdata-to-an-atomic-flag.patch +scsi-target-fix-multiple-lun_reset-handling.patch +scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch +scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch +f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch +f2fs-enforce-single-zone-capacity.patch +f2fs-apply-zone-capacity-to-all-zone-type.patch +f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch +crypto-caam-clear-some-memory-in-instantiate_rng.patch +crypto-sa2ul-select-crypto_des.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-15397 +wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch +net-qrtr-correct-types-of-trace-event-parameters.patch +selftests-xsk-disable-ipv6-on-veth1.patch +selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch +bpftool-fix-bug-for-long-instructions-in-program-cfg.patch +crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch +crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch +xsk-fix-unaligned-descriptor-validation.patch +f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch +scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch +net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch +bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch +nvmet-use-i_size_read-to-set-size-for-file-ns.patch +nvmet-move-the-call-to-nvmet_ns_changed-out-of-nvmet.patch +nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch +nvmet-fix-identify-namespace-handling.patch +nvmet-fix-identify-controller-handling.patch +nvmet-fix-identify-active-namespace-id-list-handling.patch +nvmet-fix-i-o-command-set-specific-identify-controll.patch +nvme-handle-the-persistent-internal-error-aer.patch +nvme-fix-async-event-trace-event.patch +nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch +selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch +bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch +md-drop-queue-limitation-for-raid1-and-raid10.patch +md-raid10-add-nowait-support.patch +md-raid10-factor-out-code-from-wait_barrier-to-stop_.patch +md-raid10-fix-task-hung-in-raid10d.patch +md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch +md-raid10-fix-memleak-for-conf-bio_split.patch +md-raid10-fix-memleak-of-md-thread.patch +md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch +wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch +wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch +wifi-iwlwifi-mvm-initialize-seq-variable.patch +wifi-iwlwifi-fw-move-memset-before-early-return.patch +jdb2-don-t-refuse-invalidation-of-already-invalidate.patch +wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch +wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch +wifi-mt76-add-flexible-polling-wait-interval-support.patch +wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch +wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch +wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch +wifi-iwlwifi-mvm-check-firmware-response-size.patch +wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch +ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch +ixgbe-enable-setting-rss-table-to-default-values.patch +net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch +net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch +bpf-don-t-efault-for-getsockopt-with-optval-null.patch +netfilter-nf_tables-don-t-write-table-validation-sta.patch +net-sched-sch_fq-fix-integer-overflow-of-credit.patch +ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch +revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch +netlink-use-copy_to_user-for-optval-in-netlink_getso.patch +net-amd-fix-link-leak-when-verifying-config-failed.patch +tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch +ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch +drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch +drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch +pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch +usb-host-xhci-rcar-remove-leftover-quirk-handling.patch +usb-dwc3-gadget-change-condition-for-processing-susp.patch +serial-stm32-re-introduce-an-irq-flag-condition-in-u.patch +serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch +fpga-bridge-fix-kernel-doc-parameter-description.patch +iio-light-max44009-add-missing-of-device-matching.patch +serial-8250_bcm7271-fix-arbitration-handling.patch +spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch +spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch +usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch +pci-imx6-install-the-fault-handler-only-on-compatibl.patch +asoc-es8316-handle-optional-irq-assignment.patch +linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch +spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch +spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch +vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch +of-fix-modalias-string-generation.patch +pci-edr-clear-device-status-after-edr-error-recovery.patch +ia64-mm-contig-fix-section-mismatch-warning-error.patch +ia64-salinfo-placate-defined-but-not-used-warning.patch +scripts-gdb-bail-early-if-there-are-no-clocks.patch +scripts-gdb-bail-early-if-there-are-no-generic-pd.patch +hid-amd_sfh-add-support-for-shutdown-operation.patch +coresight-etm_pmu-set-the-module-field.patch +asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch +spi-cadence-quadspi-fix-suspend-resume-implementatio.patch +i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch +scripts-gdb-raise-error-with-reduced-debugging-infor.patch +uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch +sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch +usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch +usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch +usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch +firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch +tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch +serial-8250-add-missing-wakeup-event-reporting.patch +staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch +spmi-add-a-check-for-remove-callback-when-removing-a.patch +virtio_ring-don-t-update-event-idx-on-get_buf.patch +spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch +macintosh-windfarm_smu_sat-add-missing-of_node_put.patch +powerpc-mpc512x-fix-resource-printk-format-warning.patch +powerpc-wii-fix-resource-printk-format-warnings.patch +powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch +macintosh-via-pmu-led-requires-ata-to-be-set.patch +powerpc-rtas-use-memmove-for-potentially-overlapping.patch +sched-fair-use-__schedstat_set-in-set_next_entity.patch +sched-make-struct-sched_statistics-independent-of-fa.patch +sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch +perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch +revert-objtool-support-addition-to-set-cfa-base.patch +sched-rt-fix-bad-task-migration-for-rt-tasks.patch +clk-at91-clk-sam9x60-pll-fix-return-value-check.patch +rdma-siw-fix-potential-page_array-out-of-range-acces.patch +rdma-rdmavt-delete-unnecessary-null-check.patch +workqueue-introduce-show_one_worker_pool-and-show_on.patch +workqueue-fix-hung-time-report-of-worker-pools.patch +rtc-omap-include-header-for-omap_rtc_power_off_progr.patch +rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch +rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch +fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch +fs-ntfs3-add-check-for-kmemdup.patch +fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch +fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch +fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch +power-supply-generic-adc-battery-fix-unit-scaling.patch +clk-add-missing-of_node_put-in-assigned-clocks-prope.patch +rdma-siw-remove-namespace-check-from-siw_netdev_even.patch +clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch +rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch +rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch +ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch +ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch +nfsv4.1-always-send-a-reclaim_complete-after-establi.patch +clk-qcom-regmap-add-phy-clock-source-implementation.patch +clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch +input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch +rdma-mlx5-fix-flow-counter-query-via-devx.patch +sunrpc-remove-the-maximum-number-of-retries-in-call_.patch +rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch +clocksource-drivers-davinci-fix-memory-leak-in-davin.patch +openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch +timekeeping-fix-references-to-nonexistent-ktime_get_.patch +smb3-add-missing-locks-to-protect-deferred-close-fil.patch +smb3-close-deferred-file-handles-in-case-of-handle-l.patch +ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch +ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch +pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch +leds-ti_lmu_common-select-regmap-instead-of-dependin.patch +dmaengine-mv_xor_v2-fix-an-error-code.patch +leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch +pwm-mtk-disp-disable-shadow-registers-before-setting.patch +pwm-mtk-disp-configure-double-buffering-before-readi.patch +phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch +dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch +dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch +dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch +dmaengine-at_xdmac-fix-concurrency-over-chan-s-compl.patch +dmaengine-at_xdmac-fix-race-for-the-tx-desc-callback.patch +dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch +thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch +mfd-tqmx86-do-not-access-i2c_detect-register-through.patch +mfd-tqmx86-specify-io-port-register-range-more-preci.patch +mfd-tqmx86-correct-board-names-for-tqmxe39x.patch +afs-fix-updating-of-i_size-with-dv-jump-from-server.patch diff --git a/queue-5.15/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch b/queue-5.15/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch new file mode 100644 index 00000000000..50e6fcd2c3c --- /dev/null +++ b/queue-5.15/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch @@ -0,0 +1,44 @@ +From 32f3a96207e3c47666088386db33b708369ed9da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 13:48:52 +0200 +Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer + +From: John Paul Adrian Glaubitz + +[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ] + +The Store Queue code allocates a bitmap buffer with the size of +multiple of sizeof(long) in sq_api_init(). While the buffer size +is calculated correctly, the code uses the wrong element size to +allocate the buffer which results in the allocated bitmap buffer +being too small. + +Fix this by allocating the buffer with kcalloc() with element size +sizeof(long) instead of kzalloc() whose elements size defaults to +sizeof(char). + +Fixes: d7c30c682a27 ("sh: Store Queue API rework.") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4/sq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c +index d432164b23b7c..c31ec0fea3003 100644 +--- a/arch/sh/kernel/cpu/sh4/sq.c ++++ b/arch/sh/kernel/cpu/sh4/sq.c +@@ -381,7 +381,7 @@ static int __init sq_api_init(void) + if (unlikely(!sq_cache)) + return ret; + +- sq_bitmap = kzalloc(size, GFP_KERNEL); ++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL); + if (unlikely(!sq_bitmap)) + goto out; + +-- +2.39.2 + diff --git a/queue-5.15/smb3-add-missing-locks-to-protect-deferred-close-fil.patch b/queue-5.15/smb3-add-missing-locks-to-protect-deferred-close-fil.patch new file mode 100644 index 00000000000..4bbff355509 --- /dev/null +++ b/queue-5.15/smb3-add-missing-locks-to-protect-deferred-close-fil.patch @@ -0,0 +1,60 @@ +From 2e41bafe19b9b82cd682daa3db9448fbf1d98cc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 13:54:33 +0000 +Subject: SMB3: Add missing locks to protect deferred close file list + +From: Bharath SM + +[ Upstream commit ab9ddc87a9055c4bebd6524d5d761d605d52e557 ] + +cifs_del_deferred_close function has a critical section which modifies +the deferred close file list. We must acquire deferred_lock before +calling cifs_del_deferred_close function. + +Fixes: ca08d0eac020 ("cifs: Fix memory leak on the deferred close") +Signed-off-by: Bharath SM +Acked-off-by: Paulo Alcantara (SUSE) +Acked-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/misc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 300f5f382e43f..15e8ae31ffbc9 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -733,7 +733,9 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) + list_for_each_entry(cfile, &cifs_inode->openFileList, flist) { + if (delayed_work_pending(&cfile->deferred)) { + if (cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&cifs_inode->deferred_lock); + cifs_del_deferred_close(cfile); ++ spin_unlock(&cifs_inode->deferred_lock); + + tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); + if (tmp_list == NULL) +@@ -766,7 +768,9 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) + cfile = list_entry(tmp, struct cifsFileInfo, tlist); + if (delayed_work_pending(&cfile->deferred)) { + if (cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + cifs_del_deferred_close(cfile); ++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + + tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); + if (tmp_list == NULL) +@@ -803,7 +807,9 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) + if (strstr(full_path, path)) { + if (delayed_work_pending(&cfile->deferred)) { + if (cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + cifs_del_deferred_close(cfile); ++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + + tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); + if (tmp_list == NULL) +-- +2.39.2 + diff --git a/queue-5.15/smb3-close-deferred-file-handles-in-case-of-handle-l.patch b/queue-5.15/smb3-close-deferred-file-handles-in-case-of-handle-l.patch new file mode 100644 index 00000000000..c240efef300 --- /dev/null +++ b/queue-5.15/smb3-close-deferred-file-handles-in-case-of-handle-l.patch @@ -0,0 +1,72 @@ +From 9c039b9806b68a2b6a41816c288b0ff620a50ec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 14:05:16 +0000 +Subject: SMB3: Close deferred file handles in case of handle lease break + +From: Bharath SM + +[ Upstream commit d906be3fa571f6fc9381911304a0eca99f1b6951 ] + +We should not cache deferred file handles if we dont have +handle lease on a file. And we should immediately close all +deferred handles in case of handle lease break. + +Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.") +Signed-off-by: Bharath SM +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/file.c | 16 ++++++++++++++++ + fs/cifs/misc.c | 2 +- + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index b3cf9ab50139d..ebf2877dbe76c 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -4870,6 +4870,8 @@ void cifs_oplock_break(struct work_struct *work) + struct TCP_Server_Info *server = tcon->ses->server; + int rc = 0; + bool purge_cache = false; ++ struct cifs_deferred_close *dclose; ++ bool is_deferred = false; + + wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS, + TASK_UNINTERRUPTIBLE); +@@ -4905,6 +4907,20 @@ void cifs_oplock_break(struct work_struct *work) + cifs_dbg(VFS, "Push locks rc = %d\n", rc); + + oplock_break_ack: ++ /* ++ * When oplock break is received and there are no active ++ * file handles but cached, then schedule deferred close immediately. ++ * So, new open will not use cached handle. ++ */ ++ spin_lock(&CIFS_I(inode)->deferred_lock); ++ is_deferred = cifs_is_deferred_close(cfile, &dclose); ++ spin_unlock(&CIFS_I(inode)->deferred_lock); ++ ++ if (!CIFS_CACHE_HANDLE(cinode) && is_deferred && ++ cfile->deferred_close_scheduled && delayed_work_pending(&cfile->deferred)) { ++ cifs_close_deferred_file(cinode); ++ } ++ + /* + * releasing stale oplock after recent reconnect of smb session using + * a now incorrect file handle is not a data integrity issue but do +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 15e8ae31ffbc9..5e4dab5dfb7a3 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -748,7 +748,7 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) + spin_unlock(&cifs_inode->open_file_lock); + + list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { +- _cifsFileInfo_put(tmp_list->cfile, true, false); ++ _cifsFileInfo_put(tmp_list->cfile, false, false); + list_del(&tmp_list->list); + kfree(tmp_list); + } +-- +2.39.2 + diff --git a/queue-5.15/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch b/queue-5.15/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch new file mode 100644 index 00000000000..17fe72e0592 --- /dev/null +++ b/queue-5.15/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch @@ -0,0 +1,53 @@ +From c0c5270b25b1e76e55de85c10feaac0b0ebbd439 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 09:40:22 +0400 +Subject: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe + +From: Miaoqian Lin + +[ Upstream commit 8f3c307b580a4a6425896007325bddefc36e8d91 ] + +wkup_m3_ipc_get() takes refcount, which should be freed by +wkup_m3_ipc_put(). Add missing refcount release in the error paths. + +Fixes: 5a99ae0092fe ("soc: ti: pm33xx: AM437X: Add rtc_only with ddr in self-refresh support") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230106054022.947529-1-linmq006@gmail.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/pm33xx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c +index 7bab4bbaf02dc..285302bf3ef91 100644 +--- a/drivers/soc/ti/pm33xx.c ++++ b/drivers/soc/ti/pm33xx.c +@@ -527,7 +527,7 @@ static int am33xx_pm_probe(struct platform_device *pdev) + + ret = am33xx_pm_alloc_sram(); + if (ret) +- return ret; ++ goto err_wkup_m3_ipc_put; + + ret = am33xx_pm_rtc_setup(); + if (ret) +@@ -574,13 +574,14 @@ static int am33xx_pm_probe(struct platform_device *pdev) + pm_runtime_put_sync(dev); + err_pm_runtime_disable: + pm_runtime_disable(dev); +- wkup_m3_ipc_put(m3_ipc); + err_unsetup_rtc: + iounmap(rtc_base_virt); + clk_put(rtc_fck); + err_free_sram: + am33xx_pm_free_sram(); + pm33xx_dev = NULL; ++err_wkup_m3_ipc_put: ++ wkup_m3_ipc_put(m3_ipc); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch b/queue-5.15/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch new file mode 100644 index 00000000000..390433834c2 --- /dev/null +++ b/queue-5.15/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch @@ -0,0 +1,48 @@ +From 0976b334127cc3fa6dfecbb98a0d0ce2f8e45136 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 17:46:15 +0530 +Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation + +From: Dhruva Gole + +[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ] + +Get rid of conditional compilation based on CONFIG_PM_SLEEP because +it may introduce build issues with certain configs where it maybe disabled +This is because if above config is not enabled the suspend-resume +functions are never part of the code but the bcm63xx_spi_pm_ops struct +still inits them to non-existent suspend-resume functions. