From: Sasha Levin Date: Sun, 9 Jul 2023 04:58:23 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.4.3~22^2~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=da4a63a43b70b6f0bc4ef0c6d4b64bfe5b6546e7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/acpi-make-remove-callback-of-acpi-driver-void.patch b/queue-6.1/acpi-make-remove-callback-of-acpi-driver-void.patch new file mode 100644 index 00000000000..dfd951c0bfd --- /dev/null +++ b/queue-6.1/acpi-make-remove-callback-of-acpi-driver-void.patch @@ -0,0 +1,1299 @@ +From 2fd9911fe2b28f9ad1c5601c99324885063cee03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 00:26:09 +0800 +Subject: ACPI: make remove callback of ACPI driver void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dawei Li + +[ Upstream commit 6c0eb5ba3500f6da367351ff3c4452c029cb72fa ] + +For bus-based driver, device removal is implemented as: +1 device_remove()-> +2 bus->remove()-> +3 driver->remove() + +Driver core needs no inform from callee(bus driver) about the +result of remove callback. In that case, commit fc7a6209d571 +("bus: Make remove callback return void") forces bus_type::remove +be void-returned. + +Now we have the situation that both 1 & 2 of calling chain are +void-returned, so it does not make much sense for 3(driver->remove) +to return non-void to its caller. + +So the basic idea behind this change is making remove() callback of +any bus-based driver to be void-returned. + +This change, for itself, is for device drivers based on acpi-bus. + +Acked-by: Uwe Kleine-König +Acked-by: Lee Jones +Acked-by: Dmitry Torokhov +Reviewed-by: Hans de Goede +Signed-off-by: Dawei Li +Reviewed-by: Maximilian Luz # for drivers/platform/surface/* +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 966cca72ab20 ("platform/x86/dell/dell-rbtn: Fix resources leaking on error path") +Signed-off-by: Sasha Levin +--- + arch/ia64/hp/common/aml_nfw.c | 4 ++-- + arch/x86/platform/olpc/olpc-xo15-sci.c | 3 +-- + drivers/acpi/ac.c | 8 +++----- + drivers/acpi/acpi_pad.c | 3 +-- + drivers/acpi/acpi_video.c | 8 +++----- + drivers/acpi/battery.c | 5 ++--- + drivers/acpi/button.c | 5 ++--- + drivers/acpi/ec.c | 5 ++--- + drivers/acpi/hed.c | 3 +-- + drivers/acpi/nfit/core.c | 3 +-- + drivers/acpi/sbs.c | 9 ++++----- + drivers/acpi/sbshc.c | 7 +++---- + drivers/acpi/thermal.c | 7 +++---- + drivers/acpi/tiny-power-button.c | 10 +++++++--- + drivers/char/sonypi.c | 3 +-- + drivers/char/tpm/tpm_crb.c | 4 +--- + drivers/hv/vmbus_drv.c | 4 +--- + drivers/hwmon/acpi_power_meter.c | 5 ++--- + drivers/hwmon/asus_atk0110.c | 6 ++---- + drivers/input/misc/atlas_btns.c | 4 +--- + drivers/net/fjes/fjes_main.c | 4 +--- + .../platform/chrome/chromeos_privacy_screen.c | 3 +-- + drivers/platform/chrome/wilco_ec/event.c | 4 +--- + drivers/platform/surface/surfacepro3_button.c | 3 +-- + drivers/platform/x86/asus-laptop.c | 3 +-- + drivers/platform/x86/asus-wireless.c | 3 +-- + drivers/platform/x86/classmate-laptop.c | 20 +++++++++---------- + drivers/platform/x86/dell/dell-rbtn.c | 6 ++---- + drivers/platform/x86/eeepc-laptop.c | 3 +-- + drivers/platform/x86/fujitsu-laptop.c | 4 +--- + drivers/platform/x86/fujitsu-tablet.c | 3 +-- + drivers/platform/x86/intel/rst.c | 4 +--- + drivers/platform/x86/lg-laptop.c | 4 +--- + drivers/platform/x86/panasonic-laptop.c | 8 +++----- + drivers/platform/x86/sony-laptop.c | 9 +++------ + drivers/platform/x86/system76_acpi.c | 4 +--- + drivers/platform/x86/topstar-laptop.c | 3 +-- + drivers/platform/x86/toshiba_acpi.c | 4 +--- + drivers/platform/x86/toshiba_bluetooth.c | 6 +++--- + drivers/platform/x86/toshiba_haps.c | 4 +--- + drivers/platform/x86/wireless-hotkey.c | 3 +-- + drivers/platform/x86/xo15-ebook.c | 3 +-- + drivers/ptp/ptp_vmw.c | 3 +-- + drivers/thermal/intel/intel_menlow.c | 8 +++----- + drivers/video/backlight/apple_bl.c | 3 +-- + drivers/watchdog/ni903x_wdt.c | 4 +--- + drivers/xen/xen-acpi-pad.c | 3 +-- + include/acpi/acpi_bus.h | 2 +- + 48 files changed, 88 insertions(+), 149 deletions(-) + +diff --git a/arch/ia64/hp/common/aml_nfw.c b/arch/ia64/hp/common/aml_nfw.c +index 684667ade5259..901df49461a05 100644 +--- a/arch/ia64/hp/common/aml_nfw.c ++++ b/arch/ia64/hp/common/aml_nfw.c +@@ -187,9 +187,9 @@ static int aml_nfw_add(struct acpi_device *device) + return aml_nfw_add_global_handler(); + } + +-static int aml_nfw_remove(struct acpi_device *device) ++static void aml_nfw_remove(struct acpi_device *device) + { +- return aml_nfw_remove_global_handler(); ++ aml_nfw_remove_global_handler(); + } + + static const struct acpi_device_id aml_nfw_ids[] = { +diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c +index 994a229cb79fe..68244a3422d1d 100644 +--- a/arch/x86/platform/olpc/olpc-xo15-sci.c ++++ b/arch/x86/platform/olpc/olpc-xo15-sci.c +@@ -183,13 +183,12 @@ static int xo15_sci_add(struct acpi_device *device) + return r; + } + +-static int xo15_sci_remove(struct acpi_device *device) ++static void xo15_sci_remove(struct acpi_device *device) + { + acpi_disable_gpe(NULL, xo15_sci_gpe); + acpi_remove_gpe_handler(NULL, xo15_sci_gpe, xo15_sci_gpe_handler); + cancel_work_sync(&sci_work); + sysfs_remove_file(&device->dev.kobj, &lid_wake_on_close_attr.attr); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c +index bb9fe7984b1a0..1ace70b831cdf 100644 +--- a/drivers/acpi/ac.c ++++ b/drivers/acpi/ac.c +@@ -33,7 +33,7 @@ MODULE_DESCRIPTION("ACPI AC Adapter Driver"); + MODULE_LICENSE("GPL"); + + static int acpi_ac_add(struct acpi_device *device); +-static int acpi_ac_remove(struct acpi_device *device); ++static void acpi_ac_remove(struct acpi_device *device); + static void acpi_ac_notify(struct acpi_device *device, u32 event); + + static const struct acpi_device_id ac_device_ids[] = { +@@ -288,12 +288,12 @@ static int acpi_ac_resume(struct device *dev) + #define acpi_ac_resume NULL + #endif + +-static int acpi_ac_remove(struct acpi_device *device) ++static void acpi_ac_remove(struct acpi_device *device) + { + struct acpi_ac *ac = NULL; + + if (!device || !acpi_driver_data(device)) +- return -EINVAL; ++ return; + + ac = acpi_driver_data(device); + +@@ -301,8 +301,6 @@ static int acpi_ac_remove(struct acpi_device *device) + unregister_acpi_notifier(&ac->battery_nb); + + kfree(ac); +- +- return 0; + } + + static int __init acpi_ac_init(void) +diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c +index ec0e22a1e25d6..edbb28faee2a6 100644 +--- a/drivers/acpi/acpi_pad.c ++++ b/drivers/acpi/acpi_pad.c +@@ -449,7 +449,7 @@ static int acpi_pad_add(struct acpi_device *device) + return 0; + } + +-static int acpi_pad_remove(struct acpi_device *device) ++static void acpi_pad_remove(struct acpi_device *device) + { + mutex_lock(&isolated_cpus_lock); + acpi_pad_idle_cpus(0); +@@ -458,7 +458,6 @@ static int acpi_pad_remove(struct acpi_device *device) + acpi_remove_notify_handler(device->handle, + ACPI_DEVICE_NOTIFY, acpi_pad_notify); + acpi_pad_remove_sysfs(device); +- return 0; + } + + static const struct acpi_device_id pad_device_ids[] = { +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index ed318485eb192..c7a6d0b69dabd 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -82,7 +82,7 @@ static DEFINE_MUTEX(register_count_mutex); + static DEFINE_MUTEX(video_list_lock); + static LIST_HEAD(video_bus_head); + static int acpi_video_bus_add(struct acpi_device *device); +-static int acpi_video_bus_remove(struct acpi_device *device); ++static void acpi_video_bus_remove(struct acpi_device *device); + static void acpi_video_bus_notify(struct acpi_device *device, u32 event); + static void acpi_video_bus_register_backlight_work(struct work_struct *ignored); + static DECLARE_DELAYED_WORK(video_bus_register_backlight_work, +@@ -2074,13 +2074,13 @@ static int acpi_video_bus_add(struct acpi_device *device) + return error; + } + +-static int acpi_video_bus_remove(struct acpi_device *device) ++static void acpi_video_bus_remove(struct acpi_device *device) + { + struct acpi_video_bus *video = NULL; + + + if (!device || !acpi_driver_data(device)) +- return -EINVAL; ++ return; + + video = acpi_driver_data(device); + +@@ -2094,8 +2094,6 @@ static int acpi_video_bus_remove(struct acpi_device *device) + + kfree(video->attached_array); + kfree(video); +- +- return 0; + } + + static void acpi_video_bus_register_backlight_work(struct work_struct *ignored) +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 084f156bdfbc4..c705613fa503e 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -1208,12 +1208,12 @@ static int acpi_battery_add(struct acpi_device *device) + return result; + } + +-static int acpi_battery_remove(struct acpi_device *device) ++static void acpi_battery_remove(struct acpi_device *device) + { + struct acpi_battery *battery = NULL; + + if (!device || !acpi_driver_data(device)) +- return -EINVAL; ++ return; + device_init_wakeup(&device->dev, 0); + battery = acpi_driver_data(device); + unregister_pm_notifier(&battery->pm_nb); +@@ -1221,7 +1221,6 @@ static int acpi_battery_remove(struct acpi_device *device) + mutex_destroy(&battery->lock); + mutex_destroy(&battery->sysfs_lock); + kfree(battery); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c +index 1f9b9a4c38c7d..475e1eddfa3b4 100644 +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -125,7 +125,7 @@ static const struct dmi_system_id dmi_lid_quirks[] = { + }; + + static int acpi_button_add(struct acpi_device *device); +-static int acpi_button_remove(struct acpi_device *device); ++static void acpi_button_remove(struct acpi_device *device); + static void acpi_button_notify(struct acpi_device *device, u32 event); + + #ifdef CONFIG_PM_SLEEP +@@ -580,14 +580,13 @@ static int acpi_button_add(struct acpi_device *device) + return error; + } + +-static int acpi_button_remove(struct acpi_device *device) ++static void acpi_button_remove(struct acpi_device *device) + { + struct acpi_button *button = acpi_driver_data(device); + + acpi_button_remove_fs(device); + input_unregister_device(button->input); + kfree(button); +- return 0; + } + + static int param_set_lid_init_state(const char *val, +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index ee4c812c8f6cc..612a308f3ff0e 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1664,12 +1664,12 @@ static int acpi_ec_add(struct acpi_device *device) + return ret; + } + +-static int acpi_ec_remove(struct acpi_device *device) ++static void acpi_ec_remove(struct acpi_device *device) + { + struct acpi_ec *ec; + + if (!device) +- return -EINVAL; ++ return; + + ec = acpi_driver_data(device); + release_region(ec->data_addr, 1); +@@ -1679,7 +1679,6 @@ static int acpi_ec_remove(struct acpi_device *device) + ec_remove_handlers(ec); + acpi_ec_free(ec); + } +- return 0; + } + + static acpi_status +diff --git a/drivers/acpi/hed.c b/drivers/acpi/hed.c +index 60a2939cde6c5..78d44e3fe1295 100644 +--- a/drivers/acpi/hed.c ++++ b/drivers/acpi/hed.c +@@ -56,10 +56,9 @@ static int acpi_hed_add(struct acpi_device *device) + return 0; + } + +-static int acpi_hed_remove(struct acpi_device *device) ++static void acpi_hed_remove(struct acpi_device *device) + { + hed_handle = NULL; +- return 0; + } + + static struct acpi_driver acpi_hed_driver = { +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 6d4ac934cd499..4e48d6db05eb1 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3371,10 +3371,9 @@ static int acpi_nfit_add(struct acpi_device *adev) + return devm_add_action_or_reset(dev, acpi_nfit_shutdown, acpi_desc); + } + +-static int acpi_nfit_remove(struct acpi_device *adev) ++static void acpi_nfit_remove(struct acpi_device *adev) + { + /* see acpi_nfit_unregister */ +- return 0; + } + + static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle) +diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c +index e6a01a8df1b81..e90752d4f488e 100644 +--- a/drivers/acpi/sbs.c ++++ b/drivers/acpi/sbs.c +@@ -96,7 +96,7 @@ struct acpi_sbs { + + #define to_acpi_sbs(x) power_supply_get_drvdata(x) + +-static int acpi_sbs_remove(struct acpi_device *device); ++static void acpi_sbs_remove(struct acpi_device *device); + static int acpi_battery_get_state(struct acpi_battery *battery); + + static inline int battery_scale(int log) +@@ -664,16 +664,16 @@ static int acpi_sbs_add(struct acpi_device *device) + return result; + } + +-static int acpi_sbs_remove(struct acpi_device *device) ++static void acpi_sbs_remove(struct acpi_device *device) + { + struct acpi_sbs *sbs; + int id; + + if (!device) +- return -EINVAL; ++ return; + sbs = acpi_driver_data(device); + if (!sbs) +- return -EINVAL; ++ return; + mutex_lock(&sbs->lock); + acpi_smbus_unregister_callback(sbs->hc); + for (id = 0; id < MAX_SBS_BAT; ++id) +@@ -682,7 +682,6 @@ static int acpi_sbs_remove(struct acpi_device *device) + mutex_unlock(&sbs->lock); + mutex_destroy(&sbs->lock); + kfree(sbs); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c +index 340e0b61587e0..16f2daaa2c454 100644 +--- a/drivers/acpi/sbshc.c ++++ b/drivers/acpi/sbshc.c +@@ -30,7 +30,7 @@ struct acpi_smb_hc { + }; + + static int acpi_smbus_hc_add(struct acpi_device *device); +-static int acpi_smbus_hc_remove(struct acpi_device *device); ++static void acpi_smbus_hc_remove(struct acpi_device *device); + + static const struct acpi_device_id sbs_device_ids[] = { + {"ACPI0001", 0}, +@@ -280,19 +280,18 @@ static int acpi_smbus_hc_add(struct acpi_device *device) + + extern void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit); + +-static int acpi_smbus_hc_remove(struct acpi_device *device) ++static void acpi_smbus_hc_remove(struct acpi_device *device) + { + struct acpi_smb_hc *hc; + + if (!device) +- return -EINVAL; ++ return; + + hc = acpi_driver_data(device); + acpi_ec_remove_query_handler(hc->ec, hc->query_bit); + acpi_os_wait_events_complete(); + kfree(hc); + device->driver_data = NULL; +- return 0; + } + + module_acpi_driver(acpi_smb_hc_driver); +diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c +index 40b07057983e0..0c4bdef4d09ca 100644 +--- a/drivers/acpi/thermal.c ++++ b/drivers/acpi/thermal.c +@@ -74,7 +74,7 @@ MODULE_PARM_DESC(psv, "Disable or override all passive trip points."); + static struct workqueue_struct *acpi_thermal_pm_queue; + + static int acpi_thermal_add(struct acpi_device *device); +-static int acpi_thermal_remove(struct acpi_device *device); ++static void acpi_thermal_remove(struct acpi_device *device); + static void acpi_thermal_notify(struct acpi_device *device, u32 event); + + static const struct acpi_device_id thermal_device_ids[] = { +@@ -1059,19 +1059,18 @@ static int acpi_thermal_add(struct acpi_device *device) + return result; + } + +-static int acpi_thermal_remove(struct acpi_device *device) ++static void acpi_thermal_remove(struct acpi_device *device) + { + struct acpi_thermal *tz; + + if (!device || !acpi_driver_data(device)) +- return -EINVAL; ++ return; + + flush_workqueue(acpi_thermal_pm_queue); + tz = acpi_driver_data(device); + + acpi_thermal_unregister_thermal_zone(tz); + kfree(tz); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/acpi/tiny-power-button.c b/drivers/acpi/tiny-power-button.c +index a19f0e4e69f76..598f548b21f36 100644 +--- a/drivers/acpi/tiny-power-button.c ++++ b/drivers/acpi/tiny-power-button.c +@@ -19,11 +19,15 @@ static const struct acpi_device_id tiny_power_button_device_ids[] = { + }; + MODULE_DEVICE_TABLE(acpi, tiny_power_button_device_ids); + +-static int acpi_noop_add_remove(struct acpi_device *device) ++static int acpi_noop_add(struct acpi_device *device) + { + return 0; + } + ++static void acpi_noop_remove(struct acpi_device *device) ++{ ++} ++ + static void acpi_tiny_power_button_notify(struct acpi_device *device, u32 event) + { + kill_cad_pid(power_signal, 1); +@@ -34,8 +38,8 @@ static struct acpi_driver acpi_tiny_power_button_driver = { + .class = "tiny-power-button", + .ids = tiny_power_button_device_ids, + .ops = { +- .add = acpi_noop_add_remove, +- .remove = acpi_noop_add_remove, ++ .add = acpi_noop_add, ++ .remove = acpi_noop_remove, + .notify = acpi_tiny_power_button_notify, + }, + }; +diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c +index 27e301a6bb7a3..9211531689b28 100644 +--- a/drivers/char/sonypi.c ++++ b/drivers/char/sonypi.c +@@ -1123,10 +1123,9 @@ static int sonypi_acpi_add(struct acpi_device *device) + return 0; + } + +-static int sonypi_acpi_remove(struct acpi_device *device) ++static void sonypi_acpi_remove(struct acpi_device *device) + { + sonypi_acpi_device = NULL; +- return 0; + } + + static const struct acpi_device_id sonypi_device_ids[] = { +diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c +index 916f4ff246c14..d43a0d7b97a89 100644 +--- a/drivers/char/tpm/tpm_crb.c ++++ b/drivers/char/tpm/tpm_crb.c +@@ -804,14 +804,12 @@ static int crb_acpi_add(struct acpi_device *device) + return rc; + } + +-static int crb_acpi_remove(struct acpi_device *device) ++static void crb_acpi_remove(struct acpi_device *device) + { + struct device *dev = &device->dev; + struct tpm_chip *chip = dev_get_drvdata(dev); + + tpm_chip_unregister(chip); +- +- return 0; + } + + static const struct dev_pm_ops crb_pm = { +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index b03cb7ae7fd38..89944a87989ff 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2239,7 +2239,7 @@ static acpi_status vmbus_walk_resources(struct acpi_resource *res, void *ctx) + return AE_OK; + } + +-static int vmbus_acpi_remove(struct acpi_device *device) ++static void vmbus_acpi_remove(struct acpi_device *device) + { + struct resource *cur_res; + struct resource *next_res; +@@ -2256,8 +2256,6 @@ static int vmbus_acpi_remove(struct acpi_device *device) + kfree(cur_res); + } + } +- +- return 0; + } + + static void vmbus_reserve_fb(void) +diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c +index 0962c12eba5a0..fa28d447f0dfb 100644 +--- a/drivers/hwmon/acpi_power_meter.c ++++ b/drivers/hwmon/acpi_power_meter.c +@@ -910,12 +910,12 @@ static int acpi_power_meter_add(struct acpi_device *device) + return res; + } + +-static int acpi_power_meter_remove(struct acpi_device *device) ++static void acpi_power_meter_remove(struct acpi_device *device) + { + struct acpi_power_meter_resource *resource; + + if (!device || !acpi_driver_data(device)) +- return -EINVAL; ++ return; + + resource = acpi_driver_data(device); + hwmon_device_unregister(resource->hwmon_dev); +@@ -924,7 +924,6 @@ static int acpi_power_meter_remove(struct acpi_device *device) + free_capabilities(resource); + + kfree(resource); +- return 0; + } + + static int acpi_power_meter_resume(struct device *dev) +diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c +index ff64a39d56def..d778a2aaefec1 100644 +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -187,7 +187,7 @@ struct atk_acpi_input_buf { + }; + + static int atk_add(struct acpi_device *device); +-static int atk_remove(struct acpi_device *device); ++static void atk_remove(struct acpi_device *device); + static void atk_print_sensor(struct atk_data *data, union acpi_object *obj); + static int atk_read_value(struct atk_sensor_data *sensor, u64 *value); + +@@ -1344,7 +1344,7 @@ static int atk_add(struct acpi_device *device) + return err; + } + +-static int atk_remove(struct acpi_device *device) ++static void atk_remove(struct acpi_device *device) + { + struct atk_data *data = device->driver_data; + dev_dbg(&device->dev, "removing...\n"); +@@ -1359,8 +1359,6 @@ static int atk_remove(struct acpi_device *device) + if (atk_ec_ctl(data, 0)) + dev_err(&device->dev, "Failed to disable EC\n"); + } +- +- return 0; + } + + static int __init atk0110_init(void) +diff --git a/drivers/input/misc/atlas_btns.c b/drivers/input/misc/atlas_btns.c +index 0e77c40e1966b..3c9bbd04e1434 100644 +--- a/drivers/input/misc/atlas_btns.c ++++ b/drivers/input/misc/atlas_btns.c +@@ -106,7 +106,7 @@ static int atlas_acpi_button_add(struct acpi_device *device) + return err; + } + +-static int atlas_acpi_button_remove(struct acpi_device *device) ++static void atlas_acpi_button_remove(struct acpi_device *device) + { + acpi_status status; + +@@ -116,8 +116,6 @@ static int atlas_acpi_button_remove(struct acpi_device *device) + pr_err("error removing addr spc handler\n"); + + input_unregister_device(input_dev); +- +- return 0; + } + + static const struct acpi_device_id atlas_device_ids[] = { +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 1eff202f6a1fa..2513be6d4e11d 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -145,14 +145,12 @@ static int fjes_acpi_add(struct acpi_device *device) + return 0; + } + +-static int fjes_acpi_remove(struct acpi_device *device) ++static void fjes_acpi_remove(struct acpi_device *device) + { + struct platform_device *plat_dev; + + plat_dev = (struct platform_device *)acpi_driver_data(device); + platform_device_unregister(plat_dev); +- +- return 0; + } + + static struct acpi_driver fjes_acpi_driver = { +diff --git a/drivers/platform/chrome/chromeos_privacy_screen.c b/drivers/platform/chrome/chromeos_privacy_screen.c +index 77e9f5ee8e334..bb74ddf9af4ac 100644 +--- a/drivers/platform/chrome/chromeos_privacy_screen.c ++++ b/drivers/platform/chrome/chromeos_privacy_screen.c +@@ -123,12 +123,11 @@ static int chromeos_privacy_screen_add(struct acpi_device *adev) + return 0; + } + +-static int chromeos_privacy_screen_remove(struct acpi_device *adev) ++static void chromeos_privacy_screen_remove(struct acpi_device *adev) + { + struct drm_privacy_screen *drm_privacy_screen = acpi_driver_data(adev); + + drm_privacy_screen_unregister(drm_privacy_screen); +- return 0; + } + + static const struct acpi_device_id chromeos_privacy_screen_device_ids[] = { +diff --git a/drivers/platform/chrome/wilco_ec/event.c b/drivers/platform/chrome/wilco_ec/event.c +index 32e400590be5a..69ceead8cdaa1 100644 +--- a/drivers/platform/chrome/wilco_ec/event.c ++++ b/drivers/platform/chrome/wilco_ec/event.c +@@ -500,15 +500,13 @@ static int event_device_add(struct acpi_device *adev) + return error; + } + +-static int event_device_remove(struct acpi_device *adev) ++static void event_device_remove(struct acpi_device *adev) + { + struct event_device_data *dev_data = adev->driver_data; + + cdev_device_del(&dev_data->cdev, &dev_data->dev); + ida_simple_remove(&event_ida, MINOR(dev_data->dev.devt)); + hangup_device(dev_data); +- +- return 0; + } + + static const struct acpi_device_id event_acpi_ids[] = { +diff --git a/drivers/platform/surface/surfacepro3_button.c b/drivers/platform/surface/surfacepro3_button.c +index 242fb690dcaf7..2755601f979cd 100644 +--- a/drivers/platform/surface/surfacepro3_button.c ++++ b/drivers/platform/surface/surfacepro3_button.c +@@ -239,13 +239,12 @@ static int surface_button_add(struct acpi_device *device) + return error; + } + +-static int surface_button_remove(struct acpi_device *device) ++static void surface_button_remove(struct acpi_device *device) + { + struct surface_button *button = acpi_driver_data(device); + + input_unregister_device(button->input); + kfree(button); +- return 0; + } + + static SIMPLE_DEV_PM_OPS(surface_button_pm, +diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c +index 47b2f8bb6fb53..761029f39314a 100644 +--- a/drivers/platform/x86/asus-laptop.c ++++ b/drivers/platform/x86/asus-laptop.c +@@ -1901,7 +1901,7 @@ static int asus_acpi_add(struct acpi_device *device) + return result; + } + +-static int asus_acpi_remove(struct acpi_device *device) ++static void asus_acpi_remove(struct acpi_device *device) + { + struct asus_laptop *asus = acpi_driver_data(device); + +@@ -1914,7 +1914,6 @@ static int asus_acpi_remove(struct acpi_device *device) + + kfree(asus->name); + kfree(asus); +- return 0; + } + + static const struct acpi_device_id asus_device_ids[] = { +diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c +index d3e7171928e5d..abf01e00b799f 100644 +--- a/drivers/platform/x86/asus-wireless.c ++++ b/drivers/platform/x86/asus-wireless.c +@@ -175,7 +175,7 @@ static int asus_wireless_add(struct acpi_device *adev) + return err; + } + +-static int asus_wireless_remove(struct acpi_device *adev) ++static void asus_wireless_remove(struct acpi_device *adev) + { + struct asus_wireless_data *data = acpi_driver_data(adev); + +@@ -183,7 +183,6 @@ static int asus_wireless_remove(struct acpi_device *adev) + devm_led_classdev_unregister(&adev->dev, &data->led); + destroy_workqueue(data->wq); + } +- return 0; + } + + static struct acpi_driver asus_wireless_driver = { +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index 9309ab5792cbc..8b6a146118599 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -418,11 +418,11 @@ static int cmpc_accel_add_v4(struct acpi_device *acpi) + return error; + } + +-static int cmpc_accel_remove_v4(struct acpi_device *acpi) ++static void cmpc_accel_remove_v4(struct acpi_device *acpi) + { + device_remove_file(&acpi->dev, &cmpc_accel_sensitivity_attr_v4); + device_remove_file(&acpi->dev, &cmpc_accel_g_select_attr_v4); +- return cmpc_remove_acpi_notify_device(acpi); ++ cmpc_remove_acpi_notify_device(acpi); + } + + static SIMPLE_DEV_PM_OPS(cmpc_accel_pm, cmpc_accel_suspend_v4, +@@ -648,10 +648,10 @@ static int cmpc_accel_add(struct acpi_device *acpi) + return error; + } + +-static int cmpc_accel_remove(struct acpi_device *acpi) ++static void cmpc_accel_remove(struct acpi_device *acpi) + { + device_remove_file(&acpi->dev, &cmpc_accel_sensitivity_attr); +- return cmpc_remove_acpi_notify_device(acpi); ++ cmpc_remove_acpi_notify_device(acpi); + } + + static const struct acpi_device_id cmpc_accel_device_ids[] = { +@@ -727,9 +727,9 @@ static int cmpc_tablet_add(struct acpi_device *acpi) + cmpc_tablet_idev_init); + } + +-static int cmpc_tablet_remove(struct acpi_device *acpi) ++static void cmpc_tablet_remove(struct acpi_device *acpi) + { +- return cmpc_remove_acpi_notify_device(acpi); ++ cmpc_remove_acpi_notify_device(acpi); + } + + #ifdef CONFIG_PM_SLEEP +@@ -974,7 +974,7 @@ static int cmpc_ipml_add(struct acpi_device *acpi) + return retval; + } + +-static int cmpc_ipml_remove(struct acpi_device *acpi) ++static void cmpc_ipml_remove(struct acpi_device *acpi) + { + struct ipml200_dev *ipml; + +@@ -988,8 +988,6 @@ static int cmpc_ipml_remove(struct acpi_device *acpi) + } + + kfree(ipml); +- +- return 0; + } + + static const struct acpi_device_id cmpc_ipml_device_ids[] = { +@@ -1055,9 +1053,9 @@ static int cmpc_keys_add(struct acpi_device *acpi) + cmpc_keys_idev_init); + } + +-static int cmpc_keys_remove(struct acpi_device *acpi) ++static void cmpc_keys_remove(struct acpi_device *acpi) + { +- return cmpc_remove_acpi_notify_device(acpi); ++ cmpc_remove_acpi_notify_device(acpi); + } + + static const struct acpi_device_id cmpc_keys_device_ids[] = { +diff --git a/drivers/platform/x86/dell/dell-rbtn.c b/drivers/platform/x86/dell/dell-rbtn.c +index a89fad47ff139..aa0e6c9074942 100644 +--- a/drivers/platform/x86/dell/dell-rbtn.c ++++ b/drivers/platform/x86/dell/dell-rbtn.c +@@ -206,7 +206,7 @@ static void rbtn_input_event(struct rbtn_data *rbtn_data) + */ + + static int rbtn_add(struct acpi_device *device); +-static int rbtn_remove(struct acpi_device *device); ++static void rbtn_remove(struct acpi_device *device); + static void rbtn_notify(struct acpi_device *device, u32 event); + + static const struct acpi_device_id rbtn_ids[] = { +@@ -426,7 +426,7 @@ static int rbtn_add(struct acpi_device *device) + + } + +-static int rbtn_remove(struct acpi_device *device) ++static void rbtn_remove(struct acpi_device *device) + { + struct rbtn_data *rbtn_data = device->driver_data; + +@@ -443,8 +443,6 @@ static int rbtn_remove(struct acpi_device *device) + + rbtn_acquire(device, false); + device->driver_data = NULL; +- +- return 0; + } + + static void rbtn_notify(struct acpi_device *device, u32 event) +diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c +index a388a28b6f2a2..62b71e8e3567a 100644 +--- a/drivers/platform/x86/eeepc-laptop.c ++++ b/drivers/platform/x86/eeepc-laptop.c +@@ -1440,7 +1440,7 @@ static int eeepc_acpi_add(struct acpi_device *device) + return result; + } + +-static int eeepc_acpi_remove(struct acpi_device *device) ++static void eeepc_acpi_remove(struct acpi_device *device) + { + struct eeepc_laptop *eeepc = acpi_driver_data(device); + +@@ -1451,7 +1451,6 @@ static int eeepc_acpi_remove(struct acpi_device *device) + eeepc_platform_exit(eeepc); + + kfree(eeepc); +- return 0; + } + + +diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c +index b543d117b12c7..085e044e888e4 100644 +--- a/drivers/platform/x86/fujitsu-laptop.c ++++ b/drivers/platform/x86/fujitsu-laptop.c +@@ -847,15 +847,13 @@ static int acpi_fujitsu_laptop_add(struct acpi_device *device) + return ret; + } + +-static int acpi_fujitsu_laptop_remove(struct acpi_device *device) ++static void acpi_fujitsu_laptop_remove(struct acpi_device *device) + { + struct fujitsu_laptop *priv = acpi_driver_data(device); + + fujitsu_laptop_platform_remove(device); + + kfifo_free(&priv->fifo); +- +- return 0; + } + + static void acpi_fujitsu_laptop_press(struct acpi_device *device, int scancode) +diff --git a/drivers/platform/x86/fujitsu-tablet.c b/drivers/platform/x86/fujitsu-tablet.c +index 7fb7fe5eb55a1..17f08ce7552d7 100644 +--- a/drivers/platform/x86/fujitsu-tablet.c ++++ b/drivers/platform/x86/fujitsu-tablet.c +@@ -484,12 +484,11 @@ static int acpi_fujitsu_add(struct acpi_device *adev) + return 0; + } + +-static int acpi_fujitsu_remove(struct acpi_device *adev) ++static void acpi_fujitsu_remove(struct acpi_device *adev) + { + free_irq(fujitsu.irq, fujitsu_interrupt); + release_region(fujitsu.io_base, fujitsu.io_length); + input_fujitsu_remove(); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/platform/x86/intel/rst.c b/drivers/platform/x86/intel/rst.c +index 3b81cb896fedf..35814a7707af7 100644 +--- a/drivers/platform/x86/intel/rst.c ++++ b/drivers/platform/x86/intel/rst.c +@@ -113,12 +113,10 @@ static int irst_add(struct acpi_device *acpi) + return error; + } + +-static int irst_remove(struct acpi_device *acpi) ++static void irst_remove(struct acpi_device *acpi) + { + device_remove_file(&acpi->dev, &irst_wakeup_attr); + device_remove_file(&acpi->dev, &irst_timeout_attr); +- +- return 0; + } + + static const struct acpi_device_id irst_ids[] = { +diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c +index 332868b140ed5..1452110d36ad7 100644 +--- a/drivers/platform/x86/lg-laptop.c ++++ b/drivers/platform/x86/lg-laptop.c +@@ -761,7 +761,7 @@ static int acpi_add(struct acpi_device *device) + return ret; + } + +-static int acpi_remove(struct acpi_device *device) ++static void acpi_remove(struct acpi_device *device) + { + sysfs_remove_group(&pf_device->dev.kobj, &dev_attribute_group); + +@@ -773,8 +773,6 @@ static int acpi_remove(struct acpi_device *device) + platform_device_unregister(pf_device); + pf_device = NULL; + platform_driver_unregister(&pf_driver); +- +- return 0; + } + + static const struct acpi_device_id device_ids[] = { +diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c +index ad3083f9946d4..cf845ee1c7b1f 100644 +--- a/drivers/platform/x86/panasonic-laptop.c ++++ b/drivers/platform/x86/panasonic-laptop.c +@@ -183,7 +183,7 @@ enum SINF_BITS { SINF_NUM_BATTERIES = 0, + /* R1 handles SINF_AC_CUR_BRIGHT as SINF_CUR_BRIGHT, doesn't know AC state */ + + static int acpi_pcc_hotkey_add(struct acpi_device *device); +-static int acpi_pcc_hotkey_remove(struct acpi_device *device); ++static void acpi_pcc_hotkey_remove(struct acpi_device *device); + static void acpi_pcc_hotkey_notify(struct acpi_device *device, u32 event); + + static const struct acpi_device_id pcc_device_ids[] = { +@@ -1065,12 +1065,12 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + return result; + } + +-static int acpi_pcc_hotkey_remove(struct acpi_device *device) ++static void acpi_pcc_hotkey_remove(struct acpi_device *device) + { + struct pcc_acpi *pcc = acpi_driver_data(device); + + if (!device || !pcc) +- return -EINVAL; ++ return; + + i8042_remove_filter(panasonic_i8042_filter); + +@@ -1088,8 +1088,6 @@ static int acpi_pcc_hotkey_remove(struct acpi_device *device) + + kfree(pcc->sinf); + kfree(pcc); +- +- return 0; + } + + module_acpi_driver(acpi_pcc_driver); +diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c +index 5ff5aaf92b56e..17ef014b9a8a6 100644 +--- a/drivers/platform/x86/sony-laptop.c ++++ b/drivers/platform/x86/sony-laptop.c +@@ -3270,7 +3270,7 @@ static int sony_nc_add(struct acpi_device *device) + return result; + } + +-static int sony_nc_remove(struct acpi_device *device) ++static void sony_nc_remove(struct acpi_device *device) + { + struct sony_nc_value *item; + +@@ -3287,8 +3287,6 @@ static int sony_nc_remove(struct acpi_device *device) + sony_pf_remove(); + sony_laptop_remove_input(); + dprintk(SONY_NC_DRIVER_NAME " removed.\n"); +- +- return 0; + } + + static const struct acpi_device_id sony_device_ids[] = { +@@ -4637,14 +4635,14 @@ static irqreturn_t sony_pic_irq(int irq, void *dev_id) + * ACPI driver + * + *****************/ +-static int sony_pic_remove(struct acpi_device *device) ++static void sony_pic_remove(struct acpi_device *device) + { + struct sony_pic_ioport *io, *tmp_io; + struct sony_pic_irq *irq, *tmp_irq; + + if (sony_pic_disable(device)) { + pr_err("Couldn't disable device\n"); +- return -ENXIO; ++ return; + } + + free_irq(spic_dev.cur_irq->irq.interrupts[0], &spic_dev); +@@ -4674,7 +4672,6 @@ static int sony_pic_remove(struct acpi_device *device) + spic_dev.cur_irq = NULL; + + dprintk(SONY_PIC_DRIVER_NAME " removed.\n"); +- return 0; + } + + static int sony_pic_add(struct acpi_device *device) +diff --git a/drivers/platform/x86/system76_acpi.c b/drivers/platform/x86/system76_acpi.c +index 958df41ad5098..52d94d8b1f25f 100644 +--- a/drivers/platform/x86/system76_acpi.c ++++ b/drivers/platform/x86/system76_acpi.c +@@ -744,7 +744,7 @@ static int system76_add(struct acpi_device *acpi_dev) + } + + // Remove a System76 ACPI device +-static int system76_remove(struct acpi_device *acpi_dev) ++static void system76_remove(struct acpi_device *acpi_dev) + { + struct system76_data *data; + +@@ -760,8 +760,6 @@ static int system76_remove(struct acpi_device *acpi_dev) + devm_led_classdev_unregister(&acpi_dev->dev, &data->kb_led); + + system76_get(data, "FINI"); +- +- return 0; + } + + static struct acpi_driver system76_driver = { +diff --git a/drivers/platform/x86/topstar-laptop.c b/drivers/platform/x86/topstar-laptop.c +index 6d18fbf8762b1..20df1ebefc30e 100644 +--- a/drivers/platform/x86/topstar-laptop.c ++++ b/drivers/platform/x86/topstar-laptop.c +@@ -332,7 +332,7 @@ static int topstar_acpi_add(struct acpi_device *device) + return err; + } + +-static int topstar_acpi_remove(struct acpi_device *device) ++static void topstar_acpi_remove(struct acpi_device *device) + { + struct topstar_laptop *topstar = acpi_driver_data(device); + +@@ -344,7 +344,6 @@ static int topstar_acpi_remove(struct acpi_device *device) + topstar_acpi_exit(topstar); + + kfree(topstar); +- return 0; + } + + static const struct acpi_device_id topstar_device_ids[] = { +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index 160abd3b3af8b..ce6a735b1abd8 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -3186,7 +3186,7 @@ static void print_supported_features(struct toshiba_acpi_dev *dev) + pr_cont("\n"); + } + +-static int toshiba_acpi_remove(struct acpi_device *acpi_dev) ++static void toshiba_acpi_remove(struct acpi_device *acpi_dev) + { + struct toshiba_acpi_dev *dev = acpi_driver_data(acpi_dev); + +@@ -3234,8 +3234,6 @@ static int toshiba_acpi_remove(struct acpi_device *acpi_dev) + toshiba_acpi = NULL; + + kfree(dev); +- +- return 0; + } + + static const char *find_hci_method(acpi_handle handle) +diff --git a/drivers/platform/x86/toshiba_bluetooth.c b/drivers/platform/x86/toshiba_bluetooth.c +index 57a5dc60c58a6..d8f81962a2402 100644 +--- a/drivers/platform/x86/toshiba_bluetooth.c ++++ b/drivers/platform/x86/toshiba_bluetooth.c +@@ -36,7 +36,7 @@ struct toshiba_bluetooth_dev { + }; + + static int toshiba_bt_rfkill_add(struct acpi_device *device); +-static int toshiba_bt_rfkill_remove(struct acpi_device *device); ++static void toshiba_bt_rfkill_remove(struct acpi_device *device); + static void toshiba_bt_rfkill_notify(struct acpi_device *device, u32 event); + + static const struct acpi_device_id bt_device_ids[] = { +@@ -279,7 +279,7 @@ static int toshiba_bt_rfkill_add(struct acpi_device *device) + return result; + } + +-static int toshiba_bt_rfkill_remove(struct acpi_device *device) ++static void toshiba_bt_rfkill_remove(struct acpi_device *device) + { + struct toshiba_bluetooth_dev *bt_dev = acpi_driver_data(device); + +@@ -291,7 +291,7 @@ static int toshiba_bt_rfkill_remove(struct acpi_device *device) + + kfree(bt_dev); + +- return toshiba_bluetooth_disable(device->handle); ++ toshiba_bluetooth_disable(device->handle); + } + + module_acpi_driver(toshiba_bt_rfkill_driver); +diff --git a/drivers/platform/x86/toshiba_haps.c b/drivers/platform/x86/toshiba_haps.c +index 49e84095bb010..8c9f76286b080 100644 +--- a/drivers/platform/x86/toshiba_haps.c ++++ b/drivers/platform/x86/toshiba_haps.c +@@ -138,14 +138,12 @@ static void toshiba_haps_notify(struct acpi_device *device, u32 event) + event, 0); + } + +-static int toshiba_haps_remove(struct acpi_device *device) ++static void toshiba_haps_remove(struct acpi_device *device) + { + sysfs_remove_group(&device->dev.kobj, &haps_attr_group); + + if (toshiba_haps) + toshiba_haps = NULL; +- +- return 0; + } + + /* Helper function */ +diff --git a/drivers/platform/x86/wireless-hotkey.c b/drivers/platform/x86/wireless-hotkey.c +index 11c60a2734468..c64d9f0844049 100644 +--- a/drivers/platform/x86/wireless-hotkey.c ++++ b/drivers/platform/x86/wireless-hotkey.c +@@ -83,10 +83,9 @@ static int wl_add(struct acpi_device *device) + return err; + } + +-static int wl_remove(struct acpi_device *device) ++static void wl_remove(struct acpi_device *device) + { + wireless_input_destroy(); +- return 0; + } + + static struct acpi_driver wl_driver = { +diff --git a/drivers/platform/x86/xo15-ebook.c b/drivers/platform/x86/xo15-ebook.c +index 97440462aa258..391f7ea4431e0 100644 +--- a/drivers/platform/x86/xo15-ebook.c ++++ b/drivers/platform/x86/xo15-ebook.c +@@ -143,13 +143,12 @@ static int ebook_switch_add(struct acpi_device *device) + return error; + } + +-static int ebook_switch_remove(struct acpi_device *device) ++static void ebook_switch_remove(struct acpi_device *device) + { + struct ebook_switch *button = acpi_driver_data(device); + + input_unregister_device(button->input); + kfree(button); +- return 0; + } + + static struct acpi_driver xo15_ebook_driver = { +diff --git a/drivers/ptp/ptp_vmw.c b/drivers/ptp/ptp_vmw.c +index 5dca26e14bdc8..0dcbabd1533db 100644 +--- a/drivers/ptp/ptp_vmw.c ++++ b/drivers/ptp/ptp_vmw.c +@@ -101,10 +101,9 @@ static int ptp_vmw_acpi_add(struct acpi_device *device) + return 0; + } + +-static int ptp_vmw_acpi_remove(struct acpi_device *device) ++static void ptp_vmw_acpi_remove(struct acpi_device *device) + { + ptp_clock_unregister(ptp_vmw_clock); +- return 0; + } + + static const struct acpi_device_id ptp_vmw_acpi_device_ids[] = { +diff --git a/drivers/thermal/intel/intel_menlow.c b/drivers/thermal/intel/intel_menlow.c +index 101d7e791a137..3f885b08a4909 100644 +--- a/drivers/thermal/intel/intel_menlow.c ++++ b/drivers/thermal/intel/intel_menlow.c +@@ -179,22 +179,20 @@ static int intel_menlow_memory_add(struct acpi_device *device) + + } + +-static int intel_menlow_memory_remove(struct acpi_device *device) ++static void intel_menlow_memory_remove(struct acpi_device *device) + { + struct thermal_cooling_device *cdev; + + if (!device) +- return -EINVAL; ++ return; + + cdev = acpi_driver_data(device); + if (!cdev) +- return -EINVAL; ++ return; + + sysfs_remove_link(&device->dev.kobj, "thermal_cooling"); + sysfs_remove_link(&cdev->device.kobj, "device"); + thermal_cooling_device_unregister(cdev); +- +- return 0; + } + + static const struct acpi_device_id intel_menlow_memory_ids[] = { +diff --git a/drivers/video/backlight/apple_bl.c b/drivers/video/backlight/apple_bl.c +index c0d9339cff873..e9e7acb577bfa 100644 +--- a/drivers/video/backlight/apple_bl.c ++++ b/drivers/video/backlight/apple_bl.c +@@ -193,13 +193,12 @@ static int apple_bl_add(struct acpi_device *dev) + return 0; + } + +-static int apple_bl_remove(struct acpi_device *dev) ++static void apple_bl_remove(struct acpi_device *dev) + { + backlight_device_unregister(apple_backlight_device); + + release_region(hw_data->iostart, hw_data->iolen); + hw_data = NULL; +- return 0; + } + + static const struct acpi_device_id apple_bl_ids[] = { +diff --git a/drivers/watchdog/ni903x_wdt.c b/drivers/watchdog/ni903x_wdt.c +index 4cebad324b202..045bb72d9a438 100644 +--- a/drivers/watchdog/ni903x_wdt.c ++++ b/drivers/watchdog/ni903x_wdt.c +@@ -224,14 +224,12 @@ static int ni903x_acpi_add(struct acpi_device *device) + return 0; + } + +-static int ni903x_acpi_remove(struct acpi_device *device) ++static void ni903x_acpi_remove(struct acpi_device *device) + { + struct ni903x_wdt *wdt = acpi_driver_data(device); + + ni903x_wdd_stop(&wdt->wdd); + watchdog_unregister_device(&wdt->wdd); +- +- return 0; + } + + static const struct acpi_device_id ni903x_device_ids[] = { +diff --git a/drivers/xen/xen-acpi-pad.c b/drivers/xen/xen-acpi-pad.c +index ccd8012020f15..ede69a5278d3f 100644 +--- a/drivers/xen/xen-acpi-pad.c ++++ b/drivers/xen/xen-acpi-pad.c +@@ -122,7 +122,7 @@ static int acpi_pad_add(struct acpi_device *device) + return 0; + } + +-static int acpi_pad_remove(struct acpi_device *device) ++static void acpi_pad_remove(struct acpi_device *device) + { + mutex_lock(&xen_cpu_lock); + xen_acpi_pad_idle_cpus(0); +@@ -130,7 +130,6 @@ static int acpi_pad_remove(struct acpi_device *device) + + acpi_remove_notify_handler(device->handle, + ACPI_DEVICE_NOTIFY, acpi_pad_notify); +- return 0; + } + + static const struct acpi_device_id pad_device_ids[] = { +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 6badc50ec4e66..0584e9f6e3397 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -149,7 +149,7 @@ struct acpi_hotplug_context { + */ + + typedef int (*acpi_op_add) (struct acpi_device * device); +-typedef int (*acpi_op_remove) (struct acpi_device * device); ++typedef void (*acpi_op_remove) (struct acpi_device *device); + typedef void (*acpi_op_notify) (struct acpi_device * device, u32 event); + + struct acpi_device_ops { +-- +2.39.2 + diff --git a/queue-6.1/alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch b/queue-6.1/alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch new file mode 100644 index 00000000000..cf613d71a7e --- /dev/null +++ b/queue-6.1/alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch @@ -0,0 +1,42 @@ +From 8debe4fbe4482ae3cffaedbc4f918f233134d938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 10:17:32 +0800 +Subject: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer + +From: Su Hui + +[ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ] + +smatch error: +sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: +we previously assumed 'rac97' could be null (see line 2072) + +remove redundant assignment, return error if rac97 is NULL. + +Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*") +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ac97/ac97_codec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index ff685321f1a11..534ea7a256ec3 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2070,8 +2070,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, + .dev_disconnect = snd_ac97_dev_disconnect, + }; + +- if (rac97) +- *rac97 = NULL; ++ if (!rac97) ++ return -EINVAL; + if (snd_BUG_ON(!bus || !template)) + return -EINVAL; + if (snd_BUG_ON(template->num >= 4)) +-- +2.39.2 + diff --git a/queue-6.1/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch b/queue-6.1/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch new file mode 100644 index 00000000000..0364a4f0115 --- /dev/null +++ b/queue-6.1/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch @@ -0,0 +1,73 @@ +From 56643677c00e8bb98e945f60dcc5d5943b1f5b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 15:44:12 -0700 +Subject: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-I Wu + +[ Upstream commit 9f0bcf49e9895cb005d78b33a5eebfa11711b425 ] + +This is motivated by OOB access in amdgpu_vm_update_range when +offset_in_bo+map_size overflows. + +v2: keep the validations in amdgpu_vm_bo_map +v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map + rather than to amdgpu_gem_va_ioctl + +Fixes: 9f7eb5367d00 ("drm/amdgpu: actually use the VM map parameters") +Reviewed-by: Christian König +Signed-off-by: Chia-I Wu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 5a8a4cda7e987..58fe7279599f0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -1427,14 +1427,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev, + uint64_t eaddr; + + /* validate the parameters */ +- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || +- size == 0 || size & ~PAGE_MASK) ++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK) ++ return -EINVAL; ++ if (saddr + size <= saddr || offset + size <= offset) + return -EINVAL; + + /* make sure object fit at this offset */ + eaddr = saddr + size - 1; +- if (saddr >= eaddr || +- (bo && offset + size > amdgpu_bo_size(bo)) || ++ if ((bo && offset + size > amdgpu_bo_size(bo)) || + (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT)) + return -EINVAL; + +@@ -1493,14 +1493,14 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, + int r; + + /* validate the parameters */ +- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || +- size == 0 || size & ~PAGE_MASK) ++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK) ++ return -EINVAL; ++ if (saddr + size <= saddr || offset + size <= offset) + return -EINVAL; + + /* make sure object fit at this offset */ + eaddr = saddr + size - 1; +- if (saddr >= eaddr || +- (bo && offset + size > amdgpu_bo_size(bo)) || ++ if ((bo && offset + size > amdgpu_bo_size(bo)) || + (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT)) + return -EINVAL; + +-- +2.39.2 + diff --git a/queue-6.1/arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch b/queue-6.1/arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch new file mode 100644 index 00000000000..891277eb3e0 --- /dev/null +++ b/queue-6.1/arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch @@ -0,0 +1,62 @@ +From a1b02bcb6b5096bc31ddf778f3bf5aefb78bbb8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 00:50:50 +0900 +Subject: ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ + guard + +From: Masahiro Yamada + +[ Upstream commit 92e2921eeafdfca9acd9b83f07d2b7ca099bac24 ] + +ASM_NL is useful not only in *.S files but also in .c files for using +inline assembler in C code. + +On ARC, however, ASM_NL is evaluated inconsistently. It is expanded to +a backquote (`) in *.S files, but a semicolon (;) in *.c files because +arch/arc/include/asm/linkage.h defines it inside #ifdef __ASSEMBLY__, +so the definition for C code falls back to the default value defined in +include/linux/linkage.h. + +If ASM_NL is used in inline assembler in .c files, it will result in +wrong assembly code because a semicolon is not an instruction separator, +but the start of a comment for ARC. + +Move ASM_NL (also __ALIGN and __ALIGN_STR) out of the #ifdef. + +Fixes: 9df62f054406 ("arch: use ASM_NL instead of ';' for assembler new line character in the macro") +Fixes: 8d92e992a785 ("ARC: define __ALIGN_STR and __ALIGN symbols for ARC") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/linkage.