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") + +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index 80fa0ef8909ca..0324ab3ce1c84 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -630,7 +630,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM_SLEEP + static int bcm63xx_spi_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); +@@ -657,7 +656,6 @@ static int bcm63xx_spi_resume(struct device *dev) + + return 0; + } +-#endif + + static const struct dev_pm_ops bcm63xx_spi_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume) +-- +2.39.2 + diff --git a/queue-5.15/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch b/queue-5.15/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch new file mode 100644 index 00000000000..e241a699ef1 --- /dev/null +++ b/queue-5.15/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch @@ -0,0 +1,68 @@ +From da78f957ef0ca3daf902da3b15d754b0943283bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 14:40:27 +0530 +Subject: spi: cadence-quadspi: fix suspend-resume implementations + +From: Dhruva Gole + +[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ] + +The cadence QSPI driver misbehaves after performing a full system suspend +resume: +... +spi-nor spi0.0: resume() failed +... +This results in a flash connected via OSPI interface after system suspend- +resume to be unusable. +fix these suspend and resume functions. + +Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index cda70de383309..5c8f198b0ae38 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1619,17 +1619,30 @@ static int cqspi_remove(struct platform_device *pdev) + static int cqspi_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); ++ int ret; + ++ ret = spi_master_suspend(master); + cqspi_controller_enable(cqspi, 0); +- return 0; ++ ++ clk_disable_unprepare(cqspi->clk); ++ ++ return ret; + } + + static int cqspi_resume(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); + +- cqspi_controller_enable(cqspi, 1); +- return 0; ++ clk_prepare_enable(cqspi->clk); ++ cqspi_wait_idle(cqspi); ++ cqspi_controller_init(cqspi); ++ ++ cqspi->current_cs = -1; ++ cqspi->sclk = 0; ++ ++ return spi_master_resume(master); + } + + static const struct dev_pm_ops cqspi__dev_pm_ops = { +-- +2.39.2 + diff --git a/queue-5.15/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch b/queue-5.15/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch new file mode 100644 index 00000000000..107ea1bca04 --- /dev/null +++ b/queue-5.15/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch @@ -0,0 +1,71 @@ +From 19440148d50894b0e9195ab1c36996d5c321b269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Apr 2023 19:59:46 +0200 +Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian + +From: Christophe Leroy + +[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ] + +CPM has the same problem as QE so for CPM also use the fix added +by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"): + + CPM mode uses Little Endian so words > 8 bits are byte swapped. + Workaround this by always enforcing wordsize 8 for 16 and 32 bits + words. Unfortunately this will not work for LSB transfers + where wordsize is > 8 bits so disable these for now. + +Also limit the workaround to 16 and 32 bits words because it can +only work for multiples of 8-bits. + +Signed-off-by: Christophe Leroy +Cc: Joakim Tjernlund +Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian") +Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-spi.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index bdf94cc7be1af..1bad0ceac81b4 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -207,8 +207,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + struct spi_device *spi, + int bits_per_word) + { +- /* QE uses Little Endian for words > 8 +- * so transform all words > 8 into 8 bits ++ /* CPM/QE uses Little Endian for words > 8 ++ * so transform 16 and 32 bits words into 8 bits + * Unfortnatly that doesn't work for LSB so + * reject these for now */ + /* Note: 32 bits word, LSB works iff +@@ -216,9 +216,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + if (spi->mode & SPI_LSB_FIRST && + bits_per_word > 8) + return -EINVAL; +- if (bits_per_word > 8) ++ if (bits_per_word <= 8) ++ return bits_per_word; ++ if (bits_per_word == 16 || bits_per_word == 32) + return 8; /* pretend its 8 bits */ +- return bits_per_word; ++ return -EINVAL; + } + + static int fsl_spi_setup_transfer(struct spi_device *spi, +@@ -248,7 +250,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi, + bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi, + mpc8xxx_spi, + bits_per_word); +- else if (mpc8xxx_spi->flags & SPI_QE) ++ else + bits_per_word = mspi_apply_qe_mode_quirks(cs, spi, + bits_per_word); + +-- +2.39.2 + diff --git a/queue-5.15/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-5.15/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..5ccbb938671 --- /dev/null +++ b/queue-5.15/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,52 @@ +From eacb0302c9e36a1e5f3d507bba3303637ec51c77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 07:57:32 +0100 +Subject: spi: imx: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 11951c9e3f364d7ae3b568a0e52c8335d43066b5 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: d593574aff0a ("spi: imx: do not access registers while clocks disabled") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230306065733.2170662-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 980cd168fe4c8..2f06f2840d616 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1769,13 +1769,11 @@ static int spi_imx_remove(struct platform_device *pdev) + + spi_bitbang_stop(&spi_imx->bitbang); + +- ret = pm_runtime_resume_and_get(spi_imx->dev); +- if (ret < 0) { +- dev_err(spi_imx->dev, "failed to enable clock\n"); +- return ret; +- } +- +- writel(0, spi_imx->base + MXC_CSPICTRL); ++ ret = pm_runtime_get_sync(spi_imx->dev); ++ if (ret >= 0) ++ writel(0, spi_imx->base + MXC_CSPICTRL); ++ else ++ dev_warn(spi_imx->dev, "failed to enable clock, skip hw disable\n"); + + pm_runtime_dont_use_autosuspend(spi_imx->dev); + pm_runtime_put_sync(spi_imx->dev); +-- +2.39.2 + diff --git a/queue-5.15/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-5.15/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..5aae2d48393 --- /dev/null +++ b/queue-5.15/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,65 @@ +From dbc4238a568a44385fe634fd74a8c121d718948e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 23:03:40 +0200 +Subject: spi: qup: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index f3877eeb3da65..8bf58510cca6d 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1276,18 +1276,22 @@ static int spi_qup_remove(struct platform_device *pdev) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(&pdev->dev); + +- ret = spi_qup_set_state(controller, QUP_STATE_RESET); +- if (ret) +- return ret; ++ if (ret >= 0) { ++ ret = spi_qup_set_state(controller, QUP_STATE_RESET); ++ if (ret) ++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n", ++ ERR_PTR(ret)); + +- spi_qup_release_dma(master); ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); ++ } else { ++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n", ++ ERR_PTR(ret)); ++ } + +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); ++ spi_qup_release_dma(master); + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.39.2 + diff --git a/queue-5.15/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch b/queue-5.15/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch new file mode 100644 index 00000000000..b989dda436c --- /dev/null +++ b/queue-5.15/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch @@ -0,0 +1,53 @@ +From 835e60d8320659e5881eef3580f4d0e3b44078c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 08:53:42 +0000 +Subject: spi: spi-imx: using pm_runtime_resume_and_get instead of + pm_runtime_get_sync + +From: Minghao Chi + +[ Upstream commit 7d34ff58f35c82207698f43af79817a05e1342e5 ] + +Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and +pm_runtime_put_noidle. This change is just to simplify the code, no +actual functional changes. + +Reported-by: Zeal Robot +Signed-off-by: Minghao Chi +Link: https://lore.kernel.org/r/20220414085343.2541608-1-chi.minghao@zte.com.cn +Signed-off-by: Mark Brown +Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 890b2cf02149c..980cd168fe4c8 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1552,9 +1552,8 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg) + struct spi_imx_data *spi_imx = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_get_sync(spi_imx->dev); ++ ret = pm_runtime_resume_and_get(spi_imx->dev); + if (ret < 0) { +- pm_runtime_put_noidle(spi_imx->dev); + dev_err(spi_imx->dev, "failed to enable clock\n"); + return ret; + } +@@ -1770,9 +1769,8 @@ static int spi_imx_remove(struct platform_device *pdev) + + spi_bitbang_stop(&spi_imx->bitbang); + +- ret = pm_runtime_get_sync(spi_imx->dev); ++ ret = pm_runtime_resume_and_get(spi_imx->dev); + if (ret < 0) { +- pm_runtime_put_noidle(spi_imx->dev); + dev_err(spi_imx->dev, "failed to enable clock\n"); + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/spmi-add-a-check-for-remove-callback-when-removing-a.patch b/queue-5.15/spmi-add-a-check-for-remove-callback-when-removing-a.patch new file mode 100644 index 00000000000..4e2f1655cae --- /dev/null +++ b/queue-5.15/spmi-add-a-check-for-remove-callback-when-removing-a.patch @@ -0,0 +1,65 @@ +From 9b54887cf71782bdaa33857fda38051a7021173e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 15:38:34 -0700 +Subject: spmi: Add a check for remove callback when removing a SPMI driver + +From: Jishnu Prakash + +[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ] + +When removing a SPMI driver, there can be a crash due to NULL pointer +dereference if it does not have a remove callback defined. This is +one such call trace observed when removing the QCOM SPMI PMIC driver: + + dump_backtrace.cfi_jt+0x0/0x8 + dump_stack_lvl+0xd8/0x16c + panic+0x188/0x498 + __cfi_slowpath+0x0/0x214 + __cfi_slowpath+0x1dc/0x214 + spmi_drv_remove+0x16c/0x1e0 + device_release_driver_internal+0x468/0x79c + driver_detach+0x11c/0x1a0 + bus_remove_driver+0xc4/0x124 + driver_unregister+0x58/0x84 + cleanup_module+0x1c/0xc24 [qcom_spmi_pmic] + __do_sys_delete_module+0x3ec/0x53c + __arm64_sys_delete_module+0x18/0x28 + el0_svc_common+0xdc/0x294 + el0_svc+0x38/0x9c + el0_sync_handler+0x8c/0xf0 + el0_sync+0x1b4/0x1c0 + +If a driver has all its resources allocated through devm_() APIs and +does not need any other explicit cleanup, it would not require a +remove callback to be defined. Hence, add a check for remove callback +presence before calling it when removing a SPMI driver. + +Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com +Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()") +Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI") +Signed-off-by: Jishnu Prakash +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/spmi/spmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c +index b37ead9e2fade..38913c0f11158 100644 +--- a/drivers/spmi/spmi.c ++++ b/drivers/spmi/spmi.c +@@ -350,7 +350,8 @@ static void spmi_drv_remove(struct device *dev) + const struct spmi_driver *sdrv = to_spmi_driver(dev->driver); + + pm_runtime_get_sync(dev); +- sdrv->remove(to_spmi_device(dev)); ++ if (sdrv->remove) ++ sdrv->remove(to_spmi_device(dev)); + pm_runtime_put_noidle(dev); + + pm_runtime_disable(dev); +-- +2.39.2 + diff --git a/queue-5.15/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch b/queue-5.15/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch new file mode 100644 index 00000000000..b03a467c771 --- /dev/null +++ b/queue-5.15/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch @@ -0,0 +1,44 @@ +From 83ff22100ab7672e921c34665bef93209d829966 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 22:02:01 +0200 +Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start + +From: Philipp Hortmann + +[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ] + +When loading the driver for rtl8192e, the W_DISABLE# switch is working as +intended. But when the WLAN is turned off in software and then turned on +again the W_DISABLE# does not work anymore. Reason for this is that in +the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is +checked and returned when true. bfirst_after_down is set true when +switching the WLAN off in software. But it is not set to false again +when WLAN is turned on again. + +Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix +above described bug. + +Fixes: 94a799425eee ("From: wlanfae [PATCH 1/8] rtl8192e: Import new version of driver from realtek") +Signed-off-by: Philipp Hortmann +Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710 +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index 616ab3c8fde4f..48c696df8d015 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -768,6 +768,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset) + else + netif_wake_queue(dev); + ++ priv->bfirst_after_down = false; + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch b/queue-5.15/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch new file mode 100644 index 00000000000..aed95a68ef0 --- /dev/null +++ b/queue-5.15/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch @@ -0,0 +1,74 @@ +From 885621ed35ead02ca98022db386447da0fb59ba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 13:19:02 -0700 +Subject: SUNRPC: remove the maximum number of retries in call_bind_status + +From: Dai Ngo + +[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ] + +Currently call_bind_status places a hard limit of 3 to the number of +retries on EACCES error. This limit was done to prevent NLM unlock +requests from being hang forever when the server keeps returning garbage. +However this change causes problem for cases when NLM service takes +longer than 9 seconds to register with the port mapper after a restart. + +This patch removes this hard coded limit and let the RPC handles +the retry based on the standard hard/soft task semantics. + +Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests") +Reported-by: Helen Chao +Tested-by: Helen Chao +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 3 +-- + net/sunrpc/clnt.c | 3 --- + net/sunrpc/sched.c | 1 - + 3 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index a237b8dbf6086..ba047a145e092 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -90,8 +90,7 @@ struct rpc_task { + #endif + unsigned char tk_priority : 2,/* Task priority */ + tk_garb_retry : 2, +- tk_cred_retry : 2, +- tk_rebind_retry : 2; ++ tk_cred_retry : 2; + }; + + typedef void (*rpc_action)(struct rpc_task *); +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index ad3e9a40b0610..b9c54c03c30a6 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1981,9 +1981,6 @@ call_bind_status(struct rpc_task *task) + status = -EOPNOTSUPP; + break; + } +- if (task->tk_rebind_retry == 0) +- break; +- task->tk_rebind_retry--; + rpc_delay(task, 3*HZ); + goto retry_timeout; + case -ENOBUFS: +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index f0f55fbd13752..a00890962e115 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -796,7 +796,6 @@ rpc_init_task_statistics(struct rpc_task *task) + /* Initialize retry counters */ + task->tk_garb_retry = 2; + task->tk_cred_retry = 2; +- task->tk_rebind_retry = 2; + + /* starting timestamp */ + task->tk_start = ktime_get(); +-- +2.39.2 + diff --git a/queue-5.15/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch b/queue-5.15/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch new file mode 100644 index 00000000000..bed80debd04 --- /dev/null +++ b/queue-5.15/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch @@ -0,0 +1,125 @@ +From 83e6c138bacbe5ef0efeab442f1acd89e4df0e07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:20:22 -0700 +Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. + +From: Kuniyuki Iwashima + +[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ] + +syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY +skbs. We can reproduce the problem with these sequences: + + sk = socket(AF_INET, SOCK_DGRAM, 0) + sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) + sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) + sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) + sk.close() + +sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets +skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct +ubuf_info_msgzc indirectly holds a refcnt of the socket. When the +skb is sent, __skb_tstamp_tx() clones it and puts the clone into +the socket's error queue with the TX timestamp. + +When the original skb is received locally, skb_copy_ubufs() calls +skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. +This additional count is decremented while freeing the skb, but struct +ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is +not called. + +The last refcnt is not released unless we retrieve the TX timestamped +skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() +after the socket's refcnt reaches 0, there is a circular dependency. +If we close() the socket holding such skbs, we never call sock_put() +and leak the count, sk, and skb. + +TCP has the same problem, and commit e0c8bccd40fc ("net: stream: +purge sk_error_queue in sk_stream_kill_queues()") tried to fix it +by calling skb_queue_purge() during close(). However, there is a +small chance that skb queued in a qdisc or device could be put +into the error queue after the skb_queue_purge() call. + +In __skb_tstamp_tx(), the cloned skb should not have a reference +to the ubuf to remove the circular dependency, but skb_clone() does +not call skb_copy_ubufs() for zerocopy skb. So, we need to call +skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). + +[0]: +BUG: memory leak +unreferenced object 0xffff88800c6d2d00 (size 1152): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ + 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ + backtrace: + [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 + [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 + [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] + [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 + [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 + [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] + [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636 + [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] + [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] + [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +BUG: memory leak +unreferenced object 0xffff888017633a00 (size 240): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... + backtrace: + [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497 + [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] + [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 + [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] + [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370 + [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037 + [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652 + [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253 + [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819 + [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline] + [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734 + [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117 + [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline] + [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline] + [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY") +Fixes: b5947e5d1e71 ("udp: msg_zerocopy") +Reported-by: syzbot +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 46cc3a7632f79..d4b25d6fd01d5 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4960,6 +4960,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb, + skb = alloc_skb(0, GFP_ATOMIC); + } else { + skb = skb_clone(orig_skb, GFP_ATOMIC); ++ ++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) ++ return; + } + if (!skb) + return; +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch b/queue-5.15/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch new file mode 100644 index 00000000000..654b5e031c5 --- /dev/null +++ b/queue-5.15/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch @@ -0,0 +1,63 @@ +From 282a70674217dcdd5a90f9212b4154a363ae601d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 10:07:48 +0800 +Subject: thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in + mtk_thermal_probe + +From: Kang Chen + +[ Upstream commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26 ] + +Smatch reports: +1. mtk_thermal_probe() warn: 'apmixed_base' from of_iomap() not released. +2. mtk_thermal_probe() warn: 'auxadc_base' from of_iomap() not released. + +The original code forgets to release iomap resource when handling errors, +fix it by switch to devm_of_iomap. + +Fixes: 89945047b166 ("thermal: mediatek: Add tsensor support for V2 thermal system") +Signed-off-by: Kang Chen +Reviewed-by: Dongliang Mu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20230419020749.621257-1-void0red@hust.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/thermal/mtk_thermal.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c +index ede94eaddddae..9c857fb5d9681 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mtk_thermal.c +@@ -1028,7 +1028,12 @@ static int mtk_thermal_probe(struct platform_device *pdev) + return -ENODEV; + } + +- auxadc_base = of_iomap(auxadc, 0); ++ auxadc_base = devm_of_iomap(&pdev->dev, auxadc, 0, NULL); ++ if (IS_ERR(auxadc_base)) { ++ of_node_put(auxadc); ++ return PTR_ERR(auxadc_base); ++ } ++ + auxadc_phys_base = of_get_phys_base(auxadc); + + of_node_put(auxadc); +@@ -1044,7 +1049,12 @@ static int mtk_thermal_probe(struct platform_device *pdev) + return -ENODEV; + } + +- apmixed_base = of_iomap(apmixedsys, 0); ++ apmixed_base = devm_of_iomap(&pdev->dev, apmixedsys, 0, NULL); ++ if (IS_ERR(apmixed_base)) { ++ of_node_put(apmixedsys); ++ return PTR_ERR(apmixed_base); ++ } ++ + apmixed_phys_base = of_get_phys_base(apmixedsys); + + of_node_put(apmixedsys); +-- +2.39.2 + diff --git a/queue-5.15/tick-common-align-tick-period-with-the-hz-tick.patch b/queue-5.15/tick-common-align-tick-period-with-the-hz-tick.patch new file mode 100644 index 00000000000..d7ad1248b53 --- /dev/null +++ b/queue-5.15/tick-common-align-tick-period-with-the-hz-tick.patch @@ -0,0 +1,67 @@ +From 82261dd5f85d6e27ecc8b79e51ea39de0e30ee54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 14:26:39 +0200 +Subject: tick/common: Align tick period with the HZ tick. + +From: Sebastian Andrzej Siewior + +[ Upstream commit e9523a0d81899361214d118ad60ef76f0e92f71d ] + +With HIGHRES enabled tick_sched_timer() is programmed every jiffy to +expire the timer_list timers. This timer is programmed accurate in +respect to CLOCK_MONOTONIC so that 0 seconds and nanoseconds is the +first tick and the next one is 1000/CONFIG_HZ ms later. For HZ=250 it is +every 4 ms and so based on the current time the next tick can be +computed. + +This accuracy broke since the commit mentioned below because the jiffy +based clocksource is initialized with higher accuracy in +read_persistent_wall_and_boot_offset(). This higher accuracy is +inherited during the setup in tick_setup_device(). The timer still fires +every 4ms with HZ=250 but timer is no longer aligned with +CLOCK_MONOTONIC with 0 as it origin but has an offset in the us/ns part +of the timestamp. The offset differs with every boot and makes it +impossible for user land to align with the tick. + +Align the tick period with CLOCK_MONOTONIC ensuring that it is always a +multiple of 1000/CONFIG_HZ ms. + +Fixes: 857baa87b6422 ("sched/clock: Enable sched clock early") +Reported-by: Gusenleitner Klaus +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/20230406095735.0_14edn3@linutronix.de +Link: https://lore.kernel.org/r/20230418122639.ikgfvu3f@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/tick-common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 46789356f856e..65b8658da829e 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -218,9 +218,19 @@ static void tick_setup_device(struct tick_device *td, + * this cpu: + */ + if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) { ++ ktime_t next_p; ++ u32 rem; ++ + tick_do_timer_cpu = cpu; + +- tick_next_period = ktime_get(); ++ next_p = ktime_get(); ++ div_u64_rem(next_p, TICK_NSEC, &rem); ++ if (rem) { ++ next_p -= rem; ++ next_p += TICK_NSEC; ++ } ++ ++ tick_next_period = next_p; + #ifdef CONFIG_NO_HZ_FULL + /* + * The boot CPU may be nohz_full, in which case set +-- +2.39.2 + diff --git a/queue-5.15/timekeeping-fix-references-to-nonexistent-ktime_get_.patch b/queue-5.15/timekeeping-fix-references-to-nonexistent-ktime_get_.patch new file mode 100644 index 00000000000..fb99b15864c --- /dev/null +++ b/queue-5.15/timekeeping-fix-references-to-nonexistent-ktime_get_.patch @@ -0,0 +1,47 @@ +From 7ef374e3ec7375baec9d8b8a013f61b11e613af4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 15:43:34 +0200 +Subject: timekeeping: Fix references to nonexistent ktime_get_fast_ns() + +From: Geert Uytterhoeven + +[ Upstream commit 158009f1b4a33bc0f354b994eea361362bd83226 ] + +There was never a function named ktime_get_fast_ns(). +Presumably these should refer to ktime_get_mono_fast_ns() instead. + +Fixes: c1ce406e80fb15fa ("timekeeping: Fix up function documentation for the NMI safe accessors") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Thomas Gleixner +Acked-by: John Stultz +Link: https://lore.kernel.org/r/06df7b3cbd94f016403bbf6cd2b38e4368e7468f.1682516546.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + kernel/time/timekeeping.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index d6a0ff68df410..d921c1b256cf5 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -523,7 +523,7 @@ EXPORT_SYMBOL_GPL(ktime_get_raw_fast_ns); + * partially updated. Since the tk->offs_boot update is a rare event, this + * should be a rare occurrence which postprocessing should be able to handle. + * +- * The caveats vs. timestamp ordering as documented for ktime_get_fast_ns() ++ * The caveats vs. timestamp ordering as documented for ktime_get_mono_fast_ns() + * apply as well. + */ + u64 notrace ktime_get_boot_fast_ns(void) +@@ -559,7 +559,7 @@ static __always_inline u64 __ktime_get_real_fast(struct tk_fast *tkf, u64 *mono) + /** + * ktime_get_real_fast_ns: - NMI safe and fast access to clock realtime. + * +- * See ktime_get_fast_ns() for documentation of the time stamp ordering. ++ * See ktime_get_mono_fast_ns() for documentation of the time stamp ordering. + */ + u64 ktime_get_real_fast_ns(void) + { +-- +2.39.2 + diff --git a/queue-5.15/tools-bpftool-remove-invalid-json-escape.patch b/queue-5.15/tools-bpftool-remove-invalid-json-escape.patch new file mode 100644 index 00000000000..3f97657c477 --- /dev/null +++ b/queue-5.15/tools-bpftool-remove-invalid-json-escape.patch @@ -0,0 +1,53 @@ +From 8995b610141ddd2f02fd6eab476b01ec945ed98d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 16:08:54 +0100 +Subject: tools: bpftool: Remove invalid \' json escape + +From: Luis Gerhorst + +[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ] + +RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange +Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid +two-character escape sequences. This does not include \', which is not +required in JSON because it exclusively uses double quotes as string +separators. + +Solidus (/) may be escaped, but does not have to. Only reverse +solidus (\), double quotes ("), and the control characters have to be +escaped. Therefore, with this fix, bpftool correctly supports all valid +two-character escape sequences (but still does not support characters +that require multi-character escape sequences). + +Witout this fix, attempting to load a JSON file generated by bpftool +using Python 3.10.6's default json.load() may fail with the error +"Invalid \escape" if the file contains the invalid escaped single +quote (\'). + +Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository") +Signed-off-by: Luis Gerhorst +Signed-off-by: Andrii Nakryiko +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/json_writer.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c +index 7fea83bedf488..bca5dd0a59e34 100644 +--- a/tools/bpf/bpftool/json_writer.c ++++ b/tools/bpf/bpftool/json_writer.c +@@ -80,9 +80,6 @@ static void jsonw_puts(json_writer_t *self, const char *str) + case '"': + fputs("\\\"", self->out); + break; +- case '\'': +- fputs("\\\'", self->out); +- break; + default: + putc(*str, self->out); + } +-- +2.39.2 + diff --git a/queue-5.15/tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch b/queue-5.15/tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch new file mode 100644 index 00000000000..e11bde02a3e --- /dev/null +++ b/queue-5.15/tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch @@ -0,0 +1,41 @@ +From 8ed2c84cfca10eee0ab83cc98764f02d4bd8da43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 08:18:30 -0600 +Subject: tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 + +From: Terry Bowman + +[ Upstream commit 4e347bdf44c1fd4296a7b9657a2c0e1bd900fa50 ] + +Leaf Fn00000007 contains avx512bw at bit 26 and avx512vl at bit 28. This +is incorrect per the SDM. Correct avx512bw to be bit 30 and avx512lvl to +be bit 31. + +Fixes: c6b2f240bf8d ("tools/x86: Add a kcpuid tool to show raw CPU features") +Signed-off-by: Terry Bowman +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Feng Tang +Link: https://lore.kernel.org/r/20230206141832.4162264-2-terry.bowman@amd.com +Signed-off-by: Sasha Levin +--- + tools/arch/x86/kcpuid/cpuid.csv | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/arch/x86/kcpuid/cpuid.csv b/tools/arch/x86/kcpuid/cpuid.csv +index 4f1c4b0c29e98..9914bdf4fc9ec 100644 +--- a/tools/arch/x86/kcpuid/cpuid.csv ++++ b/tools/arch/x86/kcpuid/cpuid.csv +@@ -184,8 +184,8 @@ + 7, 0, EBX, 27, avx512er, AVX512 Exponent Reciproca instr + 7, 0, EBX, 28, avx512cd, AVX512 Conflict Detection instr + 7, 0, EBX, 29, sha, Intel Secure Hash Algorithm Extensions instr +- 7, 0, EBX, 26, avx512bw, AVX512 Byte & Word instr +- 7, 0, EBX, 28, avx512vl, AVX512 Vector Length Extentions (VL) ++ 7, 0, EBX, 30, avx512bw, AVX512 Byte & Word instr ++ 7, 0, EBX, 31, avx512vl, AVX512 Vector Length Extentions (VL) + 7, 0, ECX, 0, prefetchwt1, X + 7, 0, ECX, 1, avx512vbmi, AVX512 Vector Byte Manipulation Instructions + 7, 0, ECX, 2, umip, User-mode Instruction Prevention +-- +2.39.2 + diff --git a/queue-5.15/tpm-tpm-implement-usage-counter-for-locality.patch b/queue-5.15/tpm-tpm-implement-usage-counter-for-locality.patch new file mode 100644 index 00000000000..2dbdc72efa7 --- /dev/null +++ b/queue-5.15/tpm-tpm-implement-usage-counter-for-locality.patch @@ -0,0 +1,235 @@ +From c4eb52c361a5c22b90f1c284e32b6e8bb25f1bc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:33 +0100 +Subject: tpm, tpm: Implement usage counter for locality +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit 7a2f55d0be296c4e81fd782f3d6c43ed4ec7e265 ] + +Implement a usage counter for the (default) locality used by the TPM TIS +driver: +Request the locality from the TPM if it has not been claimed yet, otherwise +only increment the counter. Also release the locality if the counter is 0 +otherwise only decrement the counter. Since in case of SPI the register +accesses are locked by means of the SPI bus mutex use a sleepable lock +(i.e. also a mutex) to ensure thread-safety of the counter which may be +accessed by both a userspace thread and the interrupt handler. + +By doing this refactor the names of the amended functions to use a more +appropriate prefix. + +Signed-off-by: Lino Sanfilippo +Tested-by: Michael Niewöhner +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 63 +++++++++++++++++++++++---------- + drivers/char/tpm/tpm_tis_core.h | 2 ++ + 2 files changed, 47 insertions(+), 18 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 52826a7edf800..3ea0fff30273e 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -136,16 +136,27 @@ static bool check_locality(struct tpm_chip *chip, int l) + return false; + } + +-static int release_locality(struct tpm_chip *chip, int l) ++static int __tpm_tis_relinquish_locality(struct tpm_tis_data *priv, int l) ++{ ++ tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); ++ ++ return 0; ++} ++ ++static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + +- tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); ++ mutex_lock(&priv->locality_count_mutex); ++ priv->locality_count--; ++ if (priv->locality_count == 0) ++ __tpm_tis_relinquish_locality(priv, l); ++ mutex_unlock(&priv->locality_count_mutex); + + return 0; + } + +-static int request_locality(struct tpm_chip *chip, int l) ++static int __tpm_tis_request_locality(struct tpm_chip *chip, int l) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + unsigned long stop, timeout; +@@ -186,6 +197,20 @@ static int request_locality(struct tpm_chip *chip, int l) + return -1; + } + ++static int tpm_tis_request_locality(struct tpm_chip *chip, int l) ++{ ++ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); ++ int ret = 0; ++ ++ mutex_lock(&priv->locality_count_mutex); ++ if (priv->locality_count == 0) ++ ret = __tpm_tis_request_locality(chip, l); ++ if (!ret) ++ priv->locality_count++; ++ mutex_unlock(&priv->locality_count_mutex); ++ return ret; ++} ++ + static u8 tpm_tis_status(struct tpm_chip *chip) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); +@@ -638,7 +663,7 @@ static int probe_itpm(struct tpm_chip *chip) + if (vendor != TPM_VID_INTEL) + return 0; + +- if (request_locality(chip, 0) != 0) ++ if (tpm_tis_request_locality(chip, 0) != 0) + return -EBUSY; + + rc = tpm_tis_send_data(chip, cmd_getticks, len); +@@ -659,7 +684,7 @@ static int probe_itpm(struct tpm_chip *chip) + + out: + tpm_tis_ready(chip); +- release_locality(chip, priv->locality); ++ tpm_tis_relinquish_locality(chip, priv->locality); + + return rc; + } +@@ -747,14 +772,14 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + } + priv->irq = irq; + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) + return rc; + + rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality), + &original_int_vec); + if (rc < 0) { +- release_locality(chip, priv->locality); ++ tpm_tis_relinquish_locality(chip, priv->locality); + return rc; + } + +@@ -793,7 +818,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + rc = -1; + } + +- release_locality(chip, priv->locality); ++ tpm_tis_relinquish_locality(chip, priv->locality); + + return rc; + } +@@ -909,8 +934,8 @@ static const struct tpm_class_ops tpm_tis = { + .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID, + .