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h +index c9434ff3aa4ce..8a3fb71e9cfad 100644 +--- a/arch/arc/include/asm/linkage.h ++++ b/arch/arc/include/asm/linkage.h +@@ -8,6 +8,10 @@ + + #include + ++#define ASM_NL ` /* use '`' to mark new line in macro */ ++#define __ALIGN .align 4 ++#define __ALIGN_STR __stringify(__ALIGN) ++ + #ifdef __ASSEMBLY__ + + .macro ST2 e, o, off +@@ -28,10 +32,6 @@ + #endif + .endm + +-#define ASM_NL ` /* use '`' to mark new line in macro */ +-#define __ALIGN .align 4 +-#define __ALIGN_STR __stringify(__ALIGN) +- + /* annotation for data we want in DCCM - if enabled in .config */ + .macro ARCFP_DATA nm + #ifdef CONFIG_ARC_HAS_DCCM +-- +2.39.2 + diff --git a/queue-6.1/arm-9303-1-kprobes-avoid-missing-declaration-warning.patch b/queue-6.1/arm-9303-1-kprobes-avoid-missing-declaration-warning.patch new file mode 100644 index 00000000000..1b71d1d739e --- /dev/null +++ b/queue-6.1/arm-9303-1-kprobes-avoid-missing-declaration-warning.patch @@ -0,0 +1,103 @@ +From 120f9f600001fbfeb232061e55bddaf59f7c753e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 19:28:42 +0100 +Subject: ARM: 9303/1: kprobes: avoid missing-declaration warnings + +From: Arnd Bergmann + +[ Upstream commit 1b9c3ddcec6a55e15d3e38e7405e2d078db02020 ] + +checker_stack_use_t32strd() and kprobe_handler() can be made static since +they are not used from other files, while coverage_start_registers() +and __kprobes_test_case() are used from assembler code, and just need +a declaration to avoid a warning with the global definition. + +arch/arm/probes/kprobes/checkers-common.c:43:18: error: no previous prototype for 'checker_stack_use_t32strd' +arch/arm/probes/kprobes/core.c:236:16: error: no previous prototype for 'kprobe_handler' +arch/arm/probes/kprobes/test-core.c:723:10: error: no previous prototype for 'coverage_start_registers' +arch/arm/probes/kprobes/test-core.c:918:14: error: no previous prototype for '__kprobes_test_case_start' +arch/arm/probes/kprobes/test-core.c:952:14: error: no previous prototype for '__kprobes_test_case_end_16' +arch/arm/probes/kprobes/test-core.c:967:14: error: no previous prototype for '__kprobes_test_case_end_32' + +Fixes: 6624cf651f1a ("ARM: kprobes: collects stack consumption for store instructions") +Fixes: 454f3e132d05 ("ARM/kprobes: Remove jprobe arm implementation") +Acked-by: Masami Hiramatsu (Google) +Reviewed-by: Kees Cook +Signed-off-by: Arnd Bergmann +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/probes/kprobes/checkers-common.c | 2 +- + arch/arm/probes/kprobes/core.c | 2 +- + arch/arm/probes/kprobes/opt-arm.c | 2 -- + arch/arm/probes/kprobes/test-core.c | 2 +- + arch/arm/probes/kprobes/test-core.h | 4 ++++ + 5 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/probes/kprobes/checkers-common.c b/arch/arm/probes/kprobes/checkers-common.c +index 4d720990cf2a3..eba7ac4725c02 100644 +--- a/arch/arm/probes/kprobes/checkers-common.c ++++ b/arch/arm/probes/kprobes/checkers-common.c +@@ -40,7 +40,7 @@ enum probes_insn checker_stack_use_imm_0xx(probes_opcode_t insn, + * Different from other insn uses imm8, the real addressing offset of + * STRD in T32 encoding should be imm8 * 4. See ARMARM description. + */ +-enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn, ++static enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn, + struct arch_probes_insn *asi, + const struct decode_header *h) + { +diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c +index 9090c3a74dcce..d8238da095df7 100644 +--- a/arch/arm/probes/kprobes/core.c ++++ b/arch/arm/probes/kprobes/core.c +@@ -233,7 +233,7 @@ singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb) + * kprobe, and that level is reserved for user kprobe handlers, so we can't + * risk encountering a new kprobe in an interrupt handler. + */ +-void __kprobes kprobe_handler(struct pt_regs *regs) ++static void __kprobes kprobe_handler(struct pt_regs *regs) + { + struct kprobe *p, *cur; + struct kprobe_ctlblk *kcb; +diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c +index dbef34ed933f2..7f65048380ca5 100644 +--- a/arch/arm/probes/kprobes/opt-arm.c ++++ b/arch/arm/probes/kprobes/opt-arm.c +@@ -145,8 +145,6 @@ __arch_remove_optimized_kprobe(struct optimized_kprobe *op, int dirty) + } + } + +-extern void kprobe_handler(struct pt_regs *regs); +- + static void + optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs) + { +diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c +index c562832b86272..171c7076b89f4 100644 +--- a/arch/arm/probes/kprobes/test-core.c ++++ b/arch/arm/probes/kprobes/test-core.c +@@ -720,7 +720,7 @@ static const char coverage_register_lookup[16] = { + [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP, + }; + +-unsigned coverage_start_registers(const struct decode_header *h) ++static unsigned coverage_start_registers(const struct decode_header *h) + { + unsigned regs = 0; + int i; +diff --git a/arch/arm/probes/kprobes/test-core.h b/arch/arm/probes/kprobes/test-core.h +index 56ad3c0aaeeac..c7297037c1623 100644 +--- a/arch/arm/probes/kprobes/test-core.h ++++ b/arch/arm/probes/kprobes/test-core.h +@@ -454,3 +454,7 @@ void kprobe_thumb32_test_cases(void); + #else + void kprobe_arm_test_cases(void); + #endif ++ ++void __kprobes_test_case_start(void); ++void __kprobes_test_case_end_16(void); ++void __kprobes_test_case_end_32(void); +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch b/queue-6.1/arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch new file mode 100644 index 00000000000..238ed557cdd --- /dev/null +++ b/queue-6.1/arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch @@ -0,0 +1,42 @@ +From 5b3d4d75112b57c88a6ca23bdc88e0d5c002abfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 14:28:30 +0200 +Subject: ARM: dts: BCM5301X: Drop "clock-names" from the SPI node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit d3c8e2c5757153bbfad70019ec1decbca86f3def ] + +There is no such property in the SPI controller binding documentation. +Also Linux driver doesn't look for it. + +This fixes: +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: spi@18029200: Unevaluated properties are not allowed ('clock-names' was unexpected) + From schema: Documentation/devicetree/bindings/spi/brcm,spi-bcm-qspi.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230503122830.3200-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 5fc1b847f4aa5..787a0dd8216b7 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -542,7 +542,6 @@ spi@18029200 { + "spi_lr_session_done", + "spi_lr_overread"; + clocks = <&iprocmed>; +- clock-names = "iprocmed"; + num-cs = <2>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch b/queue-6.1/arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch new file mode 100644 index 00000000000..2a712ec81d1 --- /dev/null +++ b/queue-6.1/arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch @@ -0,0 +1,56 @@ +From 421ec223cc532a4d4aa22d129a17769284893b79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 17:36:29 +0200 +Subject: ARM: dts: BCM5301X: fix duplex-full => full-duplex + +From: Christian Lamparter + +[ Upstream commit fd274b733bfdde3ca72f0fa2a37f032f3a8c402c ] + +this typo was found by the dtbs_check +| ports:port@5:fixed-link: 'oneOf' conditional failed, +| {'speed': [[1000]], 'duplex-full': True} is not of type 'array' +| 'duplex-full' does not match any of the regexes: 'pinctrl-[0-]..." + +this should have been full-duplex; + +Fixes: 935327a73553 ("ARM: dts: BCM5301X: Add DT for Meraki MR26") +Fixes: ec88a9c344d9 ("ARM: BCM5301X: Add DT for Meraki MR32") +Signed-off-by: Christian Lamparter +Link: https://lore.kernel.org/r/50522f45566951a9eabd22820647924cc6b4a264.1686238550.git.chunkeey@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm53015-meraki-mr26.dts | 2 +- + arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts +index 14f58033efeb9..ca2266b936ee2 100644 +--- a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts ++++ b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts +@@ -128,7 +128,7 @@ port@5 { + + fixed-link { + speed = <1000>; +- duplex-full; ++ full-duplex; + }; + }; + }; +diff --git a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts +index e678bc03d8165..008de8ee2584a 100644 +--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts ++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts +@@ -187,7 +187,7 @@ port@5 { + + fixed-link { + speed = <1000>; +- duplex-full; ++ full-duplex; + }; + }; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch b/queue-6.1/arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch new file mode 100644 index 00000000000..53c70a75fa1 --- /dev/null +++ b/queue-6.1/arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch @@ -0,0 +1,41 @@ +From c2212c75e0514c4ffee55ca8194af520df48be19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 13:32:25 +0300 +Subject: ARM: dts: gta04: Move model property out of pinctrl node + +From: Tony Lindgren + +[ Upstream commit 4ffec92e70ac5097b9f67ec154065305b16a3b46 ] + +The model property should be at the top level, let's move it out +of the pinctrl node. + +Fixes: d2eaf949d2c3 ("ARM: dts: omap3-gta04a5one: define GTA04A5 variant with OneNAND") +Cc: Andreas Kemnade +Cc: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04a5one.dts | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04a5one.dts b/arch/arm/boot/dts/omap3-gta04a5one.dts +index 9db9fe67cd63b..95df45cc70c09 100644 +--- a/arch/arm/boot/dts/omap3-gta04a5one.dts ++++ b/arch/arm/boot/dts/omap3-gta04a5one.dts +@@ -5,9 +5,11 @@ + + #include "omap3-gta04a5.dts" + +-&omap3_pmx_core { ++/ { + model = "Goldelico GTA04A5/Letux 2804 with OneNAND"; ++}; + ++&omap3_pmx_core { + gpmc_pins: pinmux_gpmc_pins { + pinctrl-single,pins = < + +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch b/queue-6.1/arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch new file mode 100644 index 00000000000..1d8f85a82fd --- /dev/null +++ b/queue-6.1/arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch @@ -0,0 +1,49 @@ +From 0f189176178237d07d45a55dee87368be7ec60e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 17:35:16 +0200 +Subject: ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier + +From: Geert Uytterhoeven + +[ Upstream commit 0501fdec106a291c43b3c1b525cf22ab4c24b2d8 ] + +make dtbs_check: + + arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + +PWM specifiers referring to R-Car PWM Timer Controllers should contain +only two cells. + +Fix this by dropping the bogus third cell. + +Fixes: 6f89dd9e9325d05b ("ARM: dts: iwg20d-q7-common: Add LCD support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/6e5c3167424a43faf8c1fa68d9667b3d87dc86d8.1684855911.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/iwg20d-q7-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi +index 03caea6fc6ffa..4351c5a02fa59 100644 +--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi ++++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi +@@ -49,7 +49,7 @@ audio_clock: audio_clock { + lcd_backlight: backlight { + compatible = "pwm-backlight"; + +- pwms = <&pwm3 0 5000000 0>; ++ pwms = <&pwm3 0 5000000>; + brightness-levels = <0 4 8 16 32 64 128 255>; + default-brightness-level = <7>; + enable-gpios = <&gpio5 14 GPIO_ACTIVE_HIGH>; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-lan966x-kontron-d10-fix-board-reset.patch b/queue-6.1/arm-dts-lan966x-kontron-d10-fix-board-reset.patch new file mode 100644 index 00000000000..824902b1867 --- /dev/null +++ b/queue-6.1/arm-dts-lan966x-kontron-d10-fix-board-reset.patch @@ -0,0 +1,51 @@ +From 486cd1c1893de2f66e899ece4c0db9eb62ac9719 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 15:18:39 +0200 +Subject: ARM: dts: lan966x: kontron-d10: fix board reset + +From: Michael Walle + +[ Upstream commit bfcd5714f6424c03e385e0e9296dcd69855cfea7 ] + +The pinctrl node was missing which change the pin mux to GPIO mode. Add +it. + +Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support") +Signed-off-by: Michael Walle +[claudiu.beznea: moved pinctrl-* bindings after compatible] +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-1-50dd0452b8fe@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi +index 0097e72e3fb22..42be207509a46 100644 +--- a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi ++++ b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi +@@ -18,6 +18,8 @@ chosen { + + gpio-restart { + compatible = "gpio-restart"; ++ pinctrl-0 = <&reset_pins>; ++ pinctrl-names = "default"; + gpios = <&gpio 56 GPIO_ACTIVE_LOW>; + priority = <200>; + }; +@@ -59,6 +61,12 @@ miim_c_pins: miim-c-pins { + function = "miim_c"; + }; + ++ reset_pins: reset-pins { ++ /* SYS_RST# */ ++ pins = "GPIO_56"; ++ function = "gpio"; ++ }; ++ + sgpio_a_pins: sgpio-a-pins { + /* SCK, D0, D1 */ + pins = "GPIO_32", "GPIO_33", "GPIO_34"; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-lan966x-kontron-d10-fix-spi-cs.patch b/queue-6.1/arm-dts-lan966x-kontron-d10-fix-spi-cs.patch new file mode 100644 index 00000000000..b3ab2a16a11 --- /dev/null +++ b/queue-6.1/arm-dts-lan966x-kontron-d10-fix-spi-cs.patch @@ -0,0 +1,51 @@ +From 8a2a23a1c59f2663550d65cb5413b02dd40e8251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 15:18:40 +0200 +Subject: ARM: dts: lan966x: kontron-d10: fix SPI CS + +From: Michael Walle + +[ Upstream commit fcb79ee3f0b15ed15f35eca5f24e952fdced9c61 ] + +The pinctrl node was missing which change the pin mux to GPIO mode. +Add it so we don't have to rely on the bootloader to set the correct +mode. + +Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support") +Signed-off-by: Michael Walle +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-2-50dd0452b8fe@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi +index 42be207509a46..f4df4cc1dfa5e 100644 +--- a/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi ++++ b/arch/arm/boot/dts/lan966x-kontron-kswitch-d10-mmt.dtsi +@@ -41,7 +41,7 @@ &flx3 { + status = "okay"; + + spi3: spi@400 { +- pinctrl-0 = <&fc3_b_pins>; ++ pinctrl-0 = <&fc3_b_pins>, <&spi3_cs_pins>; + pinctrl-names = "default"; + status = "okay"; + cs-gpios = <&gpio 46 GPIO_ACTIVE_LOW>; +@@ -79,6 +79,12 @@ sgpio_b_pins: sgpio-b-pins { + function = "sgpio_b"; + }; + ++ spi3_cs_pins: spi3-cs-pins { ++ /* CS# */ ++ pins = "GPIO_46"; ++ function = "gpio"; ++ }; ++ + usart0_pins: usart0-pins { + /* RXD, TXD */ + pins = "GPIO_25", "GPIO_26"; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch b/queue-6.1/arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch new file mode 100644 index 00000000000..6e4e4feefbd --- /dev/null +++ b/queue-6.1/arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch @@ -0,0 +1,51 @@ +From d595f26a1c7c78775824790fbd2cc3949f9ebac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:30:29 +0200 +Subject: ARM: dts: meson8: correct uart_B and uart_C clock references + +From: Martin Blumenstingl + +[ Upstream commit 98b503c7fb13a17a47d8ebf15fa8f7c10118e75c ] + +On Meson8 uart_B and uart_C do not work, because they are relying on +incorrect clocks. Change the references of pclk to the correct CLKID +(UART1 for uart_B and UART2 for uart_C), to allow use of the two uarts. + +This was originally reported by Hans-Frieder Vogt for Meson8b [0], but +the same bug is also present in meson8.dtsi + +[0] https://lore.kernel.org/linux-amlogic/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55/ + +Fixes: 57007bfb5469 ("ARM: dts: meson8: Fix the UART device-tree schema validation") +Reported-by: Hans-Frieder Vogt # for meson8b.dtsi +Signed-off-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20230516203029.1031174-1-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi +index 0f8bac8bac8bb..f9da7faa2186b 100644 +--- a/arch/arm/boot/dts/meson8.dtsi ++++ b/arch/arm/boot/dts/meson8.dtsi +@@ -749,13 +749,13 @@ &uart_A { + + &uart_B { + compatible = "amlogic,meson8-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + + &uart_C { + compatible = "amlogic,meson8-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch b/queue-6.1/arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch new file mode 100644 index 00000000000..575dfd56b4f --- /dev/null +++ b/queue-6.1/arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch @@ -0,0 +1,47 @@ +From 5ddf1f5830a6fc9187bce11b07ac8681194fd508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 16:36:25 +0200 +Subject: ARM: dts: meson8b: correct uart_B and uart_C clock references + +From: hfdevel@gmx.net + +[ Upstream commit d542ce8d4769cdef6a7bc3437e59cfed9c68f0e4 ] + +With the current device tree for meson8b, uarts B (e.g. available on pins +8/10 on Odroid-C1) and C (pins 3/5 on Odroid-C1) do not work, because they +are relying on incorrect clocks. Change the references of pclk to the +correct CLKID, to allow use of the two uarts. + +Fixes: 3375aa77135f ("ARM: dts: meson8b: Fix the UART device-tree schema validation") +Signed-off-by: Hans-Frieder Vogt +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55 +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi +index cf9c04a61ba3c..d3e0f085904db 100644 +--- a/arch/arm/boot/dts/meson8b.dtsi ++++ b/arch/arm/boot/dts/meson8b.dtsi +@@ -737,13 +737,13 @@ &uart_A { + + &uart_B { + compatible = "amlogic,meson8b-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + + &uart_C { + compatible = "amlogic,meson8b-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-qcom-apq8074-dragonboard-set-dma-as-remotely.patch b/queue-6.1/arm-dts-qcom-apq8074-dragonboard-set-dma-as-remotely.patch new file mode 100644 index 00000000000..3326363af0a --- /dev/null +++ b/queue-6.1/arm-dts-qcom-apq8074-dragonboard-set-dma-as-remotely.patch @@ -0,0 +1,42 @@ +From 2861ae7e23a342ede8f159161cac96c8d94b86f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 22:07:33 +0300 +Subject: ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled + +From: Dmitry Baryshkov + +[ Upstream commit e60c230588d88036f974cec7e93361e2c4f62226 ] + +Add the qcom,controlled-remotely property for the blsp2_bam +controller node. This board requires this, otherwise the board stalls +during the boot for some reason (most probably because TZ mishandles the +protection error and keeps on looping somewhere inside). + +Fixes: 62bc81792223 dts: msm8974: Add blsp2_bam dma node +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230507190735.2333145-3-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-apq8074-dragonboard.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts b/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts +index 91716298ec5ed..be1ab7eff8ff4 100644 +--- a/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts ++++ b/arch/arm/boot/dts/qcom-apq8074-dragonboard.dts +@@ -23,6 +23,10 @@ &blsp1_uart2 { + status = "okay"; + }; + ++&blsp2_dma { ++ qcom,controlled-remotely; ++}; ++ + &blsp2_i2c5 { + status = "okay"; + clock-frequency = <200000>; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-qcom-msm8974-do-not-use-underscore-in-node-n.patch b/queue-6.1/arm-dts-qcom-msm8974-do-not-use-underscore-in-node-n.patch new file mode 100644 index 00000000000..1f5bc315f51 --- /dev/null +++ b/queue-6.1/arm-dts-qcom-msm8974-do-not-use-underscore-in-node-n.patch @@ -0,0 +1,38 @@ +From 8b943233e1b1da2187c6501743d4f0d498214946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 19:52:32 +0200 +Subject: ARM: dts: qcom: msm8974: do not use underscore in node name (again) + +From: Krzysztof Kozlowski + +[ Upstream commit 311bbc884b2edcf584b67d331be85ce43b27586f ] + +Align RPM requests node with DT schema by using hyphen instead of +underscore. + +Fixes: f300826d27be ("ARM: dts: qcom-msm8974: Sort and clean up nodes") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230410175232.22317-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-msm8974.