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID, + .req_canceled = tpm_tis_req_canceled, +- .request_locality = request_locality, +- .relinquish_locality = release_locality, ++ .request_locality = tpm_tis_request_locality, ++ .relinquish_locality = tpm_tis_relinquish_locality, + .clk_enable = tpm_tis_clkrun_enable, + }; + +@@ -944,6 +969,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + priv->timeout_min = TPM_TIMEOUT_USECS_MIN; + priv->timeout_max = TPM_TIMEOUT_USECS_MAX; + priv->phy_ops = phy_ops; ++ priv->locality_count = 0; ++ mutex_init(&priv->locality_count_mutex); + + dev_set_drvdata(&chip->dev, priv); + +@@ -990,14 +1017,14 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; + intmask &= ~TPM_GLOBAL_INT_ENABLE; + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) { + rc = -ENODEV; + goto out_err; + } + + tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + + rc = tpm_chip_start(chip); + if (rc) +@@ -1057,13 +1084,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + * proper timeouts for the driver. + */ + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) + goto out_err; + + rc = tpm_get_timeouts(chip); + +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + + if (rc) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); +@@ -1081,11 +1108,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) + goto out_err; + disable_interrupts(chip); +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + } + } + +@@ -1158,13 +1185,13 @@ int tpm_tis_resume(struct device *dev) + * an error code but for unknown reason it isn't handled. + */ + if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { +- ret = request_locality(chip, 0); ++ ret = tpm_tis_request_locality(chip, 0); + if (ret < 0) + return ret; + + tpm1_do_selftest(chip); + +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + } + + return 0; +diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h +index 3be24f221e32a..464ed352ab2e8 100644 +--- a/drivers/char/tpm/tpm_tis_core.h ++++ b/drivers/char/tpm/tpm_tis_core.h +@@ -90,6 +90,8 @@ enum tpm_tis_flags { + + struct tpm_tis_data { + u16 manufacturer_id; ++ struct mutex locality_count_mutex; ++ unsigned int locality_count; + int locality; + int irq; + bool irq_tested; +-- +2.39.2 + diff --git a/queue-5.15/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch b/queue-5.15/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch new file mode 100644 index 00000000000..d87aad41973 --- /dev/null +++ b/queue-5.15/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch @@ -0,0 +1,85 @@ +From b207aba7fb5e45d50aa37728d888ced30a5e3a28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:29 +0100 +Subject: tpm, tpm_tis: Claim locality before writing interrupt registers + +From: Lino Sanfilippo + +[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ] + +In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR, +TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts. +Currently these modifications are done without holding a locality thus they +have no effect. Fix this by claiming the (default) locality before the +registers are written. + +Since now tpm_tis_gen_interrupt() is called with the locality already +claimed remove locality request and release from this function. + +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 99cbf6fb062ce..52826a7edf800 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -721,16 +721,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip) + cap_t cap; + int ret; + +- ret = request_locality(chip, 0); +- if (ret < 0) +- return; +- + if (chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); + else + ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); +- +- release_locality(chip, 0); + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -753,10 +747,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + } + priv->irq = irq; + ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ return rc; ++ + rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality), + &original_int_vec); +- if (rc < 0) ++ if (rc < 0) { ++ release_locality(chip, priv->locality); + return rc; ++ } + + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); + if (rc < 0) +@@ -790,10 +790,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { + tpm_tis_write8(priv, original_int_vec, + TPM_INT_VECTOR(priv->locality)); +- return -1; ++ rc = -1; + } + +- return 0; ++ release_locality(chip, priv->locality); ++ ++ return rc; + } + + /* Try to find the IRQ the TPM is using. This is for legacy x86 systems that +-- +2.39.2 + diff --git a/queue-5.15/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch b/queue-5.15/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch new file mode 100644 index 00000000000..d9feca74145 --- /dev/null +++ b/queue-5.15/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch @@ -0,0 +1,47 @@ +From 287c0af1b4c48d3dd7f2ba457bcb82f43dc9e024 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:26 +0100 +Subject: tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit 282657a8bd7fddcf511b834f43705001668b33a7 ] + +In disable_interrupts() the TPM_GLOBAL_INT_ENABLE bit is unset in the +TPM_INT_ENABLE register to shut the interrupts off. However modifying the +register is only possible with a held locality. So claim the locality +before disable_interrupts() is called. + +Signed-off-by: Lino Sanfilippo +Tested-by: Michael Niewöhner +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index ae0c773a6041a..274096fece3fa 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -1076,7 +1076,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); + ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ goto out_err; + disable_interrupts(chip); ++ release_locality(chip, 0); + } + } else { + tpm_tis_probe_irq(chip, intmask); +-- +2.39.2 + diff --git a/queue-5.15/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch b/queue-5.15/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch new file mode 100644 index 00000000000..6921710f409 --- /dev/null +++ b/queue-5.15/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch @@ -0,0 +1,68 @@ +From d44bb5531067be1679406b527df1e70496127c05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:36 +0100 +Subject: tpm, tpm_tis: Claim locality when interrupts are reenabled on resume + +From: Lino Sanfilippo + +[ Upstream commit 955df4f87760b3bb2af253d3fbb12fb712b3ffa6 ] + +In tpm_tis_resume() make sure that the locality has been claimed when +tpm_tis_reenable_interrupts() is called. Otherwise the writings to the +register might not have any effect. + +Fixes: 45baa1d1fa39 ("tpm_tis: Re-enable interrupts upon (S3) resume") +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 3ea0fff30273e..d65fff4e2ebe9 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -1173,28 +1173,27 @@ int tpm_tis_resume(struct device *dev) + struct tpm_chip *chip = dev_get_drvdata(dev); + int ret; + ++ ret = tpm_tis_request_locality(chip, 0); ++ if (ret < 0) ++ return ret; ++ + if (chip->flags & TPM_CHIP_FLAG_IRQ) + tpm_tis_reenable_interrupts(chip); + + ret = tpm_pm_resume(dev); + if (ret) +- return ret; ++ goto out; + + /* + * TPM 1.2 requires self-test on resume. This function actually returns + * an error code but for unknown reason it isn't handled. + */ +- if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { +- ret = tpm_tis_request_locality(chip, 0); +- if (ret < 0) +- return ret; +- ++ if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) + tpm1_do_selftest(chip); ++out: ++ tpm_tis_relinquish_locality(chip, 0); + +- tpm_tis_relinquish_locality(chip, 0); +- } +- +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(tpm_tis_resume); + #endif +-- +2.39.2 + diff --git a/queue-5.15/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch b/queue-5.15/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch new file mode 100644 index 00000000000..edff040ead6 --- /dev/null +++ b/queue-5.15/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch @@ -0,0 +1,69 @@ +From 60c006724641ba2f72eb1bed92910497ca264f98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:27 +0100 +Subject: tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit 6d789ad726950e612a7f31044260337237c5b490 ] + +Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup +the interrupts and then return with an error. This case is indicated by a +missing TPM_CHIP_FLAG_IRQ flag in chip->flags. +Currently the interrupt setup is only undone if tpm_tis_probe_irq_single() +fails. Undo the setup also if tpm_tis_probe_irq() fails. + +Signed-off-by: Lino Sanfilippo +Tested-by: Michael Niewöhner +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 274096fece3fa..99cbf6fb062ce 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -1069,21 +1069,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + goto out_err; + } + +- if (irq) { ++ if (irq) + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, + irq); +- if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- dev_err(&chip->dev, FW_BUG ++ else ++ tpm_tis_probe_irq(chip, intmask); ++ ++ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { ++ dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); + +- rc = request_locality(chip, 0); +- if (rc < 0) +- goto out_err; +- disable_interrupts(chip); +- release_locality(chip, 0); +- } +- } else { +- tpm_tis_probe_irq(chip, intmask); ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ goto out_err; ++ disable_interrupts(chip); ++ release_locality(chip, 0); + } + } + +-- +2.39.2 + diff --git a/queue-5.15/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch b/queue-5.15/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch new file mode 100644 index 00000000000..44274ca865d --- /dev/null +++ b/queue-5.15/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch @@ -0,0 +1,113 @@ +From 615a9af4652298061d0aaa56d65fb1a45a88e1fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:28 +0100 +Subject: tpm, tpm_tis: Do not skip reset of original interrupt vector + +From: Lino Sanfilippo + +[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ] + +If in tpm_tis_probe_irq_single() an error occurs after the original +interrupt vector has been read, restore the interrupts before the error is +returned. + +Since the caller does not check the error value, return -1 in any case that +the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function +tpm_tis_gen_interrupt() is not longer used, make it a void function. + +Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access") +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------ + 1 file changed, 11 insertions(+), 18 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index dc56b976d8162..ae0c773a6041a 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -714,7 +714,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id) + return IRQ_HANDLED; + } + +-static int tpm_tis_gen_interrupt(struct tpm_chip *chip) ++static void tpm_tis_gen_interrupt(struct tpm_chip *chip) + { + const char *desc = "attempting to generate an interrupt"; + u32 cap2; +@@ -723,7 +723,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + + ret = request_locality(chip, 0); + if (ret < 0) +- return ret; ++ return; + + if (chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); +@@ -731,8 +731,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); + + release_locality(chip, 0); +- +- return ret; + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -762,42 +760,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + /* Clear all existing */ + rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status); + if (rc < 0) +- return rc; +- ++ goto restore_irqs; + /* Turn on */ + rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), + intmask | TPM_GLOBAL_INT_ENABLE); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + priv->irq_tested = false; + + /* Generate an interrupt by having the core call through to + * tpm_tis_send + */ +- rc = tpm_tis_gen_interrupt(chip); +- if (rc < 0) +- return rc; ++ tpm_tis_gen_interrupt(chip); + ++restore_irqs: + /* tpm_tis_send will either confirm the interrupt is working or it + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- rc = tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); +- if (rc < 0) +- return rc; +- +- return 1; ++ tpm_tis_write8(priv, original_int_vec, ++ TPM_INT_VECTOR(priv->locality)); ++ return -1; + } + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch b/queue-5.15/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch new file mode 100644 index 00000000000..58ef6bfbaa6 --- /dev/null +++ b/queue-5.15/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch @@ -0,0 +1,39 @@ +From 19f67bd0ef3bb63e176ddab56108983fff5d777a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 14:55:55 -0500 +Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size + +From: Shenwei Wang + +[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ] + +Based on the fls function definition provided below, we should not +subtract 1 to obtain the correct buffer length: + +fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. + +Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 5cabc3c85eb1c..00a941db8dcb7 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1250,7 +1250,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) + * 10ms at any baud rate. + */ + sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2; +- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1)); ++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len)); + if (sport->rx_dma_rng_buf_len < 16) + sport->rx_dma_rng_buf_len = 16; + +-- +2.39.2 + diff --git a/queue-5.15/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch b/queue-5.15/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch new file mode 100644 index 00000000000..6ae22013834 --- /dev/null +++ b/queue-5.15/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch @@ -0,0 +1,65 @@ +From f5dfd0ca2da15f59f2e3413257a0ba2cb0a0ec74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 10:27:47 +0100 +Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__ + +From: Kevin Brodsky + +[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ] + +typeof is (still) a GNU extension, which means that it cannot be used when +building ISO C (e.g. -std=c99). It should therefore be avoided in uapi +headers in favour of the ISO-friendly __typeof__. + +Unfortunately this issue could not be detected by +CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in +any uapi header. + +This matters from a userspace perspective, not a kernel one. uapi +headers and their contents are expected to be usable in a variety of +situations, and in particular when building ISO C applications (with +-std=c99 or similar). + +This particular problem can be reproduced by trying to use the +__ALIGN_KERNEL macro directly in application code, say: + +#include + +int align(int x, int a) +{ + return __KERNEL_ALIGN(x, a); +} + +and trying to build that with -std=c99. + +Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com +Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()") +Signed-off-by: Kevin Brodsky +Reported-by: Ruben Ayrapetyan +Tested-by: Ruben Ayrapetyan +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Masahiro Yamada +Cc: Sam Ravnborg +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/uapi/linux/const.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index af2a44c08683d..a429381e7ca50 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -28,7 +28,7 @@ + #define _BITUL(x) (_UL(1) << (x)) + #define _BITULL(x) (_ULL(1) << (x)) + +-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) ++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1) + #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) + + #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +-- +2.39.2 + diff --git a/queue-5.15/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch b/queue-5.15/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch new file mode 100644 index 00000000000..1ed8794c5ae --- /dev/null +++ b/queue-5.15/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch @@ -0,0 +1,42 @@ +From 29186ef9d089e26414c40ad1024b6a91f7753408 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:58:52 +0800 +Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe` + +From: Yinhao Hu + +[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ] + +From the comment of ci_usb_phy_init, it returns an error code if +usb_phy_init has failed, and it should do some clean up, not just +return directly. + +Fix this by goto the error handling. + +Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core") +Reviewed-by: Dongliang Mu +Acked-by: Peter Chen +Signed-off-by: Yinhao Hu +Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index a9869975ce32f..0e8f4aa031f81 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1098,7 +1098,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + ret = ci_usb_phy_init(ci); + if (ret) { + dev_err(dev, "unable to init phy: %d\n", ret); +- return ret; ++ goto ulpi_exit; + } + + ci->hw_bank.phys = res->start; +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc3-gadget-change-condition-for-processing-susp.patch b/queue-5.15/usb-dwc3-gadget-change-condition-for-processing-susp.patch new file mode 100644 index 00000000000..3c168a2e75a --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-change-condition-for-processing-susp.patch @@ -0,0 +1,54 @@ +From 397f0d122d167570190139d279c230b292f4ae97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 11:16:58 +0530 +Subject: usb: dwc3: gadget: Change condition for processing suspend event + +From: Prashanth K + +[ Upstream commit 4decf4060ecfee1f7a710999fcd421645ac0c419 ] + +Currently we process the suspend interrupt event only if the +device is in configured state. Consider a case where device +is not configured and got suspend interrupt, in that case our +gadget will still use 100mA as composite_suspend didn't happen. +But battery charging specification (BC1.2) expects a downstream +device to draw less than 2.5mA when unconnected OR suspended. + +Fix this by removing the condition for processing suspend event, +and thus composite_resume would set vbus draw to 2. + +Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler") +Signed-off-by: Prashanth K +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/1677217619-10261-2-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index eaf64f33fe077..7ff77a0de5152 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -4092,15 +4092,8 @@ static void dwc3_gadget_interrupt(struct dwc3 *dwc, + break; + case DWC3_DEVICE_EVENT_SUSPEND: + /* It changed to be suspend event for version 2.30a and above */ +- if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) { +- /* +- * Ignore suspend event until the gadget enters into +- * USB_STATE_CONFIGURED state. +- */ +- if (dwc->gadget->state >= USB_STATE_CONFIGURED) +- dwc3_gadget_suspend_interrupt(dwc, +- event->event_info); +- } ++ if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) ++ dwc3_gadget_suspend_interrupt(dwc, event->event_info); + break; + case DWC3_DEVICE_EVENT_SOF: + case DWC3_DEVICE_EVENT_ERRATIC_ERROR: +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch b/queue-5.15/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch new file mode 100644 index 00000000000..e50988e6982 --- /dev/null +++ b/queue-5.15/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch @@ -0,0 +1,43 @@ +From df40319fc33361d24e205eb7fcff67b08c8fbd5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 19:18:53 +0100 +Subject: usb: gadget: tegra-xudc: Fix crash in vbus_draw + +From: Jon Hunter + +[ Upstream commit 5629d31955297ca47b9283c64fff70f2f34aa528 ] + +Commit ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support") +populated the vbus_draw callback for the Tegra XUDC driver. The function +tegra_xudc_gadget_vbus_draw(), that was added by this commit, assumes +that the pointer 'curr_usbphy' has been initialised, which is not always +the case because this is only initialised when the USB role is updated. +Fix this crash, by checking that the 'curr_usbphy' is valid before +dereferencing. + +Fixes: ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support") +Reviewed-by: Thierry Reding +Signed-off-by: Jon Hunter +Link: https://lore.kernel.org/r/20230405181854.42355-1-jonathanh@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index cb4ddfa52cb0f..1cb4258077bd3 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -2154,7 +2154,7 @@ static int tegra_xudc_gadget_vbus_draw(struct usb_gadget *gadget, + + dev_dbg(xudc->dev, "%s: %u mA\n", __func__, m_a); + +- if (xudc->curr_usbphy->chg_type == SDP_TYPE) ++ if (xudc->curr_usbphy && xudc->curr_usbphy->chg_type == SDP_TYPE) + ret = usb_phy_set_power(xudc->curr_usbphy, m_a); + + return ret; +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch b/queue-5.15/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch new file mode 100644 index 00000000000..177d66be87d --- /dev/null +++ b/queue-5.15/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch @@ -0,0 +1,62 @@ +From 6d451aef28310168a48f93ad54c4f71c0c5cbba7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 14:29:31 +0800 +Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in + renesas_usb3_remove due to race condition + +From: Zheng Wang + +[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ] + +In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. +renesas_usb3_start will be called to start the work. + +If we remove the driver which will call usbhs_remove, there may be +an unfinished work. The possible sequence is as follows: + +CPU0 CPU1 + + renesas_usb3_role_work +renesas_usb3_remove +usb_role_switch_unregister +device_unregister +kfree(sw) +//free usb3->role_sw + usb_role_switch_set_role + //use usb3->role_sw + +The usb3->role_sw could be freed under such circumstance and then +used in usb_role_switch_set_role. + +This bug was found by static analysis. And note that removing a +driver is a root-only operation, and should never happen in normal +case. But the root user may directly remove the device which +will also trigger the remove function. + +Fix it by canceling the work before cleanup in the renesas_usb3_remove. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Signed-off-by: Zheng Wang +Reviewed-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 601829a6b4bad..a10f41c4a3f2f 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2568,6 +2568,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) + debugfs_remove_recursive(usb3->dentry); + device_remove_file(&pdev->dev, &dev_attr_role); + ++ cancel_work_sync(&usb3->role_work); + usb_role_switch_unregister(usb3->role_sw); + + usb_del_gadget_udc(&usb3->gadget); +-- +2.39.2 + diff --git a/queue-5.15/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch b/queue-5.15/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch new file mode 100644 index 00000000000..e1daddbb7ca --- /dev/null +++ b/queue-5.15/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch @@ -0,0 +1,46 @@ +From 844ef58e539f717debfd234de968f4c99b27bb5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 17:30:37 +0100 +Subject: usb: host: xhci-rcar: remove leftover quirk handling + +From: Wolfram Sang + +[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ] + +Loading V3 firmware does not need a quirk anymore, remove the leftover +code. + +Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-rcar.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c +index 9888ba7d85b6a..cfafa1c50adea 100644 +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -75,7 +75,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3); + + /* For soc_device_attribute */ + #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */ +-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */ + + static const struct soc_device_attribute rcar_quirks_match[] = { + { +@@ -147,8 +146,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd) + + if (quirks & RCAR_XHCI_FIRMWARE_V2) + firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2; +- else if (quirks & RCAR_XHCI_FIRMWARE_V3) +- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3; + else + firmware_name = priv->firmware_name; + +-- +2.39.2 + diff --git a/queue-5.15/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch b/queue-5.15/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch new file mode 100644 index 00000000000..12bc33e21a8 --- /dev/null +++ b/queue-5.15/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch @@ -0,0 +1,73 @@ +From 20c4ac873f7c1fe3c3efd9b6fcefb3a2c258b758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 10:51:59 +0800 +Subject: usb: mtu3: fix kernel panic at qmu transfer done irq handler + +From: Chunfeng Yun + +[ Upstream commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ] + +When handle qmu transfer irq, it will unlock @mtu->lock before give back +request, if another thread handle disconnect event at the same time, and +try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu +irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before +handling it. + +e.g. +qmu done irq on cpu0 thread running on cpu1 + +qmu_done_tx() + handle gpd [0] + mtu3_requ_complete() mtu3_gadget_ep_disable() + unlock @mtu->lock + give back request lock @mtu->lock + mtu3_ep_disable() + mtu3_gpd_ring_free() + unlock @mtu->lock + lock @mtu->lock + get next gpd [1] + +[1]: goto [0] to handle next gpd, and next gpd may be NULL. + +Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/mtu3/mtu3_qmu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 2ea3157ddb6e2..e65586147965d 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -210,6 +210,7 @@ static struct qmu_gpd *advance_enq_gpd(struct mtu3_gpd_ring *ring) + return ring->enqueue; + } + ++/* @dequeue may be NULL if ring is unallocated or freed */ + static struct qmu_gpd *advance_deq_gpd(struct mtu3_gpd_ring *ring) + { + if (ring->dequeue < ring->end) +@@ -484,7 +485,7 @@ static void qmu_done_tx(struct mtu3 *mtu, u8 epnum) + dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n", + __func__, epnum, gpd, gpd_current, ring->enqueue); + +- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) { ++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) { + + mreq = next_request(mep); + +@@ -523,7 +524,7 @@ static void qmu_done_rx(struct mtu3 *mtu, u8 epnum) + dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n", + __func__, epnum, gpd, gpd_current, ring->enqueue); + +- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) { ++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) { + + mreq = next_request(mep); + +-- +2.39.2 + diff --git a/queue-5.15/virtio_ring-don-t-update-event-idx-on-get_buf.patch b/queue-5.15/virtio_ring-don-t-update-event-idx-on-get_buf.patch new file mode 100644 index 00000000000..338e1dc1bce --- /dev/null +++ b/queue-5.15/virtio_ring-don-t-update-event-idx-on-get_buf.patch @@ -0,0 +1,113 @@ +From 8be5cb575b8f35fc371ba5e2c6a7b82f298a49d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 18:23:00 +0800 +Subject: virtio_ring: don't update event idx on get_buf + +From: Albert Huang + +[ Upstream commit 6c0b057cec5eade4c3afec3908821176931a9997 ] + +In virtio_net, if we disable napi_tx, when we trigger a tx interrupt, +the vq->event_triggered will be set to true. It is then never reset +until we explicitly call virtqueue_enable_cb_delayed or +virtqueue_enable_cb_prepare. + +If we disable the napi_tx, virtqueue_enable_cb* will only be called when +the tx ring is getting relatively empty. + +Since event_triggered is true, VRING_AVAIL_F_NO_INTERRUPT or +VRING_PACKED_EVENT_FLAG_DISABLE will not be set. As a result we update +vring_used_event(&vq->split.vring) or vq->packed.vring.driver->off_wrap +every time we call virtqueue_get_buf_ctx. This causes more interrupts. + +To summarize: +1) event_triggered was set to true in vring_interrupt() +2) after this nothing will happen in virtqueue_disable_cb() so + VRING_AVAIL_F_NO_INTERRUPT is not set in avail_flags_shadow +3) virtqueue_get_buf_ctx_split() will still think the cb is enabled + and then it will publish a new event index + +To fix: +update VRING_AVAIL_F_NO_INTERRUPT or VRING_PACKED_EVENT_FLAG_DISABLE in +the vq when we call virtqueue_disable_cb even when event_triggered is +true. + +Tested with iperf: +iperf3 tcp stream: +vm1 -----------------> vm2 +vm2 just receives tcp data stream from vm1, and sends acks to vm1, +there are many tx interrupts in vm2. +with the patch applied there are just a few tx interrupts. + +v2->v3: +-update the interrupt disable flag even with the event_triggered is set, +-instead of checking whether event_triggered is set in +-virtqueue_get_buf_ctx_{packed/split}, will cause the drivers which have +-not called virtqueue_{enable/disable}_cb to miss notifications. + +v3->v4: +-remove change for +-"if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE)" +-in virtqueue_disable_cb_packed + +Fixes: 8d622d21d248 ("virtio: fix up virtio_disable_cb") +Signed-off-by: Albert Huang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Jason Wang +Message-Id: <20230329102300.61000-1-huangjie.albert@bytedance.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 603a6f4345efd..800df63c58692 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -809,6 +809,14 @@ static void virtqueue_disable_cb_split(struct virtqueue *_vq) + + if (!(vq->split.avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) { + vq->split.avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT; ++ ++ /* ++ * If device triggered an event already it won't trigger one again: ++ * no need to disable. ++ */ ++ if (vq->event_triggered) ++ return; ++ + if (vq->event) + /* TODO: this is a hack. Figure out a cleaner value to write. */ + vring_used_event(&vq->split.vring) = 0x0; +@@ -1500,6 +1508,14 @@ static void virtqueue_disable_cb_packed(struct virtqueue *_vq) + + if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE) { + vq->packed.event_flags_shadow = VRING_PACKED_EVENT_FLAG_DISABLE; ++ ++ /* ++ * If device triggered an event already it won't trigger one again: ++ * no need to disable. ++ */ ++ if (vq->event_triggered) ++ return; ++ + vq->packed.vring.driver->flags = + cpu_to_le16(vq->packed.event_flags_shadow); + } +@@ -2019,12 +2035,6 @@ void virtqueue_disable_cb(struct virtqueue *_vq) + { + struct vring_virtqueue *vq = to_vvq(_vq); + +- /* If device triggered an event already it won't trigger one again: +- * no need to disable. +- */ +- if (vq->event_triggered) +- return; +- + if (vq->packed_ring) + virtqueue_disable_cb_packed(_vq); + else +-- +2.39.2 + diff --git a/queue-5.15/vlan-partially-enable-siocshwtstamp-in-container.patch b/queue-5.15/vlan-partially-enable-siocshwtstamp-in-container.patch new file mode 100644 index 00000000000..2ad2d53314d --- /dev/null +++ b/queue-5.15/vlan-partially-enable-siocshwtstamp-in-container.patch @@ -0,0 +1,37 @@ +From 7baf91897b9c105aa8dd726f4db0728a86ec1c04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 08:33:02 -0700 +Subject: vlan: partially enable SIOCSHWTSTAMP in container + +From: Vadim Fedorenko + +[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ] + +Setting timestamp filter was explicitly disabled on vlan devices in +containers because it might affect other processes on the host. But it's +absolutely legit in case when real device is in the same namespace. + +Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container") +Signed-off-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/8021q/vlan_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index a54535cbcf4cf..b6d456c7952ed 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -365,7 +365,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + + switch (cmd) { + case SIOCSHWTSTAMP: +- if (!net_eq(dev_net(dev), &init_net)) ++ if (!net_eq(dev_net(dev), dev_net(real_dev))) + break; + fallthrough; + case SIOCGMIIPHY: +-- +2.39.2 + diff --git a/queue-5.15/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch b/queue-5.15/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch new file mode 100644 index 00000000000..b8e4de1a551 --- /dev/null +++ b/queue-5.15/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch @@ -0,0 +1,95 @@ +From e5ecbfd3dca6d7a1dad56bc833d3deeebb0d2848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 21:01:53 +0900 +Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF + +From: Dae R. Jeong + +[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ] + +During fuzzing, a general protection fault is observed in +vmci_host_poll(). + +general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] +RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 +<- omitting registers -> +Call Trace: + + lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 + add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 + poll_wait include/linux/poll.h:49 [inline] + vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 + vfs_poll include/linux/poll.h:88 [inline] + do_pollfd fs/select.c:873 [inline] + do_poll fs/select.c:921 [inline] + do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 + __do_sys_ppoll fs/select.c:1121 [inline] + __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Example thread interleaving that causes the general protection fault +is as follows: + +CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) +----- ----- +// Read uninitialized context +context = vmci_host_dev->context; + // Initialize context + vmci_host_dev->context = vmci_ctx_create(); + vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; + +if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { + // Dereferencing the wrong pointer + poll_wait(..., &context->host_context); +} + +In this scenario, vmci_host_poll() reads vmci_host_dev->context first, +and then reads vmci_host_dev->ct_type to check that +vmci_host_dev->context is initialized. However, since these two reads +are not atomically executed, there is a chance of a race condition as +described above. + +To fix this race condition, read vmci_host_dev->context after checking +the value of vmci_host_dev->ct_type so that vmci_host_poll() always +reads an initialized context. + +Reported-by: Dae R. Jeong +Fixes: 8bf503991f87 ("VMCI: host side driver implementation.") +Signed-off-by: Dae R. Jeong +Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index 857b9851402a6..abe79f6fd2a79 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -165,10 +165,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp) + static __poll_t vmci_host_poll(struct file *filp, poll_table *wait) + { + struct vmci_host_dev *vmci_host_dev = filp->private_data; +- struct vmci_ctx *context = vmci_host_dev->context; ++ struct vmci_ctx *context; + __poll_t mask = 0; + + if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { ++ /* ++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make ++ * sure that context is initialized ++ */ ++ context = vmci_host_dev->context; ++ + /* Check for VMCI calls to this VM context. */ + if (wait) + poll_wait(filp, &context->host_context.wait_queue, +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch b/queue-5.15/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch new file mode 100644 index 00000000000..e4211369351 --- /dev/null +++ b/queue-5.15/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch @@ -0,0 +1,39 @@ +From 1cb362312cb55db98d37afb35a700cdc09e317b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 16:15:48 +0300 +Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() + +From: Dan Carpenter + +[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ] + +This loop checks that i < max at the start of loop but then it does +i++ which could put it past the end of the array. It's harmless to +check again and prevent a potential out of bounds. + +Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data") +Signed-off-by: Dan Carpenter +Reviewed-by: Luis Chamberlain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index d444b3d70ba2e..58d3e86f6256d 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max, + ee->ee_n_piers[mode]++; + + freq2 = (val >> 8) & 0xff; +- if (!freq2) ++ if (!freq2 || i >= max) + break; + + pc[i++].freq = ath5k_eeprom_bin2freq(ee, +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath6kl-minor-fix-for-allocation-size.patch b/queue-5.15/wifi-ath6kl-minor-fix-for-allocation-size.patch new file mode 100644 index 00000000000..eaaf98875ca --- /dev/null +++ b/queue-5.15/wifi-ath6kl-minor-fix-for-allocation-size.patch @@ -0,0 +1,40 @@ +From 7f32e92dc2f411b9789018479c77469966189bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 20:31:37 +0200 +Subject: wifi: ath6kl: minor fix for allocation size + +From: Alexey V. Vissarionov + +[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ] + +Although the "param" pointer occupies more or equal space compared +to "*param", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver") +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/bmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c +index bde5a10d470c8..af98e871199d3 100644 +--- a/drivers/net/wireless/ath/ath6kl/bmi.c ++++ b/drivers/net/wireless/ath/ath6kl/bmi.c +@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param) + return -EACCES; + } + +- size = sizeof(cid) + sizeof(addr) + sizeof(param); ++ size = sizeof(cid) + sizeof(addr) + sizeof(*param); + if (size > ar->bmi.max_cmd_size) { + WARN_ON(1); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch b/queue-5.15/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch new file mode 100644 index 00000000000..f6d038d70c4 --- /dev/null +++ b/queue-5.15/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch @@ -0,0 +1,43 @@ +From fb6ee7e093e0a4fd970ecb423b2eafbc7c8f85a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 12:28:05 +0200 +Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback + +From: Fedor Pchelkin + +[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ] + +The warn is triggered on a known race condition, documented in the code above +the test, that is correctly handled. Using WARN() hinders automated testing. +Reducing severity. + +Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload") +Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +index c68848819a52d..9b88d96bfe96c 100644 +--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c ++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +@@ -960,8 +960,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb, + * Thus the possibility of ar->htc_target being NULL + * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work. + */ +- if (WARN_ON_ONCE(!target)) { +- ath6kl_err("Target not yet initialized\n"); ++ if (!target) { ++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n"); + status = -EINVAL; + goto free_skb; + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch b/queue-5.15/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch new file mode 100644 index 00000000000..867bdc87800 --- /dev/null +++ b/queue-5.15/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch @@ -0,0 +1,87 @@ +From 949e6bba52657e8c789166b50eeb3c5ae5bdd069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 22:23:01 +0300 +Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] + +hif_dev->remain_skb is allocated and used exclusively in +ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is +processed and subsequently freed (in error paths) only during the next +call of ath9k_hif_usb_rx_stream(). + +So, if the urbs are deallocated between those two calls due to the device +deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() +is not called next time