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom-msm8974.dtsi +index 7a9be0acf3f5a..c4b2e9ac24940 100644 +--- a/arch/arm/boot/dts/qcom-msm8974.dtsi ++++ b/arch/arm/boot/dts/qcom-msm8974.dtsi +@@ -300,7 +300,7 @@ rpm { + qcom,ipc = <&apcs 8 0>; + qcom,smd-edge = <15>; + +- rpm_requests: rpm_requests { ++ rpm_requests: rpm-requests { + compatible = "qcom,rpm-msm8974"; + qcom,smd-channels = "rpm_requests"; + +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch b/queue-6.1/arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch new file mode 100644 index 00000000000..e6f994f02b7 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch @@ -0,0 +1,52 @@ +From a8da7d327908d9735d7a465969d61d7ac650549a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 20:01:12 +0200 +Subject: ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 + +From: Marek Vasut + +[ Upstream commit e3f2778b1b6ced649bffdc7cbb05b80bb92f2108 ] + +The audio routing flow is not correct, the flow should be from source +(second element in the pair) to sink (first element in the pair). The +flow now is from "HP_OUT" to "Playback", where "Playback" is source +and "HP_OUT" is sink, i.e. the direction is swapped and there is no +direct link between the two either. + +Fill in the correct routing, where "HP_OUT" supplies the "Headphone Jack", +"Line In Jack" supplies "LINE_IN" input, "Microphone Jack" supplies "MIC_IN" +input and "Mic Bias" supplies "Microphone Jack". + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index 5f586f024060f..38f46c2c83aa6 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -137,10 +137,13 @@ reg_panel_supply: regulator-panel-supply { + + sound { + compatible = "audio-graph-card"; +- routing = +- "MIC_IN", "Capture", +- "Capture", "Mic Bias", +- "Playback", "HP_OUT"; ++ widgets = "Headphone", "Headphone Jack", ++ "Line", "Line In Jack", ++ "Microphone", "Microphone Jack"; ++ routing = "Headphone Jack", "HP_OUT", ++ "LINE_IN", "Line In Jack", ++ "MIC_IN", "Microphone Jack", ++ "Microphone Jack", "Mic Bias"; + dais = <&sai2a_port &sai2b_port>; + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch b/queue-6.1/arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch new file mode 100644 index 00000000000..0c9dfec2bfa --- /dev/null +++ b/queue-6.1/arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch @@ -0,0 +1,36 @@ +From 264c1c1504658ef219cd9378c74e573b6eacf2e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 13:56:04 +0200 +Subject: ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx + +From: Olivier Moysan + +[ Upstream commit 076c74c592cabe4a47537fe5205b5b678bed010d ] + +Use "dai-format" to configure DAI audio format as specified in +audio-graph-port.yaml bindings. + +Fixes: 144d1ba70548 ("ARM: dts: stm32: Adapt STM32MP157 DK boards to stm32 DT diversity") +Signed-off-by: Olivier Moysan +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi +index 8b48d3c89a047..fdc48536e97d1 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi +@@ -438,7 +438,7 @@ &i2s2 { + i2s2_port: port { + i2s2_endpoint: endpoint { + remote-endpoint = <&sii9022_tx_endpoint>; +- format = "i2s"; ++ dai-format = "i2s"; + mclk-fs = <256>; + }; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch b/queue-6.1/arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch new file mode 100644 index 00000000000..7dcd3b8ce60 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch @@ -0,0 +1,77 @@ +From c6361ac9710b41d5cf05a58555484f207a47b661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 23:37:29 +0200 +Subject: ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards + +From: Marek Vasut + +[ Upstream commit 9660efc2af37f3c12dc6e6a5511ad99e0addc297 ] + +The ethernet MAC EEPROM is not populated on the SoM itself, it has to be +populated on each carrier board. Move the EEPROM into the correct place +in DTs, i.e. the carrier board DTs. Add label to the EEPROM too. + +Fixes: 7e76f82acd9e1 ("ARM: dts: stm32: Split Avenger96 into DHCOR SoM and Avenger96 board") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 ++++++ + arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi | 6 ++++++ + arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 6 ------ + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index b6957cbdeff5f..2c246ac641533 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -322,6 +322,12 @@ adv7513_i2s0: endpoint { + }; + }; + }; ++ ++ dh_mac_eeprom: eeprom@53 { ++ compatible = "atmel,24c02"; ++ reg = <0x53>; ++ pagesize = <16>; ++ }; + }; + + <dc { +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi +index 27477bb219ded..bb4ac6c13cbd3 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi +@@ -192,6 +192,12 @@ eeprom@50 { + reg = <0x50>; + pagesize = <16>; + }; ++ ++ dh_mac_eeprom: eeprom@53 { ++ compatible = "atmel,24c02"; ++ reg = <0x53>; ++ pagesize = <16>; ++ }; + }; + + &sdmmc1 { /* MicroSD */ +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +index bb40fb46da81d..bba19f21e5277 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +@@ -213,12 +213,6 @@ watchdog { + status = "disabled"; + }; + }; +- +- eeprom@53 { +- compatible = "atmel,24c02"; +- reg = <0x53>; +- pagesize = <16>; +- }; + }; + + &ipcc { +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch b/queue-6.1/arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch new file mode 100644 index 00000000000..6ce9a018745 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch @@ -0,0 +1,38 @@ +From 5a014636f830a946999079dca2e235bfc1bb5671 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 02:42:32 +0200 +Subject: ARM: dts: stm32: Shorten the AV96 HDMI sound card name + +From: Marek Vasut + +[ Upstream commit 0cf765e598712addec34d0208cc1418c151fefb2 ] + +Fix the following error in kernel log due to too long sound card name: +" +asoc-audio-graph-card sound: ASoC: driver name too long 'STM32MP1-AV96-HDMI' -> 'STM32MP1-AV96-H' +" + +Fixes: e027da342772 ("ARM: dts: stm32: Add bindings for audio on AV96") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index 2c246ac641533..f068e4fcc404f 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -88,7 +88,7 @@ sd_switch: regulator-sd_switch { + + sound { + compatible = "audio-graph-card"; +- label = "STM32MP1-AV96-HDMI"; ++ label = "STM32-AV96-HDMI"; + dais = <&sai2a_port>; + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm-ep93xx-fix-missing-prototype-warnings.patch b/queue-6.1/arm-ep93xx-fix-missing-prototype-warnings.patch new file mode 100644 index 00000000000..7b411656498 --- /dev/null +++ b/queue-6.1/arm-ep93xx-fix-missing-prototype-warnings.patch @@ -0,0 +1,48 @@ +From ea340ce2b03131b1753e4cbf03840e395bf46846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 17:30:58 +0200 +Subject: ARM: ep93xx: fix missing-prototype warnings + +From: Arnd Bergmann + +[ Upstream commit 419013740ea1e4343d8ade535d999f59fa28e460 ] + +ep93xx_clocksource_read() is only called from the file it is declared in, +while ep93xx_timer_init() is declared in a header that is not included here. + +arch/arm/mach-ep93xx/timer-ep93xx.c:120:13: error: no previous prototype for 'ep93xx_timer_init' +arch/arm/mach-ep93xx/timer-ep93xx.c:63:5: error: no previous prototype for 'ep93xx_clocksource_read' + +Fixes: 000bc17817bf ("ARM: ep93xx: switch to GENERIC_CLOCKEVENTS") +Acked-by: Alexander Sverdlin +Link: https://lore.kernel.org/r/20230516153109.514251-3-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-ep93xx/timer-ep93xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c +index dd4b164d18317..a9efa7bc2fa12 100644 +--- a/arch/arm/mach-ep93xx/timer-ep93xx.c ++++ b/arch/arm/mach-ep93xx/timer-ep93xx.c +@@ -9,6 +9,7 @@ + #include + #include + #include "soc.h" ++#include "platform.h" + + /************************************************************************* + * Timer handling for EP93xx +@@ -60,7 +61,7 @@ static u64 notrace ep93xx_read_sched_clock(void) + return ret; + } + +-u64 ep93xx_clocksource_read(struct clocksource *c) ++static u64 ep93xx_clocksource_read(struct clocksource *c) + { + u64 ret; + +-- +2.39.2 + diff --git a/queue-6.1/arm-omap2-fix-missing-tick_broadcast-prototype.patch b/queue-6.1/arm-omap2-fix-missing-tick_broadcast-prototype.patch new file mode 100644 index 00000000000..bf527deff44 --- /dev/null +++ b/queue-6.1/arm-omap2-fix-missing-tick_broadcast-prototype.patch @@ -0,0 +1,41 @@ +From d7b982c57946b78d8f96d615406ebe6ce1cb7ae8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 17:31:04 +0200 +Subject: ARM: omap2: fix missing tick_broadcast() prototype + +From: Arnd Bergmann + +[ Upstream commit 861bc1d2886d47bd57a2cbf2cda87fdbe3eb9d08 ] + +omap2 contains a hack to define tick_broadcast() on non-SMP +configurations in place of the normal SMP definition. This one +causes a warning because of a missing prototype: + +arch/arm/mach-omap2/board-generic.c:44:6: error: no previous prototype for 'tick_broadcast' + +Make sure to always include the header with the declaration. + +Fixes: d86ad463d670 ("ARM: OMAP2+: Fix regression for using local timer on non-SMP SoCs") +Acked-by: Aaro Koskinen +Link: https://lore.kernel.org/r/20230516153109.514251-9-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/board-generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c +index 1610c567a6a3a..10d2f078e4a8e 100644 +--- a/arch/arm/mach-omap2/board-generic.c ++++ b/arch/arm/mach-omap2/board-generic.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include + #include +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch b/queue-6.1/arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch new file mode 100644 index 00000000000..df6abbbbb37 --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch @@ -0,0 +1,112 @@ +From 6c87db0815f8aa427d090051be1672d89c2542f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 14:19:44 +0800 +Subject: arm64: dts: mediatek: Add cpufreq nodes for MT8192 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Allen-KH Cheng + +[ Upstream commit 9d498cce9298a71e3896e2d1aee24a1a4c531d81 ] + +Add the cpufreq nodes for MT8192 SoC. + +Signed-off-by: Allen-KH Cheng +Tested-by: Chen-Yu Tsai +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Tested-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230317061944.15434-1-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Stable-dep-of: a4366b5695c9 ("arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index ef1294d960145..ff2310fe3f1d2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -64,6 +64,7 @@ cpu0: cpu@0 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -75,6 +76,7 @@ cpu1: cpu@100 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -86,6 +88,7 @@ cpu2: cpu@200 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -97,6 +100,7 @@ cpu3: cpu@300 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -108,6 +112,7 @@ cpu4: cpu@400 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -119,6 +124,7 @@ cpu5: cpu@500 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -130,6 +136,7 @@ cpu6: cpu@600 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -141,6 +148,7 @@ cpu7: cpu@700 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -257,6 +265,12 @@ soc { + compatible = "simple-bus"; + ranges; + ++ performance: performance-controller@11bc10 { ++ compatible = "mediatek,cpufreq-hw"; ++ reg = <0 0x0011bc10 0 0x120>, <0 0x0011bd30 0 0x120>; ++ #performance-domain-cells = <1>; ++ }; ++ + gic: interrupt-controller@c000000 { + compatible = "arm,gic-v3"; + #interrupt-cells = <4>; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch b/queue-6.1/arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch new file mode 100644 index 00000000000..b5db1fd017b --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch @@ -0,0 +1,44 @@ +From d57f750c397c6de74d14a5e20f1c38e12bb60653 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 13:13:52 -0700 +Subject: arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to + kukui + +From: Douglas Anderson + +[ Upstream commit 42127f578ebde652d1373e0233356fbd351675c4 ] + +Firmware shipped on mt8183 Chromebooks is affected by the GICR +save/restore issue as described by the patch ("dt-bindings: +interrupt-controller: arm,gic-v3: Add quirk for Mediatek SoCs w/ +broken FW"). Add the quirk property. + +Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") +Reviewed-by: Julius Werner +Signed-off-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230515131353.v2.3.I525a2ed4260046d43c885ee1275e91707743df1c@changeid +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index b4b86bb1f1a7d..632fd89e75969 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -297,6 +297,10 @@ dsi_out: endpoint { + }; + }; + ++&gic { ++ mediatek,broken-save-restore-fw; ++}; ++ + &gpu { + mali-supply = <&mt6358_vgpu_reg>; + sram-supply = <&mt6358_vsram_gpu_reg>; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch b/queue-6.1/arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch new file mode 100644 index 00000000000..4d1cbe3e07e --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch @@ -0,0 +1,86 @@ +From 1597bc9ba1458c9ae161dc5bf89ef9db89f65e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 14:35:15 -0400 +Subject: arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit a4366b5695c984b8a3fc8b31de9e758c8f6d1aed ] + +The capacity-dmips-mhz parameter was miscalculated: this SoC runs +the first (Cortex-A55) cluster at a maximum of 2000MHz and the +second (Cortex-A76) cluster at a maximum of 2200MHz. + +In order to calculate the right capacity-dmips-mhz, the following +test was performed: +1. CPUFREQ governor was set to 'performance' on both clusters +2. Ran dhrystone with 500000000 iterations for 10 times on each cluster +3. Calculated the mean result for each cluster +4. Calculated DMIPS/MHz: dmips_mhz = dmips_per_second / cpu_mhz +5. Scaled results to 1024: + result_c0 = dmips_mhz_c0 / dmips_mhz_c1 * 1024 + +The mean results for this SoC are: +Cluster 0 (LITTLE): 12016411 Dhry/s +Cluster 1 (BIG): 31702034 Dhry/s + +The calculated scaled results are: +Cluster 0: 426.953226899238 (rounded to 427) +Cluster 1: 1024 + +Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230602183515.3778780-1-nfraprado@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index ff2310fe3f1d2..2f40c6cc407c1 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -65,7 +65,7 @@ cpu0: cpu@0 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu1: cpu@100 { +@@ -77,7 +77,7 @@ cpu1: cpu@100 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu2: cpu@200 { +@@ -89,7 +89,7 @@ cpu2: cpu@200 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu3: cpu@300 { +@@ -101,7 +101,7 @@ cpu3: cpu@300 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu4: cpu@400 { +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch b/queue-6.1/arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch new file mode 100644 index 00000000000..cc1e4189dd8 --- /dev/null +++ b/queue-6.1/arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch @@ -0,0 +1,74 @@ +From c211d70d46053045a58f8ae06d34e2edc94bbe89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 11:50:37 +0100 +Subject: arm64: dts: microchip: sparx5: do not use PSCI on reference boards + +From: Robert Marko + +[ Upstream commit 70be83708c925b3f72c508e4756e48ad2330c830 ] + +PSCI is not implemented on SparX-5 at all, there is no ATF and U-boot that +is shipped does not implement it as well. + +I have tried flashing the latest BSP 2022.12 U-boot which did not work. +After contacting Microchip, they confirmed that there is no ATF for the +SoC nor PSCI implementation which is unfortunate in 2023. + +So, disable PSCI as otherwise kernel crashes as soon as it tries probing +PSCI with, and the crash is only visible if earlycon is used. + +Since PSCI is not implemented, switch core bringup to use spin-tables +which are implemented in the vendor U-boot and actually work. + +Tested on PCB134 with eMMC (VSC5640EV). + +Fixes: 6694aee00a4b ("arm64: dts: sparx5: Add basic cpu support") +Signed-off-by: Robert Marko +Acked-by: Steen Hegelund +Link: https://lore.kernel.org/r/20230221105039.316819-1-robert.marko@sartura.hr +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/microchip/sparx5.dtsi | 2 +- + arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi | 12 ++++++++++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/microchip/sparx5.dtsi b/arch/arm64/boot/dts/microchip/sparx5.dtsi +index 2dd5e38820b16..088d89801c276 100644 +--- a/arch/arm64/boot/dts/microchip/sparx5.dtsi ++++ b/arch/arm64/boot/dts/microchip/sparx5.dtsi +@@ -61,7 +61,7 @@ arm-pmu { + interrupt-affinity = <&cpu0>, <&cpu1>; + }; + +- psci { ++ psci: psci { + compatible = "arm,psci-0.2"; + method = "smc"; + }; +diff --git a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi +index 9d1a082de3e29..32bb76b3202a0 100644 +--- a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi ++++ b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi +@@ -6,6 +6,18 @@ + /dts-v1/; + #include "sparx5.dtsi" + ++&psci { ++ status = "disabled"; ++}; ++ ++&cpu0 { ++ enable-method = "spin-table"; ++}; ++ ++&cpu1 { ++ enable-method = "spin-table"; ++}; ++ + &uart0 { + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch b/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch new file mode 100644 index 00000000000..0bc19b28a2a --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch @@ -0,0 +1,81 @@ +From ff66cfdf18274dab0d3343792fa4484cdbf1617e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:48:41 +0200 +Subject: arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion + +From: Stephan Gerhold + +[ Upstream commit 5500f823db38db073d30557af159b77fb1f2bf26 ] + +The 96Boards specification expects a 1.8V power rail on the low-speed +expansion connector that is able to provide at least 0.18W / 100 mA. +According to the DB410c hardware user manual this is done by connecting +both L15 and L16 in parallel with up to 55mA each (for 110 mA total) [1]. + +Unfortunately the current regulator setup in the DB410c device tree +does not implement the specification correctly and only provides 5 mA: + + - Only L15 is marked always-on, so L16 is never enabled. + - Without specifying a load the regulator is put into LPM where + it can only provide 5 mA. + +Fix this by: + + - Adding proper voltage constraints for L16. + - Making L16 always-on. + - Adding regulator-system-load for both L15 and L16. 100 mA should be + available in total, so specify 50 mA for each. (The regulator + hardware can only be in normal (55 mA) or low-power mode (5 mA) so + this will actually result in the expected 110 mA total...) + +[1]: https://www.96boards.org/documentation/consumer/dragonboard/dragonboard410c/hardware-docs/hardware-user-manual.md.html#power-supplies + +Cc: Srinivas Kandagatla +Fixes: 828dd5d66f0f ("arm64: dts: apq8016-sbc: make 1.8v available on LS expansion") +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-2-54d4960a05fc@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index c6f4ee7b82042..e3e90ad92cc59 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -527,19 +527,27 @@ l14 { + regulator-max-microvolt = <3300000>; + }; + +- /** +- * 1.8v required on LS expansion +- * for mezzanine boards ++ /* ++ * The 96Boards specification expects a 1.8V power rail on the low-speed ++ * expansion connector that is able to provide at least 0.18W / 100 mA. ++ * L15/L16 are connected in parallel to provide 55 mA each. A minimum load ++ * must be specified to ensure the regulators are not put in LPM where they ++ * would only provide 5 mA. + */ + l15 { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-system-load = <50000>; ++ regulator-allow-set-load; + regulator-always-on; + }; + + l16 { + regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <3300000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-system-load = <50000>; ++ regulator-allow-set-load; ++ regulator-always-on; + }; + + l17 { +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch b/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch new file mode 100644 index 00000000000..393ff0fcc2b --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch @@ -0,0 +1,186 @@ +From acb99861cdc5e77dcef8355419d022d031e555c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:48:40 +0200 +Subject: arm64: dts: qcom: apq8016-sbc: Fix regulator constraints + +From: Stephan Gerhold + +[ Upstream commit e27654df20d77ad7549a3cf6739ebaa3aa59a088 ] + +For some reason DB410c has completely bogus regulator constraints that +actually just correspond to the programmable voltages which are already +provided by the regulator driver. Some of them are not just outside the +recommended operating conditions of the APQ8016E SoC but even exceed +the absolute maximum ratings, potentially risking permanent device +damage. + +In practice it's not quite as dangerous thanks to the RPM firmware: +It turns out that it has its own voltage constraints and silently +clamps all regulator requests. For example, requesting 3.3V for L5 +(allowed by the current regulator constraints!) still results in 1.8V +being programmed in the actual regulator hardware. + +Experimentation with various voltages shows that the internal RPM +voltage constraints roughly correspond to the safe "specified range" +in the PM8916 Device Specification (rather than the "programmable +range" used inside apq8016-sbc.dtsi right now). + +Combine those together with some fixed voltages used in the old +msm-3.10 device tree from Qualcomm to give DB410c some actually valid +voltage constraints. + +Cc: Srinivas Kandagatla +Fixes: 4c7d53d16d77 ("arm64: dts: apq8016-sbc: add regulators support") +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-1-54d4960a05fc@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 64 ++++++++++++------------ + 1 file changed, 32 insertions(+), 32 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index 1b613098fb4a0..c6f4ee7b82042 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -448,21 +448,21 @@ &smd_rpm_regulators { + vdd_l7-supply = <&pm8916_s4>; + + s3 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1562000>; ++ regulator-min-microvolt = <1250000>; ++ regulator-max-microvolt = <1350000>; + }; + + s4 { +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; ++ regulator-min-microvolt = <1850000>; ++ regulator-max-microvolt = <2150000>; + + regulator-always-on; + regulator-boot-on; + }; + + l1 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1525000>; ++ regulator-min-microvolt = <1225000>; ++ regulator-max-microvolt = <1225000>; + }; + + l2 { +@@ -471,13 +471,13 @@ l2 { + }; + + l4 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2050000>; ++ regulator-max-microvolt = <2050000>; + }; + + l5 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + }; + + l6 { +@@ -486,45 +486,45 @@ l6 { + }; + + l7 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + }; + + l8 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2900000>; ++ regulator-max-microvolt = <2900000>; + }; + + l9 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + }; + + l10 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; + }; + + l11 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2950000>; ++ regulator-max-microvolt = <2950000>; + regulator-allow-set-load; + regulator-system-load = <200000>; + }; + + l12 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <2950000>; + }; + + l13 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <3075000>; ++ regulator-max-microvolt = <3075000>; + }; + + l14 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; + }; + + /** +@@ -532,14 +532,14 @@ l14 { + * for mezzanine boards + */ + l15 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + regulator-always-on; + }; + + l16 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; + }; + + l17 { +@@ -548,8 +548,8 @@ l17 { + }; + + l18 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2700000>; ++ regulator-max-microvolt = <2700000>; + }; + }; + +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch b/queue-6.1/arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch new file mode 100644 index 00000000000..52a94c442e1 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch @@ -0,0 +1,49 @@ +From 73ff330181473636ecbadc2803c3c4af19919945 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 19:45:16 +0200 +Subject: arm64: dts: qcom: apq8096: fix fixed regulator name property + +From: Krzysztof Kozlowski + +[ Upstream commit c77612a07d18d4425fd8ddd532a8a9b8e1970c53 ] + +Correct the typo in 'regulator-name' property. + + apq8096-ifc6640.dtb: v1p05-regulator: 'regulator-name' is a required property + apq8096-ifc6640.dtb: v1p05-regulator: Unevaluated properties are not allowed ('reglator-name' was unexpected) + +Fixes: 6cbdec2d3ca6 ("arm64: dts: qcom: msm8996: Introduce IFC6640") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230507174516.264936-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts +index 92f264891d84b..9b20c1a47a186 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts +@@ -26,7 +26,7 @@ chosen { + + v1p05: v1p05-regulator { + compatible = "regulator-fixed"; +- reglator-name = "v1p05"; ++ regulator-name = "v1p05"; + regulator-always-on; + regulator-boot-on; + +@@ -38,7 +38,7 @@ v1p05: v1p05-regulator { + + v12_poe: v12-poe-regulator { + compatible = "regulator-fixed"; +- reglator-name = "v12_poe"; ++ regulator-name = "v12_poe"; + regulator-always-on; + regulator-boot-on; + +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-msm8916-correct-camss-unit-address.patch b/queue-6.1/arm64-dts-qcom-msm8916-correct-camss-unit-address.patch new file mode 100644 index 00000000000..3aa23777aa0 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8916-correct-camss-unit-address.patch @@ -0,0 +1,39 @@ +From 06e6bc63dd272c4bd9761ec24c22eeb129ba381f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:40 +0200 +Subject: arm64: dts: qcom: msm8916: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit 48798d992ce276cf0d57bf75318daf8eabd02aa4 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc@0/camss@1b00000: simple-bus unit address format error, expected "1b0ac00" + +Fixes: 58f479f90a7c ("arm64: dts: qcom: msm8916: Add CAMSS support") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 9743cb270639d..99aa9b4dce8aa 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1088,7 +1088,7 @@ dsi_phy0: dsi-phy@1a98300 { + }; + }; + +- camss: camss@1b00000 { ++ camss: camss@1b0ac00 { + compatible = "qcom,msm8916-camss"; + reg = <0x01b0ac00 0x200>, + <0x01b00030 0x4>, +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-msm8916-correct-mmc-unit-address.patch b/queue-6.1/arm64-dts-qcom-msm8916-correct-mmc-unit-address.patch new file mode 100644 index 00000000000..3d246f138e6 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8916-correct-mmc-unit-address.patch @@ -0,0 +1,49 @@ +From 31d06b637645ef8530df262a7071e7baffeac30a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:41 +0200 +Subject: arm64: dts: qcom: msm8916: correct MMC unit address + +From: Krzysztof Kozlowski + +[ Upstream commit 72644bc76d5145c098c268829554a0b98fab1de1 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc@0/mmc@7824000: simple-bus unit address format error, expected "7824900" + Warning (simple_bus_reg): /soc@0/mmc@7864000: simple-bus unit address format error, expected "7864900" + +Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nodes") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 99aa9b4dce8aa..f84b3c1a03c53 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1480,7 +1480,7 @@ lpass_codec: audio-codec@771c000 { + #sound-dai-cells = <1>; + }; + +- sdhc_1: mmc@7824000 { ++ sdhc_1: mmc@7824900 { + compatible = "qcom,msm8916-sdhci", "qcom,sdhci-msm-v4"; + reg = <0x07824900 0x11c>, <0x07824000 0x800>; + reg-names = "hc", "core"; +@@ -1498,7 +1498,7 @@ sdhc_1: mmc@7824000 { + status = "disabled"; + }; + +- sdhc_2: mmc@7864000 { ++ sdhc_2: mmc@7864900 { + compatible = "qcom,msm8916-sdhci", "qcom,sdhci-msm-v4"; + reg = <0x07864900 0x11c>, <0x07864000 0x800>; + reg-names = "hc", "core"; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch b/queue-6.1/arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch new file mode 100644 index 00000000000..03dfd45dab0 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch @@ -0,0 +1,39 @@ +From 7bfdb90a9013c82af2114320013ffcc86230f642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:46 +0200 +Subject: arm64: dts: qcom: msm8994: correct SPMI unit address + +From: Krzysztof Kozlowski + +[ Upstream commit 24f0f6a8059c7108d4ee3476c95db1e7ff4feb79 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc/spmi@fc4c0000: simple-bus unit address format error, expected "fc4cf000" + +Fixes: b0ad598f8ec0 ("arm64: dts: qcom: msm8994: Add SPMI PMIC arbiter device") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-8-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 7ed59e698c14d..3c6c2cf99fb9d 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -746,7 +746,7 @@ restart@fc4ab000 { + reg = <0xfc4ab000 0x4>; + }; + +- spmi_bus: spmi@fc4c0000 { ++ spmi_bus: spmi@fc4cf000 { + compatible = "qcom,spmi-pmic-arb"; + reg = <0xfc4cf000 0x1000>, + <0xfc4cb000 0x1000>, +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-msm8996-correct-camss-unit-address.patch b/queue-6.1/arm64-dts-qcom-msm8996-correct-camss-unit-address.patch new file mode 100644 index 00000000000..aebd6143809 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8996-correct-camss-unit-address.patch @@ -0,0 +1,39 @@ +From 85ccf2bee59de19ae9eecee4f10dda3b3f060333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:47 +0200 +Subject: arm64: dts: qcom: msm8996: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit e959ced1d0e5ef0b1f66a0c2d0e1ae80790e5ca5 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc/camss@a00000: simple-bus unit address format error, expected "a34000" + +Fixes: e0531312e78f ("arm64: dts: qcom: msm8996: Add CAMSS support") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-9-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 9f89100542018..9d6ec59d1cd3a 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2045,7 +2045,7 @@ ufsphy_lane: phy@627400 { + }; + }; + +- camss: camss@a00000 { ++ camss: camss@a34000 { + compatible = "qcom,msm8996-camss"; + reg = <0x00a34000 0x1000>, + <0x00a00030 0x4>, +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-pm7250b-add-missing-spmi-vadc-include.patch b/queue-6.1/arm64-dts-qcom-pm7250b-add-missing-spmi-vadc-include.patch new file mode 100644 index 00000000000..e78a2f9da49 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pm7250b-add-missing-spmi-vadc-include.patch @@ -0,0 +1,36 @@ +From a9e46346b5a192c553776e0118319712b44033e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 09:45:44 +0200 +Subject: arm64: dts: qcom: pm7250b: add missing spmi-vadc include + +From: Luca Weiss + +[ Upstream commit 83022f6484b11a60dbf9a95a88c7ef8e59c4b19c ] + +This file is using definitions from the spmi-vadc header, so we need to +include it. + +Fixes: 11975b9b8135 ("arm64: dts: qcom: Add pm7250b PMIC") +Signed-off-by: Luca Weiss +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230407-pm7250b-sid-v1-1-fc648478cc25@fairphone.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm7250b.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/pm7250b.dtsi b/arch/arm64/boot/dts/qcom/pm7250b.dtsi +index 61f7a63451505..694fe912536e8 100644 +--- a/arch/arm64/boot/dts/qcom/pm7250b.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm7250b.dtsi +@@ -3,6 +3,7 @@ + * Copyright (C) 2022 Luca Weiss + */ + ++#include + #include + #include + +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sdm630-correct-camss-unit-address.patch b/queue-6.1/arm64-dts-qcom-sdm630-correct-camss-unit-address.patch new file mode 100644 index 00000000000..c57788f5ba2 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm630-correct-camss-unit-address.patch @@ -0,0 +1,40 @@ +From 30dbb35cb9d1fb0cf56998baa916d46c43e8cc74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:48 +0200 +Subject: arm64: dts: qcom: sdm630: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit c8b7faa7e9913a94444b3f00b6480e53a174fcfd ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc/camss@ca00000: simple-bus unit address format error, expected "ca00020" + +Fixes: f3d5d3cc6971 ("arm64: dts: qcom: sdm630: Configure the camera subsystem") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-10-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm630.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi +index e119060ac56cb..2430549265d3f 100644 +--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi +@@ -1902,7 +1902,7 @@ pil-reloc@94c { + }; + }; + +- camss: camss@ca00000 { ++ camss: camss@ca00020 { + compatible = "qcom,sdm660-camss"; + reg = <0x0ca00020 0x10>, + <0x0ca30000 0x100>, +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-correct-camss-unit-address.patch b/queue-6.1/arm64-dts-qcom-sdm845-correct-camss-unit-address.patch new file mode 100644 index 00000000000..29072d2b019 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-correct-camss-unit-address.patch @@ -0,0 +1,39 @@ +From 93eb46a0fe6924607e3749bc034bb4bc01d9df52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:49 +0200 +Subject: arm64: dts: qcom: sdm845: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit a05b913a27e46926ba60ba2bcacc7ec7a8403e4c ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc@0/camss@a00000: simple-bus unit address format error, expected "acb3000" + +Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-11-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index a99eda4971010..6f4cc3329400c 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -4207,7 +4207,7 @@ videocc: clock-controller@ab00000 { + #reset-cells = <1>; + }; + +- camss: camss@a00000 { ++ camss: camss@acb3000 { + compatible = "qcom,sdm845-camss"; + + reg = <0 0xacb3000 0 0x1000>, +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-flush-rsc-sleep-wake-votes.patch b/queue-6.1/arm64-dts-qcom-sdm845-flush-rsc-sleep-wake-votes.patch new file mode 100644 index 00000000000..d4812da9b4a --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-flush-rsc-sleep-wake-votes.patch @@ -0,0 +1,40 @@ +From 85778135df962e1f9f036c4d6b53ad95f968ec46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 15:22:40 +0200 +Subject: arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes + +From: Konrad Dybcio + +[ Upstream commit 91e83140b5dd5598fbcfada3ee1f8b2b410c3731 ] + +The rpmh driver will cache sleep and wake votes until the cluster +power-domain is about to enter idle, to avoid unnecessary writes. So +associate the apps_rsc with the cluster pd, so that it can be notified +about this event. + +Without this, only AMC votes are being commited. + +Fixes: c83545d95376 ("arm64: dts: sdm845: Add rpmh-rsc node") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230531-topic-rsc-v1-6-b4a985f57b8b@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 6f4cc3329400c..b7ba70857d0ad 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -5043,6 +5043,7 @@ apps_rsc: rsc@179c0000 { + , + , + ; ++ power-domains = <&CLUSTER_PD>; + + apps_bcm_voter: bcm-voter { + compatible = "qcom,bcm-voter"; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-polaris-add-missing-touchscree.patch b/queue-6.1/arm64-dts-qcom-sdm845-polaris-add-missing-touchscree.patch new file mode 100644 index 00000000000..9a70b787365 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-polaris-add-missing-touchscree.patch @@ -0,0 +1,40 @@ +From e1092e87be8273dbe05ca2691ed72da4b4f12df8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:56 +0200 +Subject: arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node + reg + +From: Krzysztof Kozlowski + +[ Upstream commit 4a0156b8862665a3e31c8280607388e3001ace3d ] + +Add missing reg property to touchscreen child node to fix dtbs W=1 warnings: + + Warning (unit_address_vs_reg): /soc@0/geniqup@ac0000/i2c@a98000/touchscreen@20/rmi4-f12@12: node has a unit name, but no reg or ranges property + +Fixes: be497abe19bf ("arm64: dts: qcom: Add support for Xiaomi Mi Mix2s") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Molly Sophia +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-18-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +index 74c6832e05985..093b04359ec39 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +@@ -484,6 +484,7 @@ rmi4-f01@1 { + }; + + rmi4-f12@12 { ++ reg = <0x12>; + syna,rezero-wait-ms = <0xc8>; + syna,clip-x-high = <0x438>; + syna,clip-y-high = <0x870>; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch b/queue-6.1/arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch new file mode 100644 index 00000000000..86881962a3e --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch @@ -0,0 +1,52 @@ +From 45f5daf5f8dac9d1dcb5fedcac1f671e2b190fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 23:14:18 +0200 +Subject: arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k + +From: Marijn Suijten + +[ Upstream commit 223ce29c8b7e5b00f01a68387aabeefd77d97f06 ] + +The framebuffer configuration for edo pdx203, written in edo dtsi (which +is overwritten in pdx206 dts for its smaller panel) has to use a +1096x2560 configuration as this is what the panel (and framebuffer area) +has been initialized to. Downstream userspace also has access to (and +uses) this 2.5k mode by default, and only switches the panel to 4k when +requested. + +This is similar to commit be8de06dc397 ("arm64: dts: qcom: +sm8150-kumano: Panel framebuffer is 2.5k instead of 4k") which fixed the +same for the previous generation Sony platform. + +Fixes: 69cdb97ef652 ("arm64: dts: qcom: sm8250: Add support for SONY Xperia 1 II / 5 II (Edo platform)") +Signed-off-by: Marijn Suijten +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230606211418.587676-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +index e4769dcfaad7b..390b90a8ddf70 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +@@ -26,9 +26,10 @@ chosen { + framebuffer: framebuffer@9c000000 { + compatible = "simple-framebuffer"; + reg = <0 0x9c000000 0 0x2300000>; +- width = <1644>; +- height = <3840>; +- stride = <(1644 * 4)>; ++ /* pdx203 BL initializes in 2.5k mode, not 4k */ ++ width = <1096>; ++ height = <2560>; ++ stride = <(1096 * 4)>; + format = "a8r8g8b8"; + /* + * That's a lot of clocks, but it's necessary due +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sm8350-add-gpi-dma-compatible-fallbac.patch b/queue-6.1/arm64-dts-qcom-sm8350-add-gpi-dma-compatible-fallbac.patch new file mode 100644 index 00000000000..486e09482d1 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8350-add-gpi-dma-compatible-fallbac.patch @@ -0,0 +1,56 @@ +From 3d43c709861dd258a485244d6bf6458bb8cd2b1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 19:03:51 -0400 +Subject: arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback + +From: Krzysztof Kozlowski + +[ Upstream commit b561e225dee5412609fd98340ca71ba0ab2e4b36 ] + +Use SM6350 as fallback for GPI DMA, to indicate devices are compatible +and that drivers can bind with only one compatible. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221018230352.1238479-5-krzysztof.kozlowski@linaro.org +Stable-dep-of: 41d6bca799b3 ("arm64: dts: qcom: sm8350: correct DMA controller unit address") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index ca7c428a741d4..9430166ee45b5 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -678,7 +678,7 @@ ipcc: mailbox@408000 { + }; + + gpi_dma2: dma-controller@800000 { +- compatible = "qcom,sm8350-gpi-dma"; ++ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma"; + reg = <0 0x00800000 0 0x60000>; + interrupts = , + , +@@ -904,7 +904,7 @@ spi19: spi@894000 { + }; + + gpi_dma0: dma-controller@900000 { +- compatible = "qcom,sm8350-gpi-dma"; ++ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma"; + reg = <0 0x09800000 0 0x60000>; + interrupts = , + , +@@ -1207,7 +1207,7 @@ spi7: spi@99c000 { + }; + + gpi_dma1: dma-controller@a00000 { +- compatible = "qcom,sm8350-gpi-dma"; ++ compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma"; + reg = <0 0x00a00000 0 0x60000>; + interrupts = , + , +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sm8350-correct-dma-controller-unit-ad.patch b/queue-6.1/arm64-dts-qcom-sm8350-correct-dma-controller-unit-ad.patch new file mode 100644 index 00000000000..d55b25a0ba9 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8350-correct-dma-controller-unit-ad.patch @@ -0,0 +1,39 @@ +From cf31eb7e74a5d645f46b0aa3231e6a287c453c81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:51 +0200 +Subject: arm64: dts: qcom: sm8350: correct DMA controller unit address + +From: Krzysztof Kozlowski + +[ Upstream commit 41d6bca799b3f40d4d3c22dd4545aeac7c210e33 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc@0/dma-controller@900000: simple-bus unit address format error, expected "9800000" + +Fixes: bc08fbf49bc8 ("arm64: dts: qcom: sm8350: Define GPI DMA engines") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-13-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 9430166ee45b5..7fd1c3f71c0f8 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -903,7 +903,7 @@ spi19: spi@894000 { + }; + }; + +- gpi_dma0: dma-controller@900000 { ++ gpi_dma0: dma-controller@9800000 { + compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma"; + reg = <0 0x09800000 0 0x60000>; + interrupts = , +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch b/queue-6.1/arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch new file mode 100644 index 00000000000..abeeafea396 --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch @@ -0,0 +1,46 @@ +From 9a465833b8c1db890f1252bf9bb608c929c10cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 10:48:22 +0200 +Subject: arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 + +From: Wolfram Sang + +[ Upstream commit 1a2c4e5635177939a088d22fa35c6a7032725663 ] + +The schematics are misleading, the flow control is for HSCIF1. We need +SCIF1 for GNSS/GPS which does not use flow control. + +Fixes: c6c816e22bc8 ("arm64: dts: ulcb-kf: enable SCIF1") +Signed-off-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230525084823.4195-2-wsa+renesas@sang-engineering.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +index 408871c2859d1..588b14b66b6fb 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +@@ -393,7 +393,7 @@ hscif0_pins: hscif0 { + }; + + scif1_pins: scif1 { +- groups = "scif1_data_b", "scif1_ctrl"; ++ groups = "scif1_data_b"; + function = "scif1"; + }; + +@@ -447,7 +447,6 @@ rsnd_for_pcm3168a_capture: endpoint { + &scif1 { + pinctrl-0 = <&scif1_pins>; + pinctrl-names = "default"; +- uart-has-rtscts; + + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch b/queue-6.1/arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch new file mode 100644 index 00000000000..773d0cb4b5f --- /dev/null +++ b/queue-6.1/arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch @@ -0,0 +1,83 @@ +From 3460a27971ce5f11d5d5fe6f53259ef73532e078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 09:30:06 +0530 +Subject: arm64: dts: ti: k3-j7200: Fix physical address of pin + +From: Keerthy + +[ Upstream commit 3d011933000ed9054c649952d83162d24f020a93 ] + +wkup_pmx splits into multiple regions. Like + + wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12) + wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15) + wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84) + wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100) + +With this split, pin offset needs to be adjusted to +match with new pmx for all pins above wkup_pmx0. + +Example a pin under wkup_pmx1 should start from 0 instead of +old offset(0x38 WKUP_PADCONFIG 14 offset) + +J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) : +https://www.ti.com/lit/ds/symlink/dra821u.pdf + +Fixes: 9ae21ac445e9 ("arm64: dts: ti: k3-j7200: Fix wakeup pinmux range") + +Signed-off-by: Keerthy +Signed-off-by: Udit Kumar +Link: https://lore.kernel.org/r/20230419040007.3022780-2-u-kumar1@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + .../dts/ti/k3-j7200-common-proc-board.dts | 28 +++++++++---------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index 50009f963a324..5840063f61293 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -83,25 +83,25 @@ vdd_sd_dv: gpio-regulator-TLV71033 { + &wkup_pmx2 { + mcu_cpsw_pins_default: mcu-cpsw-pins-default { + pinctrl-single,pins = < +- J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ +- J721E_WKUP_IOPAD(0x006c, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */ +- J721E_WKUP_IOPAD(0x0070, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */ +- J721E_WKUP_IOPAD(0x0074, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */ +- J721E_WKUP_IOPAD(0x0078, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */ +- J721E_WKUP_IOPAD(0x007c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */ +- J721E_WKUP_IOPAD(0x0088, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */ +- J721E_WKUP_IOPAD(0x008c, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */ +- J721E_WKUP_IOPAD(0x0090, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */ +- J721E_WKUP_IOPAD(0x0094, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */ +- J721E_WKUP_IOPAD(0x0080, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */ +- J721E_WKUP_IOPAD(0x0084, PIN_INPUT, 0) /* MCU_RGMII1_RXC */ ++ J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ ++ J721E_WKUP_IOPAD(0x0004, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */ ++ J721E_WKUP_IOPAD(0x0008, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */ ++ J721E_WKUP_IOPAD(0x000c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */ ++ J721E_WKUP_IOPAD(0x0010, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */ ++ J721E_WKUP_IOPAD(0x0014, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */ ++ J721E_WKUP_IOPAD(0x0020, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */ ++ J721E_WKUP_IOPAD(0x0024, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */ ++ J721E_WKUP_IOPAD(0x0028, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */ ++ J721E_WKUP_IOPAD(0x002c, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */ ++ J721E_WKUP_IOPAD(0x0018, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */ ++ J721E_WKUP_IOPAD(0x001c, PIN_INPUT, 0) /* MCU_RGMII1_RXC */ + >; + }; + + mcu_mdio_pins_default: mcu-mdio1-pins-default { + pinctrl-single,pins = < +- J721E_WKUP_IOPAD(0x009c, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */ +- J721E_WKUP_IOPAD(0x0098, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */ ++ J721E_WKUP_IOPAD(0x0034, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */ ++ J721E_WKUP_IOPAD(0x0030, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */ + >; + }; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch b/queue-6.1/arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch new file mode 100644 index 00000000000..d4fdc44043f --- /dev/null +++ b/queue-6.1/arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch @@ -0,0 +1,76 @@ +From b752e6d11f6c90a78f4fb42c8637de569ff23377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 16:56:05 +0100 +Subject: arm64: sme: Use STR P to clear FFR context field in streaming SVE + mode + +From: Will Deacon + +[ Upstream commit 893b24181b4c4bf1fa2841b1ed192e5413a97cb1 ] + +The FFR is a predicate register which can vary between 16 and 256 bits +in size depending upon the configured vector length. When saving the +SVE state in streaming SVE mode, the FFR register is inaccessible and +so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply +clears the FFR field of the in-memory context structure. Unfortunately, +it achieves this using an unconditional 8-byte store and so if the SME +vector length is anything other than 64 bytes in size we will either +fail to clear the entire field or, worse, we will corrupt memory +immediately following the structure. This has led to intermittent kfence +splats in CI [1] and can trigger kmalloc Redzone corruption messages +when running the 'fp-stress' kselftest: + + | ============================================================================= + | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten + | ----------------------------------------------------------------------------- + | + | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc + | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531 + | __kmalloc+0x8c/0xcc + | do_sme_acc+0x9c/0x220 + | ... + +Replace the 8-byte store with a store of a predicate register which has +been zero-initialised with PFALSE, ensuring that the entire field is +cleared in memory. + +[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com + +Cc: Mark Brown +Cc: Mark Rutland +Cc: Naresh Kamboju +Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional") +Reported-by: Linux Kernel Functional Testing +Signed-off-by: Will Deacon +Reviewed-by: Mark Brown +Tested-by: Anders Roxell +Link: https://lore.kernel.org/r/20230628155605.22296-1-will@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/fpsimdmacros.