and the allocated remain_skb is leaked. Our local +Syzkaller instance was able to trigger that. + +remain_skb makes sense when receiving two consecutive urbs which are +logically linked together, i.e. a specific data field from the first skb +indicates a cached skb to be allocated, memcpy'd with some data and +subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs +deallocation supposedly makes that link irrelevant so we need to free the +cached skb in those cases. + +Fix the leak by introducing a function to explicitly free remain_skb (if +it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL +when it has not been allocated at all (hif_dev struct is kzalloced) or +when it has been processed in next call to ath9k_hif_usb_rx_stream(). + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index f521dfa2f1945..e0130beb304df 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = { + .send = hif_usb_send, + }; + ++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream ++ * in case ath9k_hif_usb_rx_stream wasn't called next time to ++ * process the buffer and subsequently free it. ++ */ ++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&hif_dev->rx_lock, flags); ++ if (hif_dev->remain_skb) { ++ dev_kfree_skb_any(hif_dev->remain_skb); ++ hif_dev->remain_skb = NULL; ++ hif_dev->rx_remain_len = 0; ++ RX_STAT_INC(hif_dev, skb_dropped); ++ } ++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags); ++} ++ + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + struct sk_buff *skb) + { +@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + { + usb_kill_anchored_urbs(&hif_dev->rx_submitted); ++ ath9k_hif_usb_free_rx_remain_skb(hif_dev); + } + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) +-- +2.39.2 + diff --git a/queue-5.15/wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch b/queue-5.15/wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch new file mode 100644 index 00000000000..a75d29d4190 --- /dev/null +++ b/queue-5.15/wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch @@ -0,0 +1,61 @@ +From 6a746a3e439df5cf1851c039d083bfb5f42ccb3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 10:42:48 +0000 +Subject: wifi: brcmfmac: support CQM RSSI notification with older firmware + +From: John Keeping + +[ Upstream commit ec52d77d077529f198fd874c550a26b9cc86a331 ] + +Using the BCM4339 firmware from linux-firmware (version "BCM4339/2 wl0: +Sep 5 2019 11:05:52 version 6.37.39.113 (r722271 CY)" from +cypress/cyfmac4339-sdio.bin) the RSSI respose is only 4 bytes, which +results in an error being logged. + +It seems that older devices send only the RSSI field and neither SNR nor +noise is included. Handle this by accepting a 4 byte message and +reading only the RSSI from it. + +Fixes: 7dd56ea45a66 ("brcmfmac: add support for CQM RSSI notifications") +Signed-off-by: John Keeping +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230124104248.2917465-1-john@metanate.com +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index cba909c5bc6b6..5a1b01db02e6e 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6212,18 +6212,20 @@ static s32 brcmf_notify_rssi(struct brcmf_if *ifp, + { + struct brcmf_cfg80211_vif *vif = ifp->vif; + struct brcmf_rssi_be *info = data; +- s32 rssi, snr, noise; ++ s32 rssi, snr = 0, noise = 0; + s32 low, high, last; + +- if (e->datalen < sizeof(*info)) { ++ if (e->datalen >= sizeof(*info)) { ++ rssi = be32_to_cpu(info->rssi); ++ snr = be32_to_cpu(info->snr); ++ noise = be32_to_cpu(info->noise); ++ } else if (e->datalen >= sizeof(rssi)) { ++ rssi = be32_to_cpu(*(__be32 *)data); ++ } else { + brcmf_err("insufficient RSSI event data\n"); + return 0; + } + +- rssi = be32_to_cpu(info->rssi); +- snr = be32_to_cpu(info->snr); +- noise = be32_to_cpu(info->noise); +- + low = vif->cqm_rssi_low; + high = vif->cqm_rssi_high; + last = vif->cqm_rssi_last; +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch b/queue-5.15/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch new file mode 100644 index 00000000000..dab61d5e22c --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch @@ -0,0 +1,42 @@ +From 72d61261bb081aa3bc198417f4df481449718df7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 12:28:05 +0300 +Subject: wifi: iwlwifi: fw: fix memory leak in debugfs + +From: Johannes Berg + +[ Upstream commit 3d90d2f4a018fe8cfd65068bc6350b6222be4852 ] + +Fix a memory leak that occurs when reading the fw_info +file all the way, since we return NULL indicating no +more data, but don't free the status tracking object. + +Fixes: 36dfe9ac6e8b ("iwlwifi: dump api version in yaml format") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230418122405.239e501b3b8d.I4268f87809ef91209cbcd748eee0863195e70fa2@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +index a152ce3064759..e372f935f6983 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +@@ -317,8 +317,10 @@ static void *iwl_dbgfs_fw_info_seq_next(struct seq_file *seq, + const struct iwl_fw *fw = priv->fwrt->fw; + + *pos = ++state->pos; +- if (*pos >= fw->ucode_capa.n_cmd_versions) ++ if (*pos >= fw->ucode_capa.n_cmd_versions) { ++ kfree(state); + return NULL; ++ } + + return state; + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-fw-move-memset-before-early-return.patch b/queue-5.15/wifi-iwlwifi-fw-move-memset-before-early-return.patch new file mode 100644 index 00000000000..926e8ec880c --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-fw-move-memset-before-early-return.patch @@ -0,0 +1,53 @@ +From 27036d7d124d6693759c08fb73f8aabec456c19c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:11:58 +0300 +Subject: wifi: iwlwifi: fw: move memset before early return + +From: Tom Rix + +[ Upstream commit 8ce437dd5b2e4adef13aa4ecce07392f9966b1ab ] + +Clang static analysis reports this representative issue +dbg.c:1455:6: warning: Branch condition evaluates to +a garbage value + if (!rxf_data.size) + ^~~~~~~~~~~~~~ + +This check depends on iwl_ini_get_rxf_data() to clear +rxf_data but the function can return early without +doing the clear. So move the memset before the early +return. + +Fixes: cc9b6012d34b ("iwlwifi: yoyo: use hweight_long instead of bit manipulating") +Signed-off-by: Tom Rix +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230414130637.872a7175f1ff.I33802a77a91998276992b088fbe25f61c87c33ac@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +index 69616a2868bb8..c69f3fb833327 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -1362,13 +1362,13 @@ static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt, + if (!data) + return; + ++ memset(data, 0, sizeof(*data)); ++ + /* make sure only one bit is set in only one fid */ + if (WARN_ONCE(hweight_long(fid1) + hweight_long(fid2) != 1, + "fid1=%x, fid2=%x\n", fid1, fid2)) + return; + +- memset(data, 0, sizeof(*data)); +- + if (fid1) { + fifo_idx = ffs(fid1) - 1; + if (WARN_ONCE(fifo_idx >= MAX_NUM_LMAC, "fifo_idx=%d\n", +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch b/queue-5.15/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch new file mode 100644 index 00000000000..a700dfc8b4e --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch @@ -0,0 +1,50 @@ +From 955aeeea903c991885525ec26e2e02e29575862e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 15:47:38 +0300 +Subject: wifi: iwlwifi: make the loop for card preparation effective + +From: Emmanuel Grumbach + +[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ] + +Since we didn't reset t to 0, only the first iteration of the loop +did checked the ready bit several times. +From the second iteration and on, we just tested the bit once and +continued to the next iteration. + +Reported-and-tested-by: Lorenzo Zolfanelli +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452 +Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 02da9cc8646cf..ee325950de9d2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -581,7 +581,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans) + int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; +- int t = 0; + int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); +@@ -596,6 +595,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + usleep_range(1000, 2000); + + for (iter = 0; iter < 10; iter++) { ++ int t = 0; ++ + /* If HW is not ready, prepare the conditions to check again */ + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, + CSR_HW_IF_CONFIG_REG_PREPARE); +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-check-firmware-response-size.patch b/queue-5.15/wifi-iwlwifi-mvm-check-firmware-response-size.patch new file mode 100644 index 00000000000..8116c0d15fa --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-check-firmware-response-size.patch @@ -0,0 +1,53 @@ +From a9d01ed58244a5a1237a9f188441e34d49b1be97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 11:41:33 +0300 +Subject: wifi: iwlwifi: mvm: check firmware response size + +From: Johannes Berg + +[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ] + +Check the firmware response size for responses to the +memory read/write command in debugfs before using it. + +Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +index d398a06b26567..0f5c4c2510ef1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +@@ -1931,6 +1931,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +@@ -2008,6 +2013,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-initialize-seq-variable.patch b/queue-5.15/wifi-iwlwifi-mvm-initialize-seq-variable.patch new file mode 100644 index 00000000000..80d6cbb32c8 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-initialize-seq-variable.patch @@ -0,0 +1,44 @@ +From a1c3e79606c5aa9e91393f7b433ab826fb8e1f5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:11:57 +0300 +Subject: wifi: iwlwifi: mvm: initialize seq variable + +From: Tom Rix + +[ Upstream commit 11e94d2bcd88dea5d9ce99555b6b172f5232d3e2 ] + +Clang static analysis reports this issue +d3.c:567:22: warning: The left operand of '>' is + a garbage value + if (seq.tkip.iv32 > cur_rx_iv32) + ~~~~~~~~~~~~~ ^ + +seq is never initialized. Call ieee80211_get_key_rx_seq() to +initialize seq. + +Fixes: 0419e5e672d6 ("iwlwifi: mvm: d3: separate TKIP data from key iteration") +Signed-off-by: Tom Rix +Reviewed-by: Nick Desaulniers +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230414130637.6dd372f84f93.If1f708c90e6424a935b4eba3917dfb7582e0dd0a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index 00ca17f3b263c..6dde3bd8f4416 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -564,6 +564,7 @@ static void iwl_mvm_wowlan_get_tkip_data(struct ieee80211_hw *hw, + } + + for (i = 0; i < IWL_NUM_RSC; i++) { ++ ieee80211_get_key_rx_seq(key, i, &seq); + /* wrapping isn't allowed, AP must rekey */ + if (seq.tkip.iv32 > cur_rx_iv32) + cur_rx_iv32 = seq.tkip.iv32; +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch b/queue-5.15/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch new file mode 100644 index 00000000000..06c169ab304 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch @@ -0,0 +1,44 @@ +From e04191f6aae2def3fb1d6096fd39ab377f1e9efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 21:40:34 +0300 +Subject: wifi: iwlwifi: yoyo: Fix possible division by zero + +From: Daniel Gabay + +[ Upstream commit ba30415118eee374a08b39a0460a1d1e52c24a25 ] + +Don't allow buffer allocation TLV with zero req_size since it +leads later to division by zero in iwl_dbg_tlv_alloc_fragments(). +Also, NPK/SRAM locations are allowed to have zero buffer req_size, +don't discard them. + +Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support") +Signed-off-by: Daniel Gabay +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.5d6688ed74d8.I5c2f3a882b50698b708d54f4524dc5bdf11e3d32@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +index fc4197bf2478e..f9bd081dd9e08 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +@@ -134,6 +134,12 @@ static int iwl_dbg_tlv_alloc_buf_alloc(struct iwl_trans *trans, + alloc_id != IWL_FW_INI_ALLOCATION_ID_DBGC1) + goto err; + ++ if (buf_location == IWL_FW_INI_LOCATION_DRAM_PATH && ++ alloc->req_size == 0) { ++ IWL_ERR(trans, "WRT: Invalid DRAM buffer allocation requested size (0)\n"); ++ return -EINVAL; ++ } ++ + trans->dbg.fw_mon_cfg[alloc_id] = *alloc; + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch b/queue-5.15/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch new file mode 100644 index 00000000000..3e9f679178c --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch @@ -0,0 +1,49 @@ +From 00d004038f568c5abbc1ea53bb6638a95f224db7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 21:40:33 +0300 +Subject: wifi: iwlwifi: yoyo: skip dump correctly on hw error + +From: Daniel Gabay + +[ Upstream commit 11195ab0d6f3202cf7af1a4c69570f59c377d8ad ] + +When NIC is in a bad state, reading data will return 28 bits as +0xa5a5a5a and the lowest 4 bits are not fixed value. + +Mask these bits in a few places to skip the dump correctly. + +Fixes: 89639e06d0f3 ("iwlwifi: yoyo: support for new DBGI_SRAM region") +Signed-off-by: Daniel Gabay +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.df6c0663179d.I36d8487b2419c6fefa65e5514855d94327c3b1eb@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +index b00cf92c8965a..69616a2868bb8 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -1022,7 +1022,7 @@ iwl_dump_ini_prph_mac_iter(struct iwl_fw_runtime *fwrt, + range->range_data_size = reg->dev_addr.size; + for (i = 0; i < le32_to_cpu(reg->dev_addr.size); i += 4) { + prph_val = iwl_read_prph(fwrt->trans, addr + i); +- if (prph_val == 0x5a5a5a5a) ++ if ((prph_val & ~0xf) == 0xa5a5a5a0) + return -EBUSY; + *val++ = cpu_to_le32(prph_val); + } +@@ -1536,7 +1536,7 @@ iwl_dump_ini_dbgi_sram_iter(struct iwl_fw_runtime *fwrt, + prph_data = iwl_read_prph(fwrt->trans, (i % 2) ? + DBGI_SRAM_TARGET_ACCESS_RDATA_MSB : + DBGI_SRAM_TARGET_ACCESS_RDATA_LSB); +- if (prph_data == 0x5a5a5a5a) { ++ if ((prph_data & ~0xf) == 0xa5a5a5a0) { + iwl_trans_release_nic_access(fwrt->trans); + return -EBUSY; + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt76-add-flexible-polling-wait-interval-support.patch b/queue-5.15/wifi-mt76-add-flexible-polling-wait-interval-support.patch new file mode 100644 index 00000000000..5870aede070 --- /dev/null +++ b/queue-5.15/wifi-mt76-add-flexible-polling-wait-interval-support.patch @@ -0,0 +1,79 @@ +From f5a5da248f300fd402fd2598b8ccaa1eb9aa7f24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 12:56:46 +0800 +Subject: wifi: mt76: add flexible polling wait-interval support + +From: Deren Wu + +[ Upstream commit 35effe6c0c24adcf0f732bb1c3d75573d4c88e63 ] + +The default waiting unit is 10ms and the value is too much for +data path related control. Provide a new API mt76_poll_msec_tick() +to support different cases, such as 1ms polling waiting kick. + +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Stable-dep-of: c397fc1e6365 ("wifi: mt76: mt7921e: fix probe timeout after reboot") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76.h | 9 +++++---- + drivers/net/wireless/mediatek/mt76/util.c | 10 +++++----- + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h +index 4e4af6e17b503..eb1fb955b7777 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76.h +@@ -820,10 +820,11 @@ bool __mt76_poll(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, + + #define mt76_poll(dev, ...) __mt76_poll(&((dev)->mt76), __VA_ARGS__) + +-bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, +- int timeout); +- +-#define mt76_poll_msec(dev, ...) __mt76_poll_msec(&((dev)->mt76), __VA_ARGS__) ++bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, ++ int timeout, int kick); ++#define __mt76_poll_msec(...) ____mt76_poll_msec(__VA_ARGS__, 10) ++#define mt76_poll_msec(dev, ...) ____mt76_poll_msec(&((dev)->mt76), __VA_ARGS__, 10) ++#define mt76_poll_msec_tick(dev, ...) ____mt76_poll_msec(&((dev)->mt76), __VA_ARGS__) + + void mt76_mmio_init(struct mt76_dev *dev, void __iomem *regs); + void mt76_pci_disable_aspm(struct pci_dev *pdev); +diff --git a/drivers/net/wireless/mediatek/mt76/util.c b/drivers/net/wireless/mediatek/mt76/util.c +index 581964425468f..fc76c66ff1a5a 100644 +--- a/drivers/net/wireless/mediatek/mt76/util.c ++++ b/drivers/net/wireless/mediatek/mt76/util.c +@@ -24,23 +24,23 @@ bool __mt76_poll(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, + } + EXPORT_SYMBOL_GPL(__mt76_poll); + +-bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, +- int timeout) ++bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, ++ int timeout, int tick) + { + u32 cur; + +- timeout /= 10; ++ timeout /= tick; + do { + cur = __mt76_rr(dev, offset) & mask; + if (cur == val) + return true; + +- usleep_range(10000, 20000); ++ usleep_range(1000 * tick, 2000 * tick); + } while (timeout-- > 0); + + return false; + } +-EXPORT_SYMBOL_GPL(__mt76_poll_msec); ++EXPORT_SYMBOL_GPL(____mt76_poll_msec); + + int mt76_wcid_alloc(u32 *mask, int size) + { +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch b/queue-5.15/wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch new file mode 100644 index 00000000000..65ffa854bc4 --- /dev/null +++ b/queue-5.15/wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch @@ -0,0 +1,59 @@ +From 1234d18562e2cd1ba5690d928122101ea08f585a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 21:26:12 +0800 +Subject: wifi: mt76: fix 6GHz high channel not be scanned + +From: Ming Yen Hsieh + +[ Upstream commit 23792cedaff02351b57bddd8957fc917fa88f2e0 ] + +mt76 scan command only support 64 channels currently. If the +channel count is larger than 64(for 2+5+6GHz), some channels will +not be scanned. Hence change the scan type to full channel scan +in case of the command cannot include proper list for chip. + +Fixes: 399090ef9605 ("mt76: mt76_connac: move hw_scan and sched_scan routine in mt76_connac_mcu module") +Reported-by: Ben Greear +Tested-by: Isaac Konikoff +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index 017bd59c4ea80..98f651fec3bf3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -1446,8 +1446,16 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, + req->channel_min_dwell_time = cpu_to_le16(duration); + req->channel_dwell_time = cpu_to_le16(duration); + +- req->channels_num = min_t(u8, sreq->n_channels, 32); +- req->ext_channels_num = min_t(u8, ext_channels_num, 32); ++ if (sreq->n_channels == 0 || sreq->n_channels > 64) { ++ req->channel_type = 0; ++ req->channels_num = 0; ++ req->ext_channels_num = 0; ++ } else { ++ req->channel_type = 4; ++ req->channels_num = min_t(u8, sreq->n_channels, 32); ++ req->ext_channels_num = min_t(u8, ext_channels_num, 32); ++ } ++ + for (i = 0; i < req->channels_num + req->ext_channels_num; i++) { + if (i >= 32) + chan = &req->ext_channels[i - 32]; +@@ -1457,7 +1465,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, + chan->band = scan_list[i]->band == NL80211_BAND_2GHZ ? 1 : 2; + chan->channel_num = scan_list[i]->hw_value; + } +- req->channel_type = sreq->n_channels ? 4 : 0; + + if (sreq->ie_len > 0) { + memcpy(req->ies, sreq->ie, sreq->ie_len); +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch b/queue-5.15/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch new file mode 100644 index 00000000000..8bab054de86 --- /dev/null +++ b/queue-5.15/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch @@ -0,0 +1,48 @@ +From 6bbfc8ad23cdd82a2e4d7d58c61e2fcabec24981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 22:48:23 +0800 +Subject: wifi: mt76: handle failure of vzalloc in mt7615_coredump_work + +From: Kang Chen + +[ Upstream commit 9e47dd9f64a47ae00ca0123017584c37209ee900 ] + +vzalloc may fails, dump might be null and will cause +illegal address access later. + +Link: https://lore.kernel.org/all/Y%2Fy5Asxw3T3m4jCw@lore-desk +Fixes: d2bf7959d9c0 ("mt76: mt7663: introduce coredump support") +Signed-off-by: Kang Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index c7e084821b292..37bc307c19719 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -2273,7 +2273,7 @@ void mt7615_coredump_work(struct work_struct *work) + break; + + skb_pull(skb, sizeof(struct mt7615_mcu_rxd)); +- if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { ++ if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { + dev_kfree_skb(skb); + continue; + } +@@ -2283,6 +2283,8 @@ void mt7615_coredump_work(struct work_struct *work) + + dev_kfree_skb(skb); + } +- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, +- GFP_KERNEL); ++ ++ if (dump) ++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, ++ GFP_KERNEL); + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch b/queue-5.15/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch new file mode 100644 index 00000000000..23d52f9ce53 --- /dev/null +++ b/queue-5.15/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch @@ -0,0 +1,50 @@ +From 5cc3b0825354108e373b42ea67d5041cbb5aa8c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 15:41:12 +0800 +Subject: wifi: mt76: mt7921e: fix probe timeout after reboot + +From: Quan Zhou + +[ Upstream commit c397fc1e6365a2a9e5540a85b2c1d4ea412aa0e2 ] + +In system warm reboot scene, due to the polling timeout(now 1000us) +is too short to wait dma idle in time, it may make driver probe fail +with error code -ETIMEDOUT. Meanwhile, we also found the dma may take +around 70ms to enter idle state. Change the polling idle timeout to +100ms to avoid the probabilistic probe fail. + +Tested pass with 5000 times warm reboot on x86 platform. + +[4.477496] pci 0000:01:00.0: attach allowed to drvr mt7921e [internal device] +[4.478306] mt7921e 0000:01:00.0: ASIC revision: 79610010 +[4.480063] mt7921e: probe of 0000:01:00.0 failed with error -110 + +Fixes: 0a1059d0f060 ("mt76: mt7921: move mt7921_dma_reset in dma.c") +Signed-off-by: Quan Zhou +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/dma.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +index 93d0cc1827d26..7e39bcfdb0b7a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +@@ -144,9 +144,9 @@ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force) + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO | + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2); + +- if (!mt76_poll(dev, MT_WFDMA0_GLO_CFG, +- MT_WFDMA0_GLO_CFG_TX_DMA_BUSY | +- MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 1000)) ++ if (!mt76_poll_msec_tick(dev, MT_WFDMA0_GLO_CFG, ++ MT_WFDMA0_GLO_CFG_TX_DMA_BUSY | ++ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1)) + return -ETIMEDOUT; + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch b/queue-5.15/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch new file mode 100644 index 00000000000..8dd7cbc465f --- /dev/null +++ b/queue-5.15/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch @@ -0,0 +1,107 @@ +From cb4a79e355f8ea84a519e008ea9dbe7f368782a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 05:11:13 +0800 +Subject: wifi: mt76: mt7921e: improve reliability of dma reset + +From: Quan Zhou + +[ Upstream commit 87714bf6ed1589813e473db5471e6e9857755764 ] + +The hardware team has advised the driver that it is necessary to first put +WFDMA into an idle state before resetting the WFDMA. Otherwise, the WFDMA +may enter an unknown state where it cannot be polled with the right state +successfully. To ensure that the DMA can work properly while a stressful +cold reboot test was being made, we have reordered the programming sequence +in the driver based on the hardware team's guidance. + +The patch would modify the WFDMA disabling flow from + +"DMA reset -> disabling DMASHDL -> disabling WFDMA -> polling and waiting +until DMA idle" to "disabling WFDMA -> polling and waiting for DMA idle -> +disabling DMASHDL -> DMA reset. + +Where he polling and waiting until WFDMA is idle is coordinated with the +operation of disabling WFDMA. Even while WFDMA is being disabled, it can +still handle Tx/Rx requests. The additional polling allows sufficient time +for WFDMA to process the last T/Rx request. When the idle state of WFDMA is +reached, it is a reliable indication that DMASHDL is also idle to ensure it +is safe to disable it and perform the DMA reset. + +Fixes: 0a1059d0f060 ("mt76: mt7921: move mt7921_dma_reset in dma.c") +Co-developed-by: Sean Wang +Signed-off-by: Sean Wang +Co-developed-by: Deren Wu +Signed-off-by: Deren Wu +Co-developed-by: Wang Zhao +Signed-off-by: Wang Zhao +Signed-off-by: Quan Zhou +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7921/dma.c | 36 ++++++++++--------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +index 7e39bcfdb0b7a..983861edc6834 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +@@ -120,22 +120,6 @@ static void mt7921_dma_prefetch(struct mt7921_dev *dev) + + static int mt7921_dma_disable(struct mt7921_dev *dev, bool force) + { +- if (force) { +- /* reset */ +- mt76_clear(dev, MT_WFDMA0_RST, +- MT_WFDMA0_RST_DMASHDL_ALL_RST | +- MT_WFDMA0_RST_LOGIC_RST); +- +- mt76_set(dev, MT_WFDMA0_RST, +- MT_WFDMA0_RST_DMASHDL_ALL_RST | +- MT_WFDMA0_RST_LOGIC_RST); +- } +- +- /* disable dmashdl */ +- mt76_clear(dev, MT_WFDMA0_GLO_CFG_EXT0, +- MT_WFDMA0_CSR_TX_DMASHDL_ENABLE); +- mt76_set(dev, MT_DMASHDL_SW_CONTROL, MT_DMASHDL_DMASHDL_BYPASS); +- + /* disable WFDMA0 */ + mt76_clear(dev, MT_WFDMA0_GLO_CFG, + MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN | +@@ -149,6 +133,22 @@ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force) + MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1)) + return -ETIMEDOUT; + ++ /* disable dmashdl */ ++ mt76_clear(dev, MT_WFDMA0_GLO_CFG_EXT0, ++ MT_WFDMA0_CSR_TX_DMASHDL_ENABLE); ++ mt76_set(dev, MT_DMASHDL_SW_CONTROL, MT_DMASHDL_DMASHDL_BYPASS); ++ ++ if (force) { ++ /* reset */ ++ mt76_clear(dev, MT_WFDMA0_RST, ++ MT_WFDMA0_RST_DMASHDL_ALL_RST | ++ MT_WFDMA0_RST_LOGIC_RST); ++ ++ mt76_set(dev, MT_WFDMA0_RST, ++ MT_WFDMA0_RST_DMASHDL_ALL_RST | ++ MT_WFDMA0_RST_LOGIC_RST); ++ } ++ + return 0; + } + +@@ -354,6 +354,10 @@ void mt7921_dma_cleanup(struct mt7921_dev *dev) + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO | + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2); + ++ mt76_poll_msec_tick(dev, MT_WFDMA0_GLO_CFG, ++ MT_WFDMA0_GLO_CFG_TX_DMA_BUSY | ++ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1); ++ + /* reset */ + mt76_clear(dev, MT_WFDMA0_RST, + MT_WFDMA0_RST_DMASHDL_ALL_RST | +-- +2.39.2 + diff --git a/queue-5.15/wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch b/queue-5.15/wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch new file mode 100644 index 00000000000..42f4fed9430 --- /dev/null +++ b/queue-5.15/wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch @@ -0,0 +1,65 @@ +From f4992d0855fe1749f8126eab55a490b010b888b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 23:56:37 +0200 +Subject: wifi: rt2x00: Fix memory leak when handling surveys + +From: Armin Wolf + +[ Upstream commit cbef9a83c51dfcb07f77cfa6ac26f53a1ea86f49 ] + +When removing a rt2x00 device, its associated channel surveys +are not freed, causing a memory leak observable with kmemleak: + +unreferenced object 0xffff9620f0881a00 (size 512): + comm "systemd-udevd", pid 2290, jiffies 4294906974 (age 33.768s) + hex dump (first 32 bytes): + 70 44 12 00 00 00 00 00 92 8a 00 00 00 00 00 00 pD.............. + 00 00 00 00 00 00 00 00 ab 87 01 00 00 00 00 00 ................ + backtrace: + [] __kmalloc+0x4b/0x130 + [] rt2800_probe_hw+0xc2b/0x1380 [rt2800lib] + [] rt2800usb_probe_hw+0xe/0x60 [rt2800usb] + [] rt2x00lib_probe_dev+0x21a/0x7d0 [rt2x00lib] + [] rt2x00usb_probe+0x1be/0x980 [rt2x00usb] + [] usb_probe_interface+0xe2/0x310 [usbcore] + [] really_probe+0x1a5/0x410 + [] __driver_probe_device+0x78/0x180 + [] driver_probe_device+0x1e/0x90 + [] __driver_attach+0xd2/0x1c0 + [] bus_for_each_dev+0x77/0xd0 + [] bus_add_driver+0x112/0x210 + [] driver_register+0x5c/0x120 + [] usb_register_driver+0x88/0x150 [usbcore] + [] do_one_initcall+0x44/0x220 + [] do_init_module+0x4c/0x220 + +Fix this by freeing the channel surveys on device removal. + +Tested with a RT3070 based USB wireless adapter. + +Fixes: 5447626910f5 ("rt2x00: save survey for every channel visited") +Signed-off-by: Armin Wolf +Reviewed-by: Simon Horman +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230330215637.4332-1-W_Armin@gmx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +index e95c101c27111..388675d073ce2 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +@@ -1091,6 +1091,7 @@ static void rt2x00lib_remove_hw(struct rt2x00_dev *rt2x00dev) + } + + kfree(rt2x00dev->spec.channels_info); ++ kfree(rt2x00dev->chan_survey); + } + + static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev) +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch b/queue-5.15/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch new file mode 100644 index 00000000000..06ff40294cb --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch @@ -0,0 +1,54 @@ +From 26453a1f7bf3ffbdba86c1baa7f61e4f3f741353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:31:38 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_rfreg() + +From: Wei Chen + +[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ] + +If there is a failure during copy_from_user or user-provided data buffer +is invalid, rtl_debugfs_set_write_rfreg should return negative error code +instead of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 0b1bc04cb6adb..602717928887d 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -375,8 +375,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -386,7 +386,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + if (num != 4) { + rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, + "Format is \n"); +- return count; ++ return -EINVAL; + } + + rtl_set_rfreg(hw, path, addr, bitmask, data); +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-15397 b/queue-5.15/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-15397 new file mode 100644 index 00000000000..e3c2b420af9 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-15397 @@ -0,0 +1,54 @@ +From 6d4f7eb5c14350ba3f76bd120508c215ae0045a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:42:17 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_reg() + +From: Wei Chen + +[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ] + +If there is a failure during copy_from_user or user-provided data buffer is +invalid, rtl_debugfs_set_write_reg should return negative error code instead +of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 602717928887d..9eb26dfe4ca92 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -278,8 +278,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -287,7 +287,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + num = sscanf(tmp, "%x %x %x", &addr, &val, &len); + + if (num != 3) +- return count; ++ return -EINVAL; + + switch (len) { + case 1: +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch b/queue-5.15/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch new file mode 100644 index 00000000000..1f45a8685f8 --- /dev/null +++ b/queue-5.15/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch @@ -0,0 +1,51 @@ +From 1eca721438ea7b6713082a0d4833693ba18fd9de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 23:10:04 +0100 +Subject: wifi: rtw88: mac: Return the original error from + rtw_mac_power_switch() + +From: Martin Blumenstingl + +[ Upstream commit 15c8e267dfa62f207ee1db666c822324e3362b84 ] + +rtw_mac_power_switch() calls rtw_pwr_seq_parser() which can return +-EINVAL, -EBUSY or 0. Propagate the original error code instead of +unconditionally returning -EINVAL in case of an error. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230226221004.138331-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index 6ad235d7145e1..a0576cc0c8452 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -247,6 +247,7 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + const struct rtw_pwr_seq_cmd **pwr_seq; + u8 rpwm; + bool cur_pwr; ++ int ret; + + if (rtw_chip_wcpu_11ac(rtwdev)) { + rpwm = rtw_read8(rtwdev, rtwdev->hci.rpwm_addr); +@@ -270,8 +271,9 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + return -EALREADY; + + pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq; +- if (rtw_pwr_seq_parser(rtwdev, pwr_seq)) +- return -EINVAL; ++ ret = rtw_pwr_seq_parser(rtwdev, pwr_seq); ++ if (ret) ++ return ret; + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch b/queue-5.15/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch new file mode 100644 index 00000000000..67f38ed5407 --- /dev/null +++ b/queue-5.15/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch @@ -0,0 +1,39 @@ +From ff18e1ded85caa3f412209f46182b4796aa44a20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 23:10:03 +0100 +Subject: wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() + +From: Martin Blumenstingl + +[ Upstream commit b7ed9fa2cb76ca7a3c3cd4a6d35748fe1fbda9f6 ] + +rtw_pwr_seq_parser() calls rtw_sub_pwr_seq_parser() which can either +return -EBUSY, -EINVAL or 0. Propagate the original error code instead +of unconditionally returning -EBUSY in case of an error. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230226221004.138331-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index d1678aed9d9cb..6ad235d7145e1 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -233,7 +233,7 @@ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev, + + ret = rtw_sub_pwr_seq_parser(rtwdev, intf_mask, cut_mask, cmd); + if (ret) +- return -EBUSY; ++ return ret; + + idx++; + } while (1); +-- +2.39.2 + diff --git a/queue-5.15/workqueue-fix-hung-time-report-of-worker-pools.patch b/queue-5.15/workqueue-fix-hung-time-report-of-worker-pools.patch new file mode 100644 index 00000000000..6151c6d5aa0 --- /dev/null +++ b/queue-5.15/workqueue-fix-hung-time-report-of-worker-pools.patch @@ -0,0 +1,71 @@ +From e9a11e7ee14b232be482322fac960ea989f4b3cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:53:31 +0100 +Subject: workqueue: Fix hung time report of worker pools + +From: Petr Mladek + +[ Upstream commit 335a42ebb0ca8ee9997a1731aaaae6dcd704c113 ] + +The workqueue watchdog prints a warning when there is no progress in +a worker pool. Where the progress means that the pool started processing +a pending work item. + +Note that it is perfectly fine to process work items much longer. +The progress should be guaranteed by waking up or creating idle +workers. + +show_one_worker_pool() prints state of non-idle worker pool. It shows +a delay since the last pool->watchdog_ts. + +The timestamp is updated when a first pending work is queued in +__queue_work(). Also it is updated when a work is dequeued for +processing in worker_thread() and rescuer_thread(). + +The delay is misleading when there is no pending work item. In this +case it shows how long the last work item is being proceed. Show +zero instead. There is no stall if there is no pending work. + +Fixes: 82607adcf9cdf40fb7b ("workqueue: implement lockup detector") +Signed-off-by: Petr Mladek +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index de6463b931762..2d27bed9881dd 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4857,10 +4857,16 @@ static void show_one_worker_pool(struct worker_pool *pool) + struct worker *worker; + bool first = true; + unsigned long flags; ++ unsigned long hung = 0; + + raw_spin_lock_irqsave(&pool->lock, flags); + if (pool->nr_workers == pool->nr_idle) + goto next_pool; ++ ++ /* How long the first pending work is waiting for a worker. */ ++ if (!list_empty(&pool->worklist)) ++ hung = jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000; ++ + /* + * Defer printing to avoid deadlocks in console drivers that + * queue work while holding locks also taken in their write +@@ -4869,9 +4875,7 @@ static void show_one_worker_pool(struct worker_pool *pool) + printk_deferred_enter(); + pr_info("pool %d:", pool->id); + pr_cont_pool_info(pool); +- pr_cont(" hung=%us workers=%d", +- jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000, +- pool->nr_workers); ++ pr_cont(" hung=%lus workers=%d", hung, pool->nr_workers); + if (pool->manager) + pr_cont(" manager: %d", + task_pid_nr(pool->manager->task)); +-- +2.39.2 + diff --git a/queue-5.15/workqueue-introduce-show_one_worker_pool-and-show_on.patch b/queue-5.15/workqueue-introduce-show_one_worker_pool-and-show_on.patch new file mode 100644 index 00000000000..59db1ba902d --- /dev/null +++ b/queue-5.15/workqueue-introduce-show_one_worker_pool-and-show_on.patch @@ -0,0 +1,300 @@ +From ea160135e7c21f601d41f71b4ed0aea391c2f829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 14:09:00 +1100 +Subject: workqueue: Introduce show_one_worker_pool and show_one_workqueue. + +From: Imran Khan + +[ Upstream commit 55df0933be74bd2e52aba0b67eb743ae0feabe7e ] + +Currently show_workqueue_state shows the state of all workqueues and of +all worker pools. In certain cases we may need to dump state of only a +specific workqueue or worker pool. For example in destroy_workqueue we +only need to show state of the workqueue which is getting destroyed. + +So rename show_workqueue_state to show_all_workqueues(to signify it +dumps state of all busy workqueues) and divide it into more granular +functions (show_one_workqueue and show_one_worker_pool), that would show +states of individual workqueues and worker pools and can be used in +cases such as the one mentioned above. + +Also, as mentioned earlier, make destroy_workqueue dump data pertaining +to only the workqueue that