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/include/asm/fpsimdmacros.h b/arch/arm64/include/asm/fpsimdmacros.h +index 5e0910cf48321..696d247cf8fb0 100644 +--- a/arch/arm64/include/asm/fpsimdmacros.h ++++ b/arch/arm64/include/asm/fpsimdmacros.h +@@ -294,12 +294,12 @@ + _for n, 0, 15, _sve_str_p \n, \nxbase, \n - 16 + cbz \save_ffr, 921f + _sve_rdffr 0 +- _sve_str_p 0, \nxbase +- _sve_ldr_p 0, \nxbase, -16 + b 922f + 921: +- str xzr, [x\nxbase] // Zero out FFR ++ _sve_pfalse 0 // Zero out FFR + 922: ++ _sve_str_p 0, \nxbase ++ _sve_ldr_p 0, \nxbase, -16 + mrs x\nxtmp, fpsr + str w\nxtmp, [\xpfpsr] + mrs x\nxtmp, fpcr +-- +2.39.2 + diff --git a/queue-6.1/asoc-amd-acp-clear-pdm-dma-interrupt-mask.patch b/queue-6.1/asoc-amd-acp-clear-pdm-dma-interrupt-mask.patch new file mode 100644 index 00000000000..f421cc4eee9 --- /dev/null +++ b/queue-6.1/asoc-amd-acp-clear-pdm-dma-interrupt-mask.patch @@ -0,0 +1,38 @@ +From e2d08ca2c97c25df31485d1a9d89e3d885858319 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 20:53:38 +0530 +Subject: ASoC: amd: acp: clear pdm dma interrupt mask + +From: Syed Saba Kareem + +[ Upstream commit ad60672394bd1f95c58d3d9336902f47e05126fc ] + +Clear pdm dma interrupt mask in acp_dmic_shutdown(). + +'Fixes: c32bd332ce5c9 ("ASoC: amd: acp: Add generic support for +PDM controller on ACP")' + +Signed-off-by: Syed Saba Kareem +Link: https://lore.kernel.org/r/Message-Id: <20230622152406.3709231-1-Syed.SabaKareem@amd.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-pdm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/acp-pdm.c b/sound/soc/amd/acp/acp-pdm.c +index 66ec6b6a59723..f8030b79ac17c 100644 +--- a/sound/soc/amd/acp/acp-pdm.c ++++ b/sound/soc/amd/acp/acp-pdm.c +@@ -176,7 +176,7 @@ static void acp_dmic_dai_shutdown(struct snd_pcm_substream *substream, + + /* Disable DMIC interrupts */ + ext_int_ctrl = readl(ACP_EXTERNAL_INTR_CNTL(adata, 0)); +- ext_int_ctrl |= ~PDM_DMA_INTR_MASK; ++ ext_int_ctrl &= ~PDM_DMA_INTR_MASK; + writel(ext_int_ctrl, ACP_EXTERNAL_INTR_CNTL(adata, 0)); + } + +-- +2.39.2 + diff --git a/queue-6.1/asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch b/queue-6.1/asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch new file mode 100644 index 00000000000..560ccfc5e27 --- /dev/null +++ b/queue-6.1/asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch @@ -0,0 +1,91 @@ +From 85501fab874392b62b95596c551b034e10b8ef80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 21:11:39 +0300 +Subject: ASoC: es8316: Do not set rate constraints for unsupported MCLKs + +From: Cristian Ciocaltea + +[ Upstream commit 60413129ee2b38a80347489270af7f6e1c1de4d0 ] + +When using the codec through the generic audio graph card, there are at +least two calls of es8316_set_dai_sysclk(), with the effect of limiting +the allowed sample rates according to the MCLK/LRCK ratios supported by +the codec: + +1. During audio card setup, to set the initial MCLK - see + asoc_simple_init_dai(). + +2. Before opening a stream, to update MCLK, according to the stream + sample rate and the multiplication factor - see + asoc_simple_hw_params(). + +In some cases the initial MCLK might be set to a frequency that doesn't +match any of the supported ratios, e.g. 12287999 instead of 12288000, +which is only 1 Hz below the supported clock, as that is what the +hardware reports. This creates an empty list of rate constraints, which +is further passed to snd_pcm_hw_constraint_list() via +es8316_pcm_startup(), and causes the following error on the very first +access of the sound card: + + $ speaker-test -D hw:Analog,0 -F S16_LE -c 2 -t wav + Broken configuration for playback: no configurations available: Invalid argument + Setting of hwparams failed: Invalid argument + +Note that all subsequent retries succeed thanks to the updated MCLK set +at point 2 above, which uses a computed frequency value instead of a +reading from the hardware registers. Normally this would have mitigated +the issue, but es8316_pcm_startup() executes before the 2nd call to +es8316_set_dai_sysclk(), hence it cannot make use of the updated +constraints. + +Since es8316_pcm_hw_params() performs anyway a final validation of MCLK +against the stream sample rate and the supported MCLK/LRCK ratios, fix +the issue by ensuring that sysclk_constraints list is only set when at +least one supported sample rate is autodetected by the codec. + +Fixes: b8b88b70875a ("ASoC: add es8316 codec driver") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20230530181140.483936-3-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 2bfcd9af39172..87775378362e7 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -369,13 +369,11 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, + int count = 0; + + es8316->sysclk = freq; ++ es8316->sysclk_constraints.list = NULL; ++ es8316->sysclk_constraints.count = 0; + +- if (freq == 0) { +- es8316->sysclk_constraints.list = NULL; +- es8316->sysclk_constraints.count = 0; +- ++ if (freq == 0) + return 0; +- } + + ret = clk_set_rate(es8316->mclk, freq); + if (ret) +@@ -391,8 +389,10 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, + es8316->allowed_rates[count++] = freq / ratio; + } + +- es8316->sysclk_constraints.list = es8316->allowed_rates; +- es8316->sysclk_constraints.count = count; ++ if (count) { ++ es8316->sysclk_constraints.list = es8316->allowed_rates; ++ es8316->sysclk_constraints.count = count; ++ } + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/asoc-es8316-increment-max-value-for-alc-capture-targ.patch b/queue-6.1/asoc-es8316-increment-max-value-for-alc-capture-targ.patch new file mode 100644 index 00000000000..f1009b1d8fe --- /dev/null +++ b/queue-6.1/asoc-es8316-increment-max-value-for-alc-capture-targ.patch @@ -0,0 +1,91 @@ +From eee46e08350ec173ee511b260a861f3a786310d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 21:11:38 +0300 +Subject: ASoC: es8316: Increment max value for ALC Capture Target Volume + control + +From: Cristian Ciocaltea + +[ Upstream commit 6f073429037cd79d7311cd8236311c53f5ea8f01 ] + +The following error occurs when trying to restore a previously saved +ALSA mixer state (tested on a Rock 5B board): + + $ alsactl --no-ucm -f /tmp/asound.state store hw:Analog + $ alsactl --no-ucm -I -f /tmp/asound.state restore hw:Analog + alsactl: set_control:1475: Cannot write control '2:0:0:ALC Capture Target Volume:0' : Invalid argument + +According to ES8316 datasheet, the register at address 0x2B, which is +related to the above mixer control, contains by default the value 0xB0. +Considering the corresponding ALC target bits (ALCLVL) are 7:4, the +control is initialized with 11, which is one step above the maximum +value allowed by the driver: + + ALCLVL | dB gain + -------+-------- + 0000 | -16.5 + 0001 | -15.0 + 0010 | -13.5 + .... | ..... + 0111 | -6.0 + 1000 | -4.5 + 1001 | -3.0 + 1010 | -1.5 + .... | ..... + 1111 | -1.5 + +The tests performed using the VU meter feature (--vumeter=TYPE) of +arecord/aplay confirm the specs are correct and there is no measured +gain if the 1011-1111 range would have been mapped to 0 dB: + + dB gain | VU meter % + --------+----------- + -6.0 | 30-31 + -4.5 | 35-36 + -3.0 | 42-43 + -1.5 | 50-51 + 0.0 | 50-51 + +Increment the max value allowed for ALC Capture Target Volume control, +so that it matches the hardware default. Additionally, update the +related TLV to prevent an artificial extension of the dB gain range. + +Fixes: b8b88b70875a ("ASoC: add es8316 codec driver") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20230530181140.483936-2-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index f7d7a9c91e04c..2bfcd9af39172 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -52,7 +52,12 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0); +-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0); ++ ++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(alc_target_tlv, ++ 0, 10, TLV_DB_SCALE_ITEM(-1650, 150, 0), ++ 11, 11, TLV_DB_SCALE_ITEM(-150, 0, 0), ++); ++ + static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv, + 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0), + 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0), +@@ -115,7 +120,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = { + alc_max_gain_tlv), + SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0, + alc_min_gain_tlv), +- SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0, ++ SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 11, 0, + alc_target_tlv), + SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0), + SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0), +-- +2.39.2 + diff --git a/queue-6.1/asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch b/queue-6.1/asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch new file mode 100644 index 00000000000..28a86873ffb --- /dev/null +++ b/queue-6.1/asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch @@ -0,0 +1,66 @@ +From fe0e9c6bc81a4454792105925508fc5573549707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 15:15:09 +0300 +Subject: ASoC: imx-audmix: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 2f76e1d6ca524a888d29aafe29f2ad2003857971 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: b86ef5367761 ("ASoC: fsl: Add Audio Mixer machine driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230614121509.443926-1-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-audmix.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/fsl/imx-audmix.c b/sound/soc/fsl/imx-audmix.c +index 1292a845c4244..d8e99b263ab21 100644 +--- a/sound/soc/fsl/imx-audmix.c ++++ b/sound/soc/fsl/imx-audmix.c +@@ -228,6 +228,8 @@ static int imx_audmix_probe(struct platform_device *pdev) + + dai_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%s", + fe_name_pref, args.np->full_name + 1); ++ if (!dai_name) ++ return -ENOMEM; + + dev_info(pdev->dev.parent, "DAI FE name:%s\n", dai_name); + +@@ -236,6 +238,8 @@ static int imx_audmix_probe(struct platform_device *pdev) + capture_dai_name = + devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s", + dai_name, "CPU-Capture"); ++ if (!capture_dai_name) ++ return -ENOMEM; + } + + priv->dai[i].cpus = &dlc[0]; +@@ -266,6 +270,8 @@ static int imx_audmix_probe(struct platform_device *pdev) + "AUDMIX-Playback-%d", i); + be_cp = devm_kasprintf(&pdev->dev, GFP_KERNEL, + "AUDMIX-Capture-%d", i); ++ if (!be_name || !be_pb || !be_cp) ++ return -ENOMEM; + + priv->dai[num_dai + i].cpus = &dlc[3]; + priv->dai[num_dai + i].codecs = &dlc[4]; +@@ -293,6 +299,9 @@ static int imx_audmix_probe(struct platform_device *pdev) + priv->dapm_routes[i].source = + devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s", + dai_name, "CPU-Playback"); ++ if (!priv->dapm_routes[i].source) ++ return -ENOMEM; ++ + priv->dapm_routes[i].sink = be_pb; + priv->dapm_routes[num_dai + i].source = be_pb; + priv->dapm_routes[num_dai + i].sink = be_cp; +-- +2.39.2 + diff --git a/queue-6.1/asoc-intel-sof_sdw-remove-sof_sdw_tgl_hdmi-for-meteo.patch b/queue-6.1/asoc-intel-sof_sdw-remove-sof_sdw_tgl_hdmi-for-meteo.patch new file mode 100644 index 00000000000..3b03d7cfbca --- /dev/null +++ b/queue-6.1/asoc-intel-sof_sdw-remove-sof_sdw_tgl_hdmi-for-meteo.patch @@ -0,0 +1,38 @@ +From 3dad8bff59547ec634b3dfdbdfd1ee74bc6cd690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 12:32:59 -0500 +Subject: ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices + +From: Bard Liao + +[ Upstream commit 0db94947c9d3da16aa31d152b7d26fab78b02cb9 ] + +Topologies support three HDMI links on MeteorLake devices only. + +Fixes: 18489174e4fb ("ASoC: intel: sof_sdw: add RT711 SDCA card for MTL platform") +Signed-off-by: Bard Liao +--- + sound/soc/intel/boards/sof_sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index d4f92bb5e29f8..a37c85d301471 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -372,7 +372,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + .matches = { + DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_mtlrvp"), + }, +- .driver_data = (void *)(RT711_JD1 | SOF_SDW_TGL_HDMI), ++ .driver_data = (void *)(RT711_JD1), + }, + {} + }; +-- +2.39.2 + diff --git a/queue-6.1/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch b/queue-6.1/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch new file mode 100644 index 00000000000..f22bc81f22a --- /dev/null +++ b/queue-6.1/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch @@ -0,0 +1,150 @@ +From 6fd31c923cd18d2425b3e6da138e13c2c349f571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 17:19:04 +0800 +Subject: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost + +From: Li Nan + +[ Upstream commit 8d211554679d0b23702bd32ba04aeac0c1c4f660 ] + +adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled +when unlock. DEADLOCK might happen if we have held other locks and disabled +IRQ before invoking it. + +Fix it by using spin_lock_irqsave() instead, which can keep IRQ state +consistent with before when unlock. + + ================================ + WARNING: inconsistent lock state + 5.10.0-02758-g8e5f91fd772f #26 Not tainted + -------------------------------- + inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. + kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes: + ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq + ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 + {IN-HARDIRQ-W} state was registered at: + __lock_acquire+0x3d7/0x1070 + lock_acquire+0x197/0x4a0 + __raw_spin_lock_irqsave + _raw_spin_lock_irqsave+0x3b/0x60 + bfq_idle_slice_timer_body + bfq_idle_slice_timer+0x53/0x1d0 + __run_hrtimer+0x477/0xa70 + __hrtimer_run_queues+0x1c6/0x2d0 + hrtimer_interrupt+0x302/0x9e0 + local_apic_timer_interrupt + __sysvec_apic_timer_interrupt+0xfd/0x420 + run_sysvec_on_irqstack_cond + sysvec_apic_timer_interrupt+0x46/0xa0 + asm_sysvec_apic_timer_interrupt+0x12/0x20 + irq event stamp: 837522 + hardirqs last enabled at (837521): [] __raw_spin_unlock_irqrestore + hardirqs last enabled at (837521): [] _raw_spin_unlock_irqrestore+0x3d/0x40 + hardirqs last disabled at (837522): [] __raw_spin_lock_irq + hardirqs last disabled at (837522): [] _raw_spin_lock_irq+0x43/0x50 + softirqs last enabled at (835852): [] __do_softirq+0x558/0x8ec + softirqs last disabled at (835845): [] asm_call_irq_on_stack+0xf/0x20 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&bfqd->lock); + + lock(&bfqd->lock); + + *** DEADLOCK *** + + 3 locks held by kworker/2:3/388: + #0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at: process_one_work+0x742/0x13f0 + #1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0 + #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq + #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 + + stack backtrace: + CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 + Workqueue: kthrotld blk_throtl_dispatch_work_fn + Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x107/0x167 + print_usage_bug + valid_state + mark_lock_irq.cold+0x32/0x3a + mark_lock+0x693/0xbc0 + mark_held_locks+0x9e/0xe0 + __trace_hardirqs_on_caller + lockdep_hardirqs_on_prepare.part.0+0x151/0x360 + trace_hardirqs_on+0x5b/0x180 + __raw_spin_unlock_irq + _raw_spin_unlock_irq+0x24/0x40 + spin_unlock_irq + adjust_inuse_and_calc_cost+0x4fb/0x970 + ioc_rqos_merge+0x277/0x740 + __rq_qos_merge+0x62/0xb0 + rq_qos_merge + bio_attempt_back_merge+0x12c/0x4a0 + blk_mq_sched_try_merge+0x1b6/0x4d0 + bfq_bio_merge+0x24a/0x390 + __blk_mq_sched_bio_merge+0xa6/0x460 + blk_mq_sched_bio_merge + blk_mq_submit_bio+0x2e7/0x1ee0 + __submit_bio_noacct_mq+0x175/0x3b0 + submit_bio_noacct+0x1fb/0x270 + blk_throtl_dispatch_work_fn+0x1ef/0x2b0 + process_one_work+0x83e/0x13f0 + process_scheduled_works + worker_thread+0x7e3/0xd80 + kthread+0x353/0x470 + ret_from_fork+0x1f/0x30 + +Fixes: b0853ab4a238 ("blk-iocost: revamp in-period donation snapbacks") +Signed-off-by: Li Nan +Acked-by: Tejun Heo +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20230527091904.3001833-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-iocost.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 00d59d2288f00..7dd6a33e1d6a8 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -2437,6 +2437,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime, + u32 hwi, adj_step; + s64 margin; + u64 cost, new_inuse; ++ unsigned long flags; + + current_hweight(iocg, NULL, &hwi); + old_hwi = hwi; +@@ -2455,11 +2456,11 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime, + iocg->inuse == iocg->active) + return cost; + +- spin_lock_irq(&ioc->lock); ++ spin_lock_irqsave(&ioc->lock, flags); + + /* we own inuse only when @iocg is in the normal active state */ + if (iocg->abs_vdebt || list_empty(&iocg->active_list)) { +- spin_unlock_irq(&ioc->lock); ++ spin_unlock_irqrestore(&ioc->lock, flags); + return cost; + } + +@@ -2480,7 +2481,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime, + } while (time_after64(vtime + cost, now->vnow) && + iocg->inuse != iocg->active); + +- spin_unlock_irq(&ioc->lock); ++ spin_unlock_irqrestore(&ioc->lock, flags); + + TRACE_IOCG_PATH(inuse_adjust, iocg, now, + old_inuse, iocg->inuse, old_hwi, hwi); +-- +2.39.2 + diff --git a/queue-6.1/blk-mq-fix-potential-io-hang-by-wrong-wake_batch.patch b/queue-6.1/blk-mq-fix-potential-io-hang-by-wrong-wake_batch.patch new file mode 100644 index 00000000000..51cde6918af --- /dev/null +++ b/queue-6.1/blk-mq-fix-potential-io-hang-by-wrong-wake_batch.patch @@ -0,0 +1,126 @@ +From 94cb7ec31def09b54a7fa40e1b653b28c1566adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 10:30:43 +0800 +Subject: blk-mq: fix potential io hang by wrong 'wake_batch' + +From: Yu Kuai + +[ Upstream commit 4f1731df60f9033669f024d06ae26a6301260b55 ] + +In __blk_mq_tag_busy/idle(), updating 'active_queues' and calculating +'wake_batch' is not atomic: + +t1: t2: +_blk_mq_tag_busy blk_mq_tag_busy +inc active_queues +// assume 1->2 + inc active_queues + // 2 -> 3 + blk_mq_update_wake_batch + // calculate based on 3 +blk_mq_update_wake_batch +/* calculate based on 2, while active_queues is actually 3. */ + +Fix this problem by protecting them wih 'tags->lock', this is not a hot +path, so performance should not be concerned. And now that all writers +are inside the lock, switch 'actives_queues' from atomic to unsigned +int. + +Fixes: 180dccb0dba4 ("blk-mq: fix tag_get wait task can't be awakened") +Signed-off-by: Yu Kuai +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230610023043.2559121-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 2 +- + block/blk-mq-tag.c | 15 ++++++++++----- + block/blk-mq.h | 3 +-- + include/linux/blk-mq.h | 3 +-- + 4 files changed, 13 insertions(+), 10 deletions(-) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index bd942341b6382..7675e663df365 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -427,7 +427,7 @@ static void blk_mq_debugfs_tags_show(struct seq_file *m, + seq_printf(m, "nr_tags=%u\n", tags->nr_tags); + seq_printf(m, "nr_reserved_tags=%u\n", tags->nr_reserved_tags); + seq_printf(m, "active_queues=%d\n", +- atomic_read(&tags->active_queues)); ++ READ_ONCE(tags->active_queues)); + + seq_puts(m, "\nbitmap_tags:\n"); + sbitmap_queue_show(&tags->bitmap_tags, m); +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index a80d7c62bdfe6..100889c276c3f 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -40,6 +40,7 @@ static void blk_mq_update_wake_batch(struct blk_mq_tags *tags, + void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx) + { + unsigned int users; ++ struct blk_mq_tags *tags = hctx->tags; + + /* + * calling test_bit() prior to test_and_set_bit() is intentional, +@@ -57,9 +58,11 @@ void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx) + return; + } + +- users = atomic_inc_return(&hctx->tags->active_queues); +- +- blk_mq_update_wake_batch(hctx->tags, users); ++ spin_lock_irq(&tags->lock); ++ users = tags->active_queues + 1; ++ WRITE_ONCE(tags->active_queues, users); ++ blk_mq_update_wake_batch(tags, users); ++ spin_unlock_irq(&tags->lock); + } + + /* +@@ -92,9 +95,11 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx) + return; + } + +- users = atomic_dec_return(&tags->active_queues); +- ++ spin_lock_irq(&tags->lock); ++ users = tags->active_queues - 1; ++ WRITE_ONCE(tags->active_queues, users); + blk_mq_update_wake_batch(tags, users); ++ spin_unlock_irq(&tags->lock); + + blk_mq_tag_wakeup_all(tags, false); + } +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 0b2870839cdd6..c6eca452ea2a2 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -362,8 +362,7 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx, + return true; + } + +- users = atomic_read(&hctx->tags->active_queues); +- ++ users = READ_ONCE(hctx->tags->active_queues); + if (!users) + return true; + +diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h +index a9764cbf7f8d2..e4f676e1042b5 100644 +--- a/include/linux/blk-mq.h ++++ b/include/linux/blk-mq.h +@@ -745,8 +745,7 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, + struct blk_mq_tags { + unsigned int nr_tags; + unsigned int nr_reserved_tags; +- +- atomic_t active_queues; ++ unsigned int active_queues; + + struct sbitmap_queue bitmap_tags; + struct sbitmap_queue breserved_tags; +-- +2.39.2 + diff --git a/queue-6.1/block-fix-blktrace-debugfs-entries-leakage.patch b/queue-6.1/block-fix-blktrace-debugfs-entries-leakage.patch new file mode 100644 index 00000000000..dd98b1e37bf --- /dev/null +++ b/queue-6.1/block-fix-blktrace-debugfs-entries-leakage.patch @@ -0,0 +1,59 @@ +From 7dc54a5b7dbae2edce1e8bcbfa3b564bf281cc76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 10:20:03 +0800 +Subject: block: fix blktrace debugfs entries leakage + +From: Yu Kuai + +[ Upstream commit dd7de3704af9989b780693d51eaea49a665bd9c2 ] + +Commit 99d055b4fd4b ("block: remove per-disk debugfs files in +blk_unregister_queue") moves blk_trace_shutdown() from +blk_release_queue() to blk_unregister_queue(), this is safe if blktrace +is created through sysfs, however, there is a regression in corner +case. + +blktrace can still be