is being destroyed and make user(s) of +earlier interface(show_workqueue_state), use new interface +(show_all_workqueues). + +Signed-off-by: Imran Khan +Signed-off-by: Tejun Heo +Stable-dep-of: 335a42ebb0ca ("workqueue: Fix hung time report of worker pools") +Signed-off-by: Sasha Levin +--- + drivers/tty/sysrq.c | 2 +- + include/linux/workqueue.h | 3 +- + kernel/power/process.c | 2 +- + kernel/workqueue.c | 172 +++++++++++++++++++++----------------- + 4 files changed, 100 insertions(+), 79 deletions(-) + +diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c +index 6b445ece83395..4ffed77f80018 100644 +--- a/drivers/tty/sysrq.c ++++ b/drivers/tty/sysrq.c +@@ -301,7 +301,7 @@ static const struct sysrq_key_op sysrq_showregs_op = { + static void sysrq_handle_showstate(int key) + { + show_state(); +- show_workqueue_state(); ++ show_all_workqueues(); + } + static const struct sysrq_key_op sysrq_showstate_op = { + .handler = sysrq_handle_showstate, +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 74d3c1efd9bb5..7fee9b6cfedef 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -469,7 +469,8 @@ extern bool workqueue_congested(int cpu, struct workqueue_struct *wq); + extern unsigned int work_busy(struct work_struct *work); + extern __printf(1, 2) void set_worker_desc(const char *fmt, ...); + extern void print_worker_info(const char *log_lvl, struct task_struct *task); +-extern void show_workqueue_state(void); ++extern void show_all_workqueues(void); ++extern void show_one_workqueue(struct workqueue_struct *wq); + extern void wq_worker_comm(char *buf, size_t size, struct task_struct *task); + + /** +diff --git a/kernel/power/process.c b/kernel/power/process.c +index ee78a39463e63..11b570fcf0494 100644 +--- a/kernel/power/process.c ++++ b/kernel/power/process.c +@@ -94,7 +94,7 @@ static int try_to_freeze_tasks(bool user_only) + todo - wq_busy, wq_busy); + + if (wq_busy) +- show_workqueue_state(); ++ show_all_workqueues(); + + if (!wakeup || pm_debug_messages_on) { + read_lock(&tasklist_lock); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index f5fa7be8d17ea..de6463b931762 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -375,6 +375,7 @@ EXPORT_SYMBOL_GPL(system_freezable_power_efficient_wq); + static int worker_thread(void *__worker); + static void workqueue_sysfs_unregister(struct workqueue_struct *wq); + static void show_pwq(struct pool_workqueue *pwq); ++static void show_one_worker_pool(struct worker_pool *pool); + + #define CREATE_TRACE_POINTS + #include +@@ -4454,7 +4455,7 @@ void destroy_workqueue(struct workqueue_struct *wq) + raw_spin_unlock_irq(&pwq->pool->lock); + mutex_unlock(&wq->mutex); + mutex_unlock(&wq_pool_mutex); +- show_workqueue_state(); ++ show_one_workqueue(wq); + return; + } + raw_spin_unlock_irq(&pwq->pool->lock); +@@ -4804,97 +4805,116 @@ static void show_pwq(struct pool_workqueue *pwq) + } + + /** +- * show_workqueue_state - dump workqueue state +- * +- * Called from a sysrq handler or try_to_freeze_tasks() and prints out +- * all busy workqueues and pools. ++ * show_one_workqueue - dump state of specified workqueue ++ * @wq: workqueue whose state will be printed + */ +-void show_workqueue_state(void) ++void show_one_workqueue(struct workqueue_struct *wq) + { +- struct workqueue_struct *wq; +- struct worker_pool *pool; ++ struct pool_workqueue *pwq; ++ bool idle = true; + unsigned long flags; +- int pi; +- +- rcu_read_lock(); + +- pr_info("Showing busy workqueues and worker pools:\n"); +- +- list_for_each_entry_rcu(wq, &workqueues, list) { +- struct pool_workqueue *pwq; +- bool idle = true; +- +- for_each_pwq(pwq, wq) { +- if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { +- idle = false; +- break; +- } ++ for_each_pwq(pwq, wq) { ++ if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { ++ idle = false; ++ break; + } +- if (idle) +- continue; ++ } ++ if (idle) /* Nothing to print for idle workqueue */ ++ return; + +- pr_info("workqueue %s: flags=0x%x\n", wq->name, wq->flags); ++ pr_info("workqueue %s: flags=0x%x\n", wq->name, wq->flags); + +- for_each_pwq(pwq, wq) { +- raw_spin_lock_irqsave(&pwq->pool->lock, flags); +- if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { +- /* +- * Defer printing to avoid deadlocks in console +- * drivers that queue work while holding locks +- * also taken in their write paths. +- */ +- printk_deferred_enter(); +- show_pwq(pwq); +- printk_deferred_exit(); +- } +- raw_spin_unlock_irqrestore(&pwq->pool->lock, flags); ++ for_each_pwq(pwq, wq) { ++ raw_spin_lock_irqsave(&pwq->pool->lock, flags); ++ if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { + /* +- * We could be printing a lot from atomic context, e.g. +- * sysrq-t -> show_workqueue_state(). Avoid triggering +- * hard lockup. ++ * Defer printing to avoid deadlocks in console ++ * drivers that queue work while holding locks ++ * also taken in their write paths. + */ +- touch_nmi_watchdog(); +- } +- } +- +- for_each_pool(pool, pi) { +- struct worker *worker; +- bool first = true; +- +- raw_spin_lock_irqsave(&pool->lock, flags); +- if (pool->nr_workers == pool->nr_idle) +- goto next_pool; +- /* +- * Defer printing to avoid deadlocks in console drivers that +- * queue work while holding locks also taken in their write +- * paths. +- */ +- printk_deferred_enter(); +- pr_info("pool %d:", pool->id); +- pr_cont_pool_info(pool); +- pr_cont(" hung=%us workers=%d", +- jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000, +- pool->nr_workers); +- if (pool->manager) +- pr_cont(" manager: %d", +- task_pid_nr(pool->manager->task)); +- list_for_each_entry(worker, &pool->idle_list, entry) { +- pr_cont(" %s%d", first ? "idle: " : "", +- task_pid_nr(worker->task)); +- first = false; ++ printk_deferred_enter(); ++ show_pwq(pwq); ++ printk_deferred_exit(); + } +- pr_cont("\n"); +- printk_deferred_exit(); +- next_pool: +- raw_spin_unlock_irqrestore(&pool->lock, flags); ++ raw_spin_unlock_irqrestore(&pwq->pool->lock, flags); + /* + * We could be printing a lot from atomic context, e.g. +- * sysrq-t -> show_workqueue_state(). Avoid triggering ++ * sysrq-t -> show_all_workqueues(). Avoid triggering + * hard lockup. + */ + touch_nmi_watchdog(); + } + ++} ++ ++/** ++ * show_one_worker_pool - dump state of specified worker pool ++ * @pool: worker pool whose state will be printed ++ */ ++static void show_one_worker_pool(struct worker_pool *pool) ++{ ++ struct worker *worker; ++ bool first = true; ++ unsigned long flags; ++ ++ raw_spin_lock_irqsave(&pool->lock, flags); ++ if (pool->nr_workers == pool->nr_idle) ++ goto next_pool; ++ /* ++ * Defer printing to avoid deadlocks in console drivers that ++ * queue work while holding locks also taken in their write ++ * paths. ++ */ ++ printk_deferred_enter(); ++ pr_info("pool %d:", pool->id); ++ pr_cont_pool_info(pool); ++ pr_cont(" hung=%us workers=%d", ++ jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000, ++ pool->nr_workers); ++ if (pool->manager) ++ pr_cont(" manager: %d", ++ task_pid_nr(pool->manager->task)); ++ list_for_each_entry(worker, &pool->idle_list, entry) { ++ pr_cont(" %s%d", first ? "idle: " : "", ++ task_pid_nr(worker->task)); ++ first = false; ++ } ++ pr_cont("\n"); ++ printk_deferred_exit(); ++next_pool: ++ raw_spin_unlock_irqrestore(&pool->lock, flags); ++ /* ++ * We could be printing a lot from atomic context, e.g. ++ * sysrq-t -> show_all_workqueues(). Avoid triggering ++ * hard lockup. ++ */ ++ touch_nmi_watchdog(); ++ ++} ++ ++/** ++ * show_all_workqueues - dump workqueue state ++ * ++ * Called from a sysrq handler or try_to_freeze_tasks() and prints out ++ * all busy workqueues and pools. ++ */ ++void show_all_workqueues(void) ++{ ++ struct workqueue_struct *wq; ++ struct worker_pool *pool; ++ int pi; ++ ++ rcu_read_lock(); ++ ++ pr_info("Showing busy workqueues and worker pools:\n"); ++ ++ list_for_each_entry_rcu(wq, &workqueues, list) ++ show_one_workqueue(wq); ++ ++ for_each_pool(pool, pi) ++ show_one_worker_pool(pool); ++ + rcu_read_unlock(); + } + +@@ -5883,7 +5903,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + rcu_read_unlock(); + + if (lockup_detected) +- show_workqueue_state(); ++ show_all_workqueues(); + + wq_watchdog_reset_touched(); + mod_timer(&wq_watchdog_timer, jiffies + thresh); +-- +2.39.2 + diff --git a/queue-5.15/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch b/queue-5.15/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch new file mode 100644 index 00000000000..fd383e82055 --- /dev/null +++ b/queue-5.15/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch @@ -0,0 +1,49 @@ +From cd5b16d6e62ae10764a71546670a78eaa0060cfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 17:09:17 +0100 +Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset() + +From: Uros Bizjak + +[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ] + +The detection of atomic update failure in reserve_eilvt_offset() is +not correct. The value returned by atomic_cmpxchg() should be compared +to the old value from the location to be updated. + +If these two are the same, then atomic update succeeded and +"eilvt_offsets[offset]" location is updated to "new" in an atomic way. + +Otherwise, the atomic update failed and it should be retried with the +value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg() +does in a correct and more optimal way. + +Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index ed7d9cf71f68d..4df7d694369a5 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -412,10 +412,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new) + if (vector && !eilvt_entry_is_changeable(vector, new)) + /* may not change if vectors are different */ + return rsvd; +- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new); +- } while (rsvd != new); ++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new)); + +- rsvd &= ~APIC_EILVT_MASKED; ++ rsvd = new & ~APIC_EILVT_MASKED; + if (rsvd && rsvd != vector) + pr_info("LVT offset %d assigned for vector 0x%02x\n", + offset, rsvd); +-- +2.39.2 + diff --git a/queue-5.15/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch b/queue-5.15/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch new file mode 100644 index 00000000000..14dd783ced4 --- /dev/null +++ b/queue-5.15/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch @@ -0,0 +1,72 @@ +From 714eaec255213e5e8dbadae067602e98b2400bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 00:30:04 -0700 +Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() + +From: Saurabh Sengar + +[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ] + +arch_dynirq_lower_bound() is invoked by the core interrupt code to +retrieve the lowest possible Linux interrupt number for dynamically +allocated interrupts like MSI. + +The x86 implementation uses this to exclude the IO/APIC GSI space. +This works correctly as long as there is an IO/APIC registered, but +returns 0 if not. This has been observed in VMs where the BIOS does +not advertise an IO/APIC. + +0 is an invalid interrupt number except for the legacy timer interrupt +on x86. The return value is unchecked in the core code, so it ends up +to allocate interrupt number 0 which is subsequently considered to be +invalid by the caller, e.g. the MSI allocation code. + +The function has already a check for 0 in the case that an IO/APIC is +registered, as ioapic_dynirq_base is 0 in case of device tree setups. + +Consolidate this and zero check for both ioapic_dynirq_base and gsi_top, +which is used in the case that no IO/APIC is registered. + +Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines") +Signed-off-by: Saurabh Sengar +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/io_apic.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index c1bb384935b05..bb71b628edcb4 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2479,17 +2479,21 @@ static int io_apic_get_redir_entries(int ioapic) + + unsigned int arch_dynirq_lower_bound(unsigned int from) + { ++ unsigned int ret; ++ + /* + * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use + * gsi_top if ioapic_dynirq_base hasn't been initialized yet. + */ +- if (!ioapic_initialized) +- return gsi_top; ++ ret = ioapic_dynirq_base ? : gsi_top; ++ + /* +- * For DT enabled machines ioapic_dynirq_base is irrelevant and not +- * updated. So simply return @from if ioapic_dynirq_base == 0. ++ * For DT enabled machines ioapic_dynirq_base is irrelevant and ++ * always 0. gsi_top can be 0 if there is no IO/APIC registered. ++ * 0 is an invalid interrupt number for dynamic allocations. Return ++ * @from instead. + */ +- return ioapic_dynirq_base ? : from; ++ return ret ? : from; + } + + #ifdef CONFIG_X86_32 +-- +2.39.2 + diff --git a/queue-5.15/x86-mce-amd-use-an-u64-for-bank_map.patch b/queue-5.15/x86-mce-amd-use-an-u64-for-bank_map.patch new file mode 100644 index 00000000000..e3b58eb9967 --- /dev/null +++ b/queue-5.15/x86-mce-amd-use-an-u64-for-bank_map.patch @@ -0,0 +1,99 @@ +From decd896da0f38216da5badb61521b76b61255052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 15:16:01 +0000 +Subject: x86/MCE/AMD: Use an u64 for bank_map + +From: Muralidhara M K + +[ Upstream commit 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156 ] + +Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see + + a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64"). + +However, the bank_map which contains a bitfield of which banks to +initialize is of type unsigned int and that overflows when those bit +numbers are >= 32, leading to UBSAN complaining correctly: + + UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 + shift exponent 32 is too large for 32-bit type 'int' + +Change the bank_map to a u64 and use the proper BIT_ULL() macro when +modifying bits in there. + + [ bp: Rewrite commit message. ] + +Fixes: a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64") +Signed-off-by: Muralidhara M K +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230127151601.1068324-1-muralimk@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/amd.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c +index 6469d3135d268..d4e75be64a4c5 100644 +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -210,10 +210,10 @@ static DEFINE_PER_CPU(struct threshold_bank **, threshold_banks); + * A list of the banks enabled on each logical CPU. Controls which respective + * descriptors to initialize later in mce_threshold_create_device(). + */ +-static DEFINE_PER_CPU(unsigned int, bank_map); ++static DEFINE_PER_CPU(u64, bank_map); + + /* Map of banks that have more than MCA_MISC0 available. */ +-static DEFINE_PER_CPU(u32, smca_misc_banks_map); ++static DEFINE_PER_CPU(u64, smca_misc_banks_map); + + static void amd_threshold_interrupt(void); + static void amd_deferred_error_interrupt(void); +@@ -242,7 +242,7 @@ static void smca_set_misc_banks_map(unsigned int bank, unsigned int cpu) + return; + + if (low & MASK_BLKPTR_LO) +- per_cpu(smca_misc_banks_map, cpu) |= BIT(bank); ++ per_cpu(smca_misc_banks_map, cpu) |= BIT_ULL(bank); + + } + +@@ -505,7 +505,7 @@ static u32 smca_get_block_address(unsigned int bank, unsigned int block, + if (!block) + return MSR_AMD64_SMCA_MCx_MISC(bank); + +- if (!(per_cpu(smca_misc_banks_map, cpu) & BIT(bank))) ++ if (!(per_cpu(smca_misc_banks_map, cpu) & BIT_ULL(bank))) + return 0; + + return MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1); +@@ -549,7 +549,7 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr, + int new; + + if (!block) +- per_cpu(bank_map, cpu) |= (1 << bank); ++ per_cpu(bank_map, cpu) |= BIT_ULL(bank); + + memset(&b, 0, sizeof(b)); + b.cpu = cpu; +@@ -1061,7 +1061,7 @@ static void amd_threshold_interrupt(void) + return; + + for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank) { +- if (!(per_cpu(bank_map, cpu) & (1 << bank))) ++ if (!(per_cpu(bank_map, cpu) & BIT_ULL(bank))) + continue; + + first_block = bp[bank]->blocks; +@@ -1538,7 +1538,7 @@ int mce_threshold_create_device(unsigned int cpu) + return -ENOMEM; + + for (bank = 0; bank < numbanks; ++bank) { +- if (!(this_cpu_read(bank_map) & (1 << bank))) ++ if (!(this_cpu_read(bank_map) & BIT_ULL(bank))) + continue; + err = threshold_create_bank(bp, cpu, bank); + if (err) { +-- +2.39.2 + diff --git a/queue-5.15/xsk-fix-unaligned-descriptor-validation.patch b/queue-5.15/xsk-fix-unaligned-descriptor-validation.patch new file mode 100644 index 00000000000..1153848ecda --- /dev/null +++ b/queue-5.15/xsk-fix-unaligned-descriptor-validation.patch @@ -0,0 +1,65 @@ +From 733bf6c5652155d6c93d0503f6da482d87b8362f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 01:59:18 +0200 +Subject: xsk: Fix unaligned descriptor validation + +From: Kal Conley + +[ Upstream commit d769ccaf957fe7391f357c0a923de71f594b8a2b ] + +Make sure unaligned descriptors that straddle the end of the UMEM are +considered invalid. Currently, descriptor validation is broken for +zero-copy mode which only checks descriptors at page granularity. +For example, descriptors in zero-copy mode that overrun the end of the +UMEM but not a page boundary are (incorrectly) considered valid. The +UMEM boundary check needs to happen before the page boundary and +contiguity checks in xp_desc_crosses_non_contig_pg(). Do this check in +xp_unaligned_validate_desc() instead like xp_check_unaligned() already +does. + +Fixes: 2b43470add8c ("xsk: Introduce AF_XDP buffer allocation API") +Signed-off-by: Kal Conley +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/r/20230405235920.7305-2-kal.conley@dectris.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + include/net/xsk_buff_pool.h | 9 ++------- + net/xdp/xsk_queue.h | 1 + + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h +index 7517f4faf6b32..ebd1f43578d65 100644 +--- a/include/net/xsk_buff_pool.h ++++ b/include/net/xsk_buff_pool.h +@@ -152,13 +152,8 @@ static inline bool xp_desc_crosses_non_contig_pg(struct xsk_buff_pool *pool, + if (likely(!cross_pg)) + return false; + +- if (pool->dma_pages_cnt) { +- return !(pool->dma_pages[addr >> PAGE_SHIFT] & +- XSK_NEXT_PG_CONTIG_MASK); +- } +- +- /* skb path */ +- return addr + len > pool->addrs_cnt; ++ return pool->dma_pages_cnt && ++ !(pool->dma_pages[addr >> PAGE_SHIFT] & XSK_NEXT_PG_CONTIG_MASK); + } + + static inline u64 xp_aligned_extract_addr(struct xsk_buff_pool *pool, u64 addr) +diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h +index cca1fce8035cb..6b4df83aa28f6 100644 +--- a/net/xdp/xsk_queue.h ++++ b/net/xdp/xsk_queue.h +@@ -157,6 +157,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool, + return false; + + if (base_addr >= pool->addrs_cnt || addr >= pool->addrs_cnt || ++ addr + desc->len > pool->addrs_cnt || + xp_desc_crosses_non_contig_pg(pool, addr, desc->len)) + return false; + +-- +2.39.2 +