enabled after del_gendisk() through ioctl if +the disk is opened before del_gendisk(), and if blktrace is not shutdown +through ioctl before closing the disk, debugfs entries will be leaked. + +Fix this problem by shutdown blktrace in disk_release(), this is safe +because blk_trace_remove() is reentrant. + +Fixes: 99d055b4fd4b ("block: remove per-disk debugfs files in blk_unregister_queue") +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230610022003.2557284-4-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 62a61388e752d..afab646d12c85 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -25,8 +25,9 @@ + #include + #include + #include +-#include "blk-throttle.h" ++#include + ++#include "blk-throttle.h" + #include "blk.h" + #include "blk-mq-sched.h" + #include "blk-rq-qos.h" +@@ -1181,6 +1182,8 @@ static void disk_release(struct device *dev) + might_sleep(); + WARN_ON_ONCE(disk_live(disk)); + ++ blk_trace_remove(disk->queue); ++ + /* + * To undo the all initialization from blk_mq_init_allocated_queue in + * case of a probe failure where add_disk is never called we have to +-- +2.39.2 + diff --git a/queue-6.1/block-fix-the-type-of-the-second-bdev_op_is_zoned_wr.patch b/queue-6.1/block-fix-the-type-of-the-second-bdev_op_is_zoned_wr.patch new file mode 100644 index 00000000000..905523ac264 --- /dev/null +++ b/queue-6.1/block-fix-the-type-of-the-second-bdev_op_is_zoned_wr.patch @@ -0,0 +1,44 @@ +From cdaa08692e19863bf26ec9e539bb230d9af8d8cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 10:42:21 -0700 +Subject: block: Fix the type of the second bdev_op_is_zoned_write() argument + +From: Bart Van Assche + +[ Upstream commit 3ddbe2a7e0d4a155a805f69c906c9beed30d4cc4 ] + +Change the type of the second argument of bdev_op_is_zoned_write() from +blk_opf_t into enum req_op because this function expects an operation +without flags as second argument. + +Reviewed-by: Johannes Thumshirn +Reviewed-by: Pankaj Raghav +Reviewed-by: Christoph Hellwig +Reviewed-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Cc: Ming Lei +Fixes: 8cafdb5ab94c ("block: adapt blk_mq_plug() to not plug for writes that require a zone lock") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20230517174230.897144-4-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/blkdev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 891f8cbcd0436..427e79ac72194 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1305,7 +1305,7 @@ static inline bool bdev_is_zoned(struct block_device *bdev) + } + + static inline bool bdev_op_is_zoned_write(struct block_device *bdev, +- blk_opf_t op) ++ enum req_op op) + { + if (!bdev_is_zoned(bdev)) + return false; +-- +2.39.2 + diff --git a/queue-6.1/bonding-do-not-assume-skb-mac_header-is-set.patch b/queue-6.1/bonding-do-not-assume-skb-mac_header-is-set.patch new file mode 100644 index 00000000000..b393585f8fe --- /dev/null +++ b/queue-6.1/bonding-do-not-assume-skb-mac_header-is-set.patch @@ -0,0 +1,92 @@ +From 157eed3125fcc13f75af4147092bb06ed35848d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 15:23:04 +0000 +Subject: bonding: do not assume skb mac_header is set + +From: Eric Dumazet + +[ Upstream commit 6a940abdef3162e5723f1495b8a49859d1708f79 ] + +Drivers must not assume in their ndo_start_xmit() that +skbs have their mac_header set. skb->data is all what is needed. + +bonding seems to be one of the last offender as caught by syzbot: + +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 +Modules linked in: +CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 +RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline] +RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline] +RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] +RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] +RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] +RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] +RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 +Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe +RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283 +RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000 +RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6 +RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584 +R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e +R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76 +FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +[] netdev_start_xmit include/linux/netdevice.h:4925 [inline] +[] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380 +[] dev_direct_xmit include/linux/netdevice.h:3043 [inline] +[] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284 +[] packet_snd net/packet/af_packet.c:3112 [inline] +[] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143 +[] sock_sendmsg_nosec net/socket.c:716 [inline] +[] sock_sendmsg net/socket.c:736 [inline] +[] __sys_sendto+0x472/0x5f0 net/socket.c:2139 +[] __do_sys_sendto net/socket.c:2151 [inline] +[] __se_sys_sendto net/socket.c:2147 [inline] +[] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 +[] do_syscall_x64 arch/x86/entry/common.c:50 [inline] +[] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 +[] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 7b8fc0103bb5 ("bonding: add a vlan+srcmac tx hashing option") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Jarod Wilson +Cc: Moshe Tal +Cc: Jussi Maki +Cc: Jay Vosburgh +Cc: Andy Gospodarek +Cc: Vladimir Oltean +Link: https://lore.kernel.org/r/20230622152304.2137482-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 9ed80f7106515..91d84df91123b 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4168,7 +4168,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb) + return skb->hash; + + return __bond_xmit_hash(bond, skb, skb->data, skb->protocol, +- skb_mac_offset(skb), skb_network_offset(skb), ++ 0, skb_network_offset(skb), + skb_headlen(skb)); + } + +-- +2.39.2 + diff --git a/queue-6.1/bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch b/queue-6.1/bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch new file mode 100644 index 00000000000..4cc67ac7864 --- /dev/null +++ b/queue-6.1/bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch @@ -0,0 +1,79 @@ +From c3cadfbd769e18cffb2123537e7d2bfb61fbfd35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:42:09 +0300 +Subject: bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC + hookpoint + +From: Gilad Sever + +[ Upstream commit 97fbfeb86917bdbe9c41d5143e335a929147f405 ] + +skb->dev always exists in the tc flow. There is no need to use +bpf_skc_lookup(), bpf_sk_lookup() from this code path. + +This change facilitates fixing the tc flow to be VRF aware. + +Signed-off-by: Gilad Sever +Signed-off-by: Daniel Borkmann +Reviewed-by: Shmulik Ladkani +Reviewed-by: Eyal Birger +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230621104211.301902-3-gilad9366@gmail.com +Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings") +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index e0f73ed8821e1..1b60a6cc975a7 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6649,8 +6649,12 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { + BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP, +- netns_id, flags); ++ struct net *caller_net = dev_net(skb->dev); ++ int ifindex = skb->dev->ifindex; ++ ++ return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net, ++ ifindex, IPPROTO_TCP, netns_id, ++ flags); + } + + static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { +@@ -6668,8 +6672,12 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP, +- netns_id, flags); ++ struct net *caller_net = dev_net(skb->dev); ++ int ifindex = skb->dev->ifindex; ++ ++ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, ++ ifindex, IPPROTO_TCP, netns_id, ++ flags); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { +@@ -6687,8 +6695,12 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP, +- netns_id, flags); ++ struct net *caller_net = dev_net(skb->dev); ++ int ifindex = skb->dev->ifindex; ++ ++ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, ++ ifindex, IPPROTO_UDP, netns_id, ++ flags); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = { +-- +2.39.2 + diff --git a/queue-6.1/bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch b/queue-6.1/bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch new file mode 100644 index 00000000000..8e731e2c4a2 --- /dev/null +++ b/queue-6.1/bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch @@ -0,0 +1,88 @@ +From 7490c80b0b897ccf88a682546ca814acfbc16fb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 10:04:53 -0700 +Subject: bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen + +From: Stanislav Fomichev + +[ Upstream commit 29ebbba7d46136cba324264e513a1e964ca16c0a ] + +With the way the hooks implemented right now, we have a special +condition: optval larger than PAGE_SIZE will expose only first 4k into +BPF; any modifications to the optval are ignored. If the BPF program +doesn't handle this condition by resetting optlen to 0, +the userspace will get EFAULT. + +The intention of the EFAULT was to make it apparent to the +developers that the program is doing something wrong. +However, this inadvertently might affect production workloads +with the BPF programs that are not too careful (i.e., returning EFAULT +for perfectly valid setsockopt/getsockopt calls). + +Let's try to minimize the chance of BPF program screwing up userspace +by ignoring the output of those BPF programs (instead of returning +EFAULT to the userspace). pr_info_once those cases to +the dmesg to help with figuring out what's going wrong. + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Suggested-by: Martin KaFai Lau +Signed-off-by: Stanislav Fomichev +Link: https://lore.kernel.org/r/20230511170456.1759459-2-sdf@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/cgroup.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index b86b907e566ca..bb70f400c25eb 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -1826,6 +1826,12 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level, + ret = 1; + } else if (ctx.optlen > max_optlen || ctx.optlen < -1) { + /* optlen is out of bounds */ ++ if (*optlen > PAGE_SIZE && ctx.optlen >= 0) { ++ pr_info_once("bpf setsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n", ++ ctx.optlen, max_optlen); ++ ret = 0; ++ goto out; ++ } + ret = -EFAULT; + } else { + /* optlen within bounds, run kernel handler */ +@@ -1881,8 +1887,10 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + .optname = optname, + .current_task = current, + }; ++ int orig_optlen; + int ret; + ++ orig_optlen = max_optlen; + ctx.optlen = max_optlen; + max_optlen = sockopt_alloc_buf(&ctx, max_optlen, &buf); + if (max_optlen < 0) +@@ -1905,6 +1913,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + ret = -EFAULT; + goto out; + } ++ orig_optlen = ctx.optlen; + + if (copy_from_user(ctx.optval, optval, + min(ctx.optlen, max_optlen)) != 0) { +@@ -1922,6 +1931,12 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + goto out; + + if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) { ++ if (orig_optlen > PAGE_SIZE && ctx.optlen >= 0) { ++ pr_info_once("bpf getsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n", ++ ctx.optlen, max_optlen); ++ ret = retval; ++ goto out; ++ } + ret = -EFAULT; + goto out; + } +-- +2.39.2 + diff --git a/queue-6.1/bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch b/queue-6.1/bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch new file mode 100644 index 00000000000..e1fc90d7327 --- /dev/null +++ b/queue-6.1/bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch @@ -0,0 +1,120 @@ +From 3700546d4c21df7de5f867d300d1fb6d622f5cd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:42:08 +0300 +Subject: bpf: Factor out socket lookup functions for the TC hookpoint. + +From: Gilad Sever + +[ Upstream commit 6e98730bc0b44acaf86eccc75f823128aa9c9e79 ] + +Change BPF helper socket lookup functions to use TC specific variants: +bpf_tc_sk_lookup_tcp() / bpf_tc_sk_lookup_udp() / bpf_tc_skc_lookup_tcp() +instead of sharing implementation with the cg / sk_skb hooking points. +This allows introducing a separate logic for the TC flow. + +The tc functions are identical to the original code. + +Signed-off-by: Gilad Sever +Signed-off-by: Daniel Borkmann +Reviewed-by: Shmulik Ladkani +Reviewed-by: Eyal Birger +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230621104211.301902-2-gilad9366@gmail.com +Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings") +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 63 ++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 60 insertions(+), 3 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b79a070fa8246..e0f73ed8821e1 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6646,6 +6646,63 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { + .arg5_type = ARG_ANYTHING, + }; + ++BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb, ++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) ++{ ++ return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP, ++ netns_id, flags); ++} ++ ++static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { ++ .func = bpf_tc_skc_lookup_tcp, ++ .gpl_only = false, ++ .pkt_access = true, ++ .ret_type = RET_PTR_TO_SOCK_COMMON_OR_NULL, ++ .arg1_type = ARG_PTR_TO_CTX, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, ++ .arg3_type = ARG_CONST_SIZE, ++ .arg4_type = ARG_ANYTHING, ++ .arg5_type = ARG_ANYTHING, ++}; ++ ++BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb, ++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) ++{ ++ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP, ++ netns_id, flags); ++} ++ ++static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { ++ .func = bpf_tc_sk_lookup_tcp, ++ .gpl_only = false, ++ .pkt_access = true, ++ .ret_type = RET_PTR_TO_SOCKET_OR_NULL, ++ .arg1_type = ARG_PTR_TO_CTX, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, ++ .arg3_type = ARG_CONST_SIZE, ++ .arg4_type = ARG_ANYTHING, ++ .arg5_type = ARG_ANYTHING, ++}; ++ ++BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb, ++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) ++{ ++ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP, ++ netns_id, flags); ++} ++ ++static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = { ++ .func = bpf_tc_sk_lookup_udp, ++ .gpl_only = false, ++ .pkt_access = true, ++ .ret_type = RET_PTR_TO_SOCKET_OR_NULL, ++ .arg1_type = ARG_PTR_TO_CTX, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, ++ .arg3_type = ARG_CONST_SIZE, ++ .arg4_type = ARG_ANYTHING, ++ .arg5_type = ARG_ANYTHING, ++}; ++ + BPF_CALL_1(bpf_sk_release, struct sock *, sk) + { + if (sk && sk_is_refcounted(sk)) +@@ -7902,9 +7959,9 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) + #endif + #ifdef CONFIG_INET + case BPF_FUNC_sk_lookup_tcp: +- return &bpf_sk_lookup_tcp_proto; ++ return &bpf_tc_sk_lookup_tcp_proto; + case BPF_FUNC_sk_lookup_udp: +- return &bpf_sk_lookup_udp_proto; ++ return &bpf_tc_sk_lookup_udp_proto; + case BPF_FUNC_sk_release: + return &bpf_sk_release_proto; + case BPF_FUNC_tcp_sock: +@@ -7912,7 +7969,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) + case BPF_FUNC_get_listener_sock: + return &bpf_get_listener_sock_proto; + case BPF_FUNC_skc_lookup_tcp: +- return &bpf_skc_lookup_tcp_proto; ++ return &bpf_tc_skc_lookup_tcp_proto; + case BPF_FUNC_tcp_check_syncookie: + return &bpf_tcp_check_syncookie_proto; + case BPF_FUNC_skb_ecn_set_ce: +-- +2.39.2 + diff --git a/queue-6.1/bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch b/queue-6.1/bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch new file mode 100644 index 00000000000..f6b6ee2b572 --- /dev/null +++ b/queue-6.1/bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch @@ -0,0 +1,250 @@ +From df8ec53ac1b0a7fd28ceec94b4f49ec30886884a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:42:10 +0300 +Subject: bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings + +From: Gilad Sever + +[ Upstream commit 9a5cb79762e0eda17ca15c2a6eaca4622383c21c ] + +When calling bpf_sk_lookup_tcp(), bpf_sk_lookup_udp() or +bpf_skc_lookup_tcp() from tc/xdp ingress, VRF socket bindings aren't +respoected, i.e. unbound sockets are returned, and bound sockets aren't +found. + +VRF binding is determined by the sdif argument to sk_lookup(), however +when called from tc the IP SKB control block isn't initialized and thus +inet{,6}_sdif() always returns 0. + +Fix by calculating sdif for the tc/xdp flows by observing the device's +l3 enslaved state. + +The cg/sk_skb hooking points which are expected to support +inet{,6}_sdif() pass sdif=-1 which makes __bpf_skc_lookup() use the +existing logic. + +Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") +Signed-off-by: Gilad Sever +Signed-off-by: Daniel Borkmann +Reviewed-by: Shmulik Ladkani +Reviewed-by: Eyal Birger +Acked-by: Stanislav Fomichev +Cc: David Ahern +Link: https://lore.kernel.org/bpf/20230621104211.301902-4-gilad9366@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/netdevice.h | 9 +++++ + net/core/filter.c | 69 ++++++++++++++++++++++----------------- + 2 files changed, 48 insertions(+), 30 deletions(-) + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index d5eb3ab8e38f2..5a04fbf724768 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -5028,6 +5028,15 @@ static inline bool netif_is_l3_slave(const struct net_device *dev) + return dev->priv_flags & IFF_L3MDEV_SLAVE; + } + ++static inline int dev_sdif(const struct net_device *dev) ++{ ++#ifdef CONFIG_NET_L3_MASTER_DEV ++ if (netif_is_l3_slave(dev)) ++ return dev->ifindex; ++#endif ++ return 0; ++} ++ + static inline bool netif_is_bridge_master(const struct net_device *dev) + { + return dev->priv_flags & IFF_EBRIDGE; +diff --git a/net/core/filter.c b/net/core/filter.c +index 1b60a6cc975a7..da71e6812ab51 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6474,12 +6474,11 @@ static struct sock *sk_lookup(struct net *net, struct bpf_sock_tuple *tuple, + static struct sock * + __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id, +- u64 flags) ++ u64 flags, int sdif) + { + struct sock *sk = NULL; + struct net *net; + u8 family; +- int sdif; + + if (len == sizeof(tuple->ipv4)) + family = AF_INET; +@@ -6491,10 +6490,12 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + if (unlikely(flags || !((s32)netns_id < 0 || netns_id <= S32_MAX))) + goto out; + +- if (family == AF_INET) +- sdif = inet_sdif(skb); +- else +- sdif = inet6_sdif(skb); ++ if (sdif < 0) { ++ if (family == AF_INET) ++ sdif = inet_sdif(skb); ++ else ++ sdif = inet6_sdif(skb); ++ } + + if ((s32)netns_id < 0) { + net = caller_net; +@@ -6514,10 +6515,11 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + static struct sock * + __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id, +- u64 flags) ++ u64 flags, int sdif) + { + struct sock *sk = __bpf_skc_lookup(skb, tuple, len, caller_net, +- ifindex, proto, netns_id, flags); ++ ifindex, proto, netns_id, flags, ++ sdif); + + if (sk) { + struct sock *sk2 = sk_to_full_sk(sk); +@@ -6557,7 +6559,7 @@ bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + } + + return __bpf_skc_lookup(skb, tuple, len, caller_net, ifindex, proto, +- netns_id, flags); ++ netns_id, flags, -1); + } + + static struct sock * +@@ -6649,12 +6651,13 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { + BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(skb->dev); +- int ifindex = skb->dev->ifindex; ++ struct net_device *dev = skb->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { +@@ -6672,12 +6675,13 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(skb->dev); +- int ifindex = skb->dev->ifindex; ++ struct net_device *dev = skb->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { +@@ -6695,12 +6699,13 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(skb->dev); +- int ifindex = skb->dev->ifindex; ++ struct net_device *dev = skb->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, + ifindex, IPPROTO_UDP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = { +@@ -6732,12 +6737,13 @@ static const struct bpf_func_proto bpf_sk_release_proto = { + BPF_CALL_5(bpf_xdp_sk_lookup_udp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(ctx->rxq->dev); +- int ifindex = ctx->rxq->dev->ifindex; ++ struct net_device *dev = ctx->rxq->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net, + ifindex, IPPROTO_UDP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = { +@@ -6755,12 +6761,13 @@ static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = { + BPF_CALL_5(bpf_xdp_skc_lookup_tcp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(ctx->rxq->dev); +- int ifindex = ctx->rxq->dev->ifindex; ++ struct net_device *dev = ctx->rxq->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_skc_lookup(NULL, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = { +@@ -6778,12 +6785,13 @@ static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = { + BPF_CALL_5(bpf_xdp_sk_lookup_tcp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(ctx->rxq->dev); +- int ifindex = ctx->rxq->dev->ifindex; ++ struct net_device *dev = ctx->rxq->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_xdp_sk_lookup_tcp_proto = { +@@ -6803,7 +6811,8 @@ BPF_CALL_5(bpf_sock_addr_skc_lookup_tcp, struct bpf_sock_addr_kern *, ctx, + { + return (unsigned long)__bpf_skc_lookup(NULL, tuple, len, + sock_net(ctx->sk), 0, +- IPPROTO_TCP, netns_id, flags); ++ IPPROTO_TCP, netns_id, flags, ++ -1); + } + + static const struct bpf_func_proto bpf_sock_addr_skc_lookup_tcp_proto = { +@@ -6822,7 +6831,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_tcp, struct bpf_sock_addr_kern *, ctx, + { + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, + sock_net(ctx->sk), 0, IPPROTO_TCP, +- netns_id, flags); ++ netns_id, flags, -1); + } + + static const struct bpf_func_proto bpf_sock_addr_sk_lookup_tcp_proto = { +@@ -6841,7 +6850,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_udp, struct bpf_sock_addr_kern *, ctx, + { + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, + sock_net(ctx->sk), 0, IPPROTO_UDP, +- netns_id, flags); ++ netns_id, flags, -1); + } + + static const struct bpf_func_proto bpf_sock_addr_sk_lookup_udp_proto = { +-- +2.39.2 + diff --git a/queue-6.1/bpf-fix-memleak-due-to-fentry-attach-failure.patch b/queue-6.1/bpf-fix-memleak-due-to-fentry-attach-failure.patch new file mode 100644 index 00000000000..579b22204fe --- /dev/null +++ b/queue-6.1/bpf-fix-memleak-due-to-fentry-attach-failure.patch @@ -0,0 +1,112 @@ +From 85ebabd75cfe9913da14dd29030c6a1859f9808d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 13:08:47 +0000 +Subject: bpf: Fix memleak due to fentry attach failure + +From: Yafang Shao + +[ Upstream commit 108598c39eefbedc9882273ac0df96127a629220 ] + +If it fails to attach fentry, the allocated bpf trampoline image will be +left in the system. That can be verified by checking /proc/kallsyms. + +This meamleak can be verified by a simple bpf program as follows: + + SEC("fentry/trap_init") + int fentry_run() + { + return 0; + } + +It will fail to attach trap_init because this function is freed after +kernel init, and then we can find the trampoline image is left in the +system by checking /proc/kallsyms. + + $ tail /proc/kallsyms + ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] + ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] + + $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" + [2522] FUNC 'trap_init' type_id=119 linkage=static + + $ echo $((6442453466 & 0x7fffffff)) + 2522 + +Note that there are two left bpf trampoline images, that is because the +libbpf will fallback to raw tracepoint if -EINVAL is returned. + +Fixes: e21aa341785c ("bpf: Fix fexit trampoline.") +Signed-off-by: Yafang Shao +Signed-off-by: Daniel Borkmann +Acked-by: Song Liu +Cc: Jiri Olsa +Link: https://lore.kernel.org/bpf/20230515130849.57502-2-laoar.shao@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/trampoline.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c +index 91d8de938a3dd..30af8f66e17b4 100644 +--- a/kernel/bpf/trampoline.c ++++ b/kernel/bpf/trampoline.c +@@ -279,11 +279,8 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a + return tlinks; + } + +-static void __bpf_tramp_image_put_deferred(struct work_struct *work) ++static void bpf_tramp_image_free(struct bpf_tramp_image *im) + { +- struct bpf_tramp_image *im; +- +- im = container_of(work, struct bpf_tramp_image, work); + bpf_image_ksym_del(&im->ksym); + bpf_jit_free_exec(im->image); + bpf_jit_uncharge_modmem(PAGE_SIZE); +@@ -291,6 +288,14 @@ static void __bpf_tramp_image_put_deferred(struct work_struct *work) + kfree_rcu(im, rcu); + } + ++static void __bpf_tramp_image_put_deferred(struct work_struct *work) ++{ ++ struct bpf_tramp_image *im; ++ ++ im = container_of(work, struct bpf_tramp_image, work); ++ bpf_tramp_image_free(im); ++} ++ + /* callback, fexit step 3 or fentry step 2 */ + static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu) + { +@@ -465,7 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut + &tr->func.model, tr->flags, tlinks, + tr->func.addr); + if (err < 0) +- goto out; ++ goto out_free; + + set_memory_ro((long)im->image, 1); + set_memory_x((long)im->image, 1); +@@ -495,7 +500,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut + } + #endif + if (err) +- goto out; ++ goto out_free; + + if (tr->cur_image) + bpf_tramp_image_put(tr->cur_image); +@@ -506,6 +511,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut + tr->flags = orig_flags; + kfree(tlinks); + return err; ++ ++out_free: ++ bpf_tramp_image_free(im); ++ goto out; + } + + static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) +-- +2.39.2 + diff --git a/queue-6.1/bpf-remove-bpf-trampoline-selector.patch b/queue-6.1/bpf-remove-bpf-trampoline-selector.patch new file mode 100644 index 00000000000..ad3acb46d2b --- /dev/null +++ b/queue-6.1/bpf-remove-bpf-trampoline-selector.patch @@ -0,0 +1,102 @@ +From f4c24105fc948e7ac9d417bb22742b88e7eff91c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 13:08:48 +0000 +Subject: bpf: Remove bpf trampoline selector + +From: Yafang Shao + +[ Upstream commit 47e79cbeea4b3891ad476047f4c68543eb51c8e0 ] + +After commit e21aa341785c ("bpf: Fix fexit trampoline."), the selector is only +used to indicate how many times the bpf trampoline image are updated and been +displayed in the trampoline ksym name. After the trampoline is freed, the +selector will start from 0 again. So the selector is a useless value to the +user. We can remove it. + +If the user want to check whether the bpf trampoline image has been updated +or not, the user can compare the address. Each time the trampoline image is +updated, the address will change consequently. Jiri also pointed out another +issue that perf is still using the old name "bpf_trampoline_%lu", so this +change can fix the issue in perf. + +Fixes: e21aa341785c ("bpf: Fix fexit trampoline.") +Signed-off-by: Yafang Shao +Signed-off-by: Daniel Borkmann +Acked-by: Song Liu +Cc: Jiri Olsa +Link: https://lore.kernel.org/bpf/ZFvOOlrmHiY9AgXE@krava +Link: https://lore.kernel.org/bpf/20230515130849.57502-3-laoar.shao@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 1 - + kernel/bpf/trampoline.c | 11 ++++------- + 2 files changed, 4 insertions(+), 8 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 942f9ac9fa7b6..8cef9ec3a89c2 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -933,7 +933,6 @@ struct bpf_trampoline { + int progs_cnt[BPF_TRAMP_MAX]; + /* Executable image of trampoline */ + struct bpf_tramp_image *cur_image; +- u64 selector; + struct module *mod; + }; + +diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c +index f1504cb5b6e19..91d8de938a3dd 100644 +--- a/kernel/bpf/trampoline.c ++++ b/kernel/bpf/trampoline.c +@@ -372,7 +372,7 @@ static void bpf_tramp_image_put(struct bpf_tramp_image *im) + call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks); + } + +-static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx) ++static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key) + { + struct bpf_tramp_image *im; + struct bpf_ksym *ksym; +@@ -399,7 +399,7 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx) + + ksym = &im->ksym; + INIT_LIST_HEAD_RCU(&ksym->lnode); +- snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx); ++ snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", key); + bpf_image_ksym_add(image, ksym); + return im; + +@@ -429,11 +429,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut + err = unregister_fentry(tr, tr->cur_image->image); + bpf_tramp_image_put(tr->cur_image); + tr->cur_image = NULL; +- tr->selector = 0; + goto out; + } + +- im = bpf_tramp_image_alloc(tr->key, tr->selector); ++ im = bpf_tramp_image_alloc(tr->key); + if (IS_ERR(im)) { + err = PTR_ERR(im); + goto out; +@@ -471,8 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut + set_memory_ro((long)im->image, 1); + set_memory_x((long)im->image, 1); + +- WARN_ON(tr->cur_image && tr->selector == 0); +- WARN_ON(!tr->cur_image && tr->selector); ++ WARN_ON(tr->cur_image && total == 0); + if (tr->cur_image) + /* progs already running at this address */ + err = modify_fentry(tr, tr->cur_image->image, im->image, lock_direct_mutex); +@@ -502,7 +500,6 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut + if (tr->cur_image) + bpf_tramp_image_put(tr->cur_image); + tr->cur_image = im; +- tr->selector++; + out: + /* If any error happens, restore previous flags */ + if (err) +-- +2.39.2 + diff --git a/queue-6.1/bpftool-jit-limited-misreported-as-negative-value-on.patch b/queue-6.1/bpftool-jit-limited-misreported-as-negative-value-on.patch new file mode 100644 index 00000000000..35e69811b32 --- /dev/null +++ b/queue-6.1/bpftool-jit-limited-misreported-as-negative-value-on.patch @@ -0,0 +1,150 @@ +From 80ffa4402b38a65829425f6c9974706df7559382 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 12:31:34 +0100 +Subject: bpftool: JIT limited misreported as negative value on aarch64 + +From: Alan Maguire + +[ Upstream commit 04cb8453a91c7c22f60ddadb6cef0d19abb33bb5 ] + +On aarch64, "bpftool feature" reports an incorrect BPF JIT limit: + +$ sudo /sbin/bpftool feature +Scanning system configuration... +bpf() syscall restricted to privileged users +JIT compiler is enabled +JIT compiler hardening is disabled +JIT compiler kallsyms exports are enabled for root +skipping kernel config, can't open file: No such file or directory +Global memory limit for JIT compiler for unprivileged users is -201326592 bytes + +This is because /proc/sys/net/core/bpf_jit_limit reports + +$ sudo cat /proc/sys/net/core/bpf_jit_limit +68169519595520 + +...and an int is assumed in read_procfs(). Change read_procfs() +to return a long to avoid negative value reporting. + +Fixes: 7a4522bbef0c ("tools: bpftool: add probes for /proc/ eBPF parameters") +Reported-by: Nicky Veitch +Signed-off-by: Alan Maguire +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Acked-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230512113134.58996-1-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/feature.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/tools/bpf/bpftool/feature.c b/tools/bpf/bpftool/feature.c +index 36cf0f1517c94..4460399bc8ed8 100644 +--- a/tools/bpf/bpftool/feature.c ++++ b/tools/bpf/bpftool/feature.c +@@ -167,12 +167,12 @@ static int get_vendor_id(int ifindex) + return strtol(buf, NULL, 0); + } + +-static int read_procfs(const char *path) ++static long read_procfs(const char *path) + { + char *endptr, *line = NULL; + size_t len = 0; + FILE *fd; +- int res; ++ long res; + + fd = fopen(path, "r"); + if (!fd) +@@ -194,7 +194,7 @@ static int read_procfs(const char *path) + + static void probe_unprivileged_disabled(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -216,14 +216,14 @@ static void probe_unprivileged_disabled(void) + printf("Unable to retrieve required privileges for bpf() syscall\n"); + break; + default: +- printf("bpf() syscall restriction has unknown value %d\n", res); ++ printf("bpf() syscall restriction has unknown value %ld\n", res); + } + } + } + + static void probe_jit_enable(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -245,7 +245,7 @@ static void probe_jit_enable(void) + printf("Unable to retrieve JIT-compiler status\n"); + break; + default: +- printf("JIT-compiler status has unknown value %d\n", ++ printf("JIT-compiler status has unknown value %ld\n", + res); + } + } +@@ -253,7 +253,7 @@ static void probe_jit_enable(void) + + static void probe_jit_harden(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -275,7 +275,7 @@ static void probe_jit_harden(void) + printf("Unable to retrieve JIT hardening status\n"); + break; + default: +- printf("JIT hardening status has unknown value %d\n", ++ printf("JIT hardening status has unknown value %ld\n", + res); + } + } +@@ -283,7 +283,7 @@ static void probe_jit_harden(void) + + static void probe_jit_kallsyms(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -302,14 +302,14 @@ static void probe_jit_kallsyms(void) + printf("Unable to retrieve JIT kallsyms export status\n"); + break; + default: +- printf("JIT kallsyms exports status has unknown value %d\n", res); ++ printf("JIT kallsyms exports status has unknown value %ld\n", res); + } + } + } + + static void probe_jit_limit(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -322,7 +322,7 @@ static void probe_jit_limit(void) + printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n"); + break; + default: +- printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res); ++ printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res); + } + } + } +-- +2.39.2 + diff --git a/queue-6.1/bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch b/queue-6.1/bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch new file mode 100644 index 00000000000..03c5a1cb77a --- /dev/null +++ b/queue-6.1/bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch @@ -0,0 +1,49 @@ +From 24b9dec1c394c3f5275418eeb67a1c4d758c1bea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 10:04:16 +0300 +Subject: bus: ti-sysc: Fix dispc quirk masking bool variables + +From: Tony Lindgren + +[ Upstream commit f620596fa347170852da499e778a5736d79a4b79 ] + +Fix warning drivers/bus/ti-sysc.c:1806 sysc_quirk_dispc() +warn: masking a bool. + +While at it let's add a comment for what were doing to make +the code a bit easier to follow. + +Fixes: 7324a7a0d5e2 ("bus: ti-sysc: Implement display subsystem reset quirk") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-omap/a8ec8a68-9c2c-4076-bf47-09fccce7659f@kili.mountain/ +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 9a7d12332fadb..cae078bffc715 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1808,7 +1808,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset, + if (!ddata->module_va) + return -EIO; + +- /* DISP_CONTROL */ ++ /* DISP_CONTROL, shut down lcd and digit on disable if enabled */ + val = sysc_read(ddata, dispc_offset + 0x40); + lcd_en = val & lcd_en_mask; + digit_en = val & digit_en_mask; +@@ -1820,7 +1820,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset, + else + irq_mask |= BIT(2) | BIT(3); /* EVSYNC bits */ + } +- if (disable & (lcd_en | digit_en)) ++ if (disable && (lcd_en || digit_en)) + sysc_write(ddata, dispc_offset + 0x40, + val & ~(lcd_en_mask | digit_en_mask)); + +-- +2.39.2 + diff --git a/queue-6.1/can-kvaser_pciefd-add-function-to-set-skb-hwtstamps.patch b/queue-6.1/can-kvaser_pciefd-add-function-to-set-skb-hwtstamps.patch new file mode 100644 index 00000000000..082b4252b45 --- /dev/null +++ b/queue-6.1/can-kvaser_pciefd-add-function-to-set-skb-hwtstamps.patch @@ -0,0 +1,104 @@ +From 9d16f23a341fc1062aa4c944d9128d934826ca69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 15:42:37 +0200 +Subject: can: kvaser_pciefd: Add function to set skb hwtstamps + +From: Jimmy Assarsson + +[ Upstream commit 2d55e9f9b4427e1ad59b974f2267767aac3788d3 ] + +Add new function, kvaser_pciefd_set_skb_timestamp(), to set skb hwtstamps. + +Signed-off-by: Jimmy Assarsson +Reviewed-by: Vincent Mailhol +Link: https://lore.kernel.org/all/20230529134248.752036-4-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Stable-dep-of: ec681b91befa ("can: kvaser_pciefd: Set hardware timestamp on transmitted packets") +Signed-off-by: Sasha Levin +--- + drivers/net/can/kvaser_pciefd.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 956a4a57396f9..0b537292c7b19 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -538,6 +538,13 @@ static int kvaser_pciefd_set_tx_irq(struct kvaser_pciefd_can *can) + return 0; + } + ++static inline void kvaser_pciefd_set_skb_timestamp(const struct kvaser_pciefd *pcie, ++ struct sk_buff *skb, u64 timestamp) ++{ ++ skb_hwtstamps(skb)->hwtstamp = ++ ns_to_ktime(div_u64(timestamp * 1000, pcie->freq_to_ticks_div)); ++} ++ + static void kvaser_pciefd_setup_controller(struct kvaser_pciefd_can *can) + { + u32 mode; +@@ -1171,7 +1178,6 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie, + struct canfd_frame *cf; + struct can_priv *priv; + struct net_device_stats *stats; +- struct skb_shared_hwtstamps *shhwtstamps; + u8 ch_id = (p->header[1] >> KVASER_PCIEFD_PACKET_CHID_SHIFT) & 0x7; + + if (ch_id >= pcie->nr_channels) +@@ -1214,12 +1220,7 @@ static int kvaser_pciefd_handle_data_packet(struct kvaser_pciefd *pcie, + stats->rx_bytes += cf->len; + } + stats->rx_packets++; +- +- shhwtstamps = skb_hwtstamps(skb); +- +- shhwtstamps->hwtstamp = +- ns_to_ktime(div_u64(p->timestamp * 1000, +- pcie->freq_to_ticks_div)); ++ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp); + + return netif_rx(skb); + } +@@ -1282,7 +1283,6 @@ static int kvaser_pciefd_rx_error_frame(struct kvaser_pciefd_can *can, + struct net_device *ndev = can->can.dev; + struct sk_buff *skb; + struct can_frame *cf = NULL; +- struct skb_shared_hwtstamps *shhwtstamps; + struct net_device_stats *stats = &ndev->stats; + + old_state = can->can.state; +@@ -1323,10 +1323,7 @@ static int kvaser_pciefd_rx_error_frame(struct kvaser_pciefd_can *can, + return -ENOMEM; + } + +- shhwtstamps = skb_hwtstamps(skb); +- shhwtstamps->hwtstamp = +- ns_to_ktime(div_u64(p->timestamp * 1000, +- can->kv_pcie->freq_to_ticks_div)); ++ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp); + cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_CNT; + + cf->data[6] = bec.txerr; +@@ -1374,7 +1371,6 @@ static int kvaser_pciefd_handle_status_resp(struct kvaser_pciefd_can *can, + struct net_device *ndev = can->can.dev; + struct sk_buff *skb; + struct can_frame *cf; +- struct skb_shared_hwtstamps *shhwtstamps; + + skb = alloc_can_err_skb(ndev, &cf); + if (!skb) { +@@ -1394,10 +1390,7 @@ static int kvaser_pciefd_handle_status_resp(struct kvaser_pciefd_can *can, + cf->can_id |= CAN_ERR_RESTARTED; + } + +- shhwtstamps = skb_hwtstamps(skb); +- shhwtstamps->hwtstamp = +- ns_to_ktime(div_u64(p->timestamp * 1000, +- can->kv_pcie->freq_to_ticks_div)); ++ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp); + + cf->data[6] = bec.txerr; + cf->data[7] = bec.rxerr; +-- +2.39.2 + diff --git a/queue-6.1/can-kvaser_pciefd-set-hardware-timestamp-on-transmit.patch b/queue-6.1/can-kvaser_pciefd-set-hardware-timestamp-on-transmit.patch new file mode 100644 index 00000000000..4cc0826a702 --- /dev/null +++ b/queue-6.1/can-kvaser_pciefd-set-hardware-timestamp-on-transmit.patch @@ -0,0 +1,54 @@ +From 48b362f72be6137a53729da39c5c454af555c446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 15:42:38 +0200 +Subject: can: kvaser_pciefd: Set hardware timestamp on transmitted packets + +From: Jimmy Assarsson + +[ Upstream commit ec681b91befa982477e24a150dd6452427fe6473 ] + +Set hardware timestamp on transmitted packets. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Signed-off-by: Jimmy Assarsson +Reviewed-by: Vincent Mailhol +Link: https://lore.kernel.org/all/20230529134248.752036-5-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/kvaser_pciefd.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 0b537292c7b19..74a47244f1291 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -1519,6 +1519,7 @@ static void kvaser_pciefd_handle_nack_packet(struct kvaser_pciefd_can *can, + + if (skb) { + cf->can_id |= CAN_ERR_BUSERROR; ++ kvaser_pciefd_set_skb_timestamp(can->kv_pcie, skb, p->timestamp); + netif_rx(skb); + } else { + stats->rx_dropped++; +@@ -1550,8 +1551,15 @@ static int kvaser_pciefd_handle_ack_packet(struct kvaser_pciefd *pcie, + netdev_dbg(can->can.dev, "Packet was flushed\n"); + } else { + int echo_idx = p->header[0] & KVASER_PCIEFD_PACKET_SEQ_MSK; +- int dlc = can_get_echo_skb(can->can.dev, echo_idx, NULL); +- u8 count = ioread32(can->reg_base + ++ int dlc; ++ u8 count; ++ struct sk_buff *skb; ++ ++ skb = can->can.echo_skb[echo_idx]; ++ if (skb) ++ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp); ++ dlc = can_get_echo_skb(can->can.dev, echo_idx, NULL); ++ count = ioread32(can->reg_base + + KVASER_PCIEFD_KCAN_TX_NPACKETS_REG) & 0xff; + + if (count < KVASER_PCIEFD_CAN_TX_MAX_COUNT && +-- +2.39.2 + diff --git a/queue-6.1/can-length-fix-bitstuffing-count.patch b/queue-6.1/can-length-fix-bitstuffing-count.patch new file mode 100644 index 00000000000..4ee1fa3ce26 --- /dev/null +++ b/queue-6.1/can-length-fix-bitstuffing-count.patch @@ -0,0 +1,123 @@ +From 22049ca5e2d693e63bf9ecaa6c80f17521b024b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 11:57:26 +0900 +Subject: can: length: fix bitstuffing count + +From: Vincent Mailhol + +[ Upstream commit 9fde4c557f78ee2f3626e92b4089ce9d54a2573a ] + +The Stuff Bit Count is always coded on 4 bits [1]. Update the Stuff +Bit Count size accordingly. + +In addition, the CRC fields of CAN FD Frames contain stuff bits at +fixed positions called fixed stuff bits [2]. The CRC field starts with +a fixed stuff bit and then has another fixed stuff bit after each +fourth bit [2], which allows us to derive this formula: + + FSB count = 1 + round_down(len(CRC field)/4) + +The length of the CRC field is [1]: + + len(CRC field) = len(Stuff Bit Count) + len(CRC) + = 4 + len(CRC) + +with len(CRC) either 17 or 21 bits depending of the payload length. + +In conclusion, for CRC17: + + FSB count = 1 + round_down((4 + 17)/4) + = 6 + +and for CRC 21: + + FSB count = 1 + round_down((4 + 21)/4) + = 7 + +Add a Fixed Stuff bits (FSB) field with above values and update +CANFD_FRAME_OVERHEAD_SFF and CANFD_FRAME_OVERHEAD_EFF accordingly. + +[1] ISO 11898-1:2015 section 10.4.2.6 "CRC field": + + The CRC field shall contain the CRC sequence followed by a recessive + CRC delimiter. For FD Frames, the CRC field shall also contain the + stuff count. + + Stuff count + + If FD Frames, the stuff count shall be at the beginning of the CRC + field. It shall consist of the stuff bit count modulo 8 in a 3-bit + gray code followed by a parity bit [...] + +[2] ISO 11898-1:2015 paragraph 10.5 "Frame coding": + + In the CRC field of FD Frames, the stuff bits shall be inserted at + fixed positions; they are called fixed stuff bits. There shall be a + fixed stuff bit before the first bit of the stuff count, even if the + last bits of the preceding field are a sequence of five consecutive + bits of identical value, there shall be only the fixed stuff bit, + there shall not be two consecutive stuff bits. A further fixed stuff + bit shall be inserted after each fourth bit of the CRC field [...] + +Fixes: 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer") +Suggested-by: Thomas Kopp +Signed-off-by: Vincent Mailhol +Reviewed-by: Thomas Kopp +Link: https://lore.kernel.org/all/20230611025728.450837-2-mailhol.vincent@wanadoo.fr +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + include/linux/can/length.h | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/include/linux/can/length.h b/include/linux/can/length.h +index 6995092b774ec..ef1fd32cef16b 100644 +--- a/include/linux/can/length.h ++++ b/include/linux/can/length.h +@@ -69,17 +69,18 @@ + * Error Status Indicator (ESI) 1 + * Data length code (DLC) 4 + * Data field 0...512 +- * Stuff Bit Count (SBC) 0...16: 4 20...64:5 ++ * Stuff Bit Count (SBC) 4 + * CRC 0...16: 17 20...64:21 + * CRC delimiter (CD) 1 ++ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7 + * ACK slot (AS) 1 + * ACK delimiter (AD) 1 + * End-of-frame (EOF) 7 + * Inter frame spacing 3 + * +- * assuming CRC21, rounded up and ignoring bitstuffing ++ * assuming CRC21, rounded up and ignoring dynamic bitstuffing + */ +-#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(61, 8) ++#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(67, 8) + + /* + * Size of a CAN-FD Extended Frame +@@ -98,17 +99,18 @@ + * Error Status Indicator (ESI) 1 + * Data length code (DLC) 4 + * Data field 0...512 +- * Stuff Bit Count (SBC) 0...16: 4 20...64:5 ++ * Stuff Bit Count (SBC) 4 + * CRC 0...16: 17 20...64:21 + * CRC delimiter (CD) 1 ++ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7 + * ACK slot (AS) 1 + * ACK delimiter (AD) 1 + * End-of-frame (EOF) 7 + * Inter frame spacing 3 + * +- * assuming CRC21, rounded up and ignoring bitstuffing ++ * assuming CRC21, rounded up and ignoring dynamic bitstuffing + */ +-#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(80, 8) ++#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(86, 8) + + /* + * Maximum size of a Classical CAN frame +-- +2.39.2 + diff --git a/queue-6.1/cifs-do-all-necessary-checks-for-credits-within-or-b.patch b/queue-6.1/cifs-do-all-necessary-checks-for-credits-within-or-b.patch new file mode 100644 index 00000000000..e3b034eb8b3 --- /dev/null +++ b/queue-6.1/cifs-do-all-necessary-checks-for-credits-within-or-b.patch @@ -0,0 +1,114 @@ +From 0baee28326c52356110f217b8da8a33ca891c6cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 18:16:04 +0000 +Subject: cifs: do all necessary checks for credits within or before locking + +From: Shyam Prasad N + +[ Upstream commit 326a8d04f147e2bf393f6f9cdb74126ee6900607 ] + +All the server credits and in-flight info is protected by req_lock. +Once the req_lock is held, and we've determined that we have enough +credits to continue, this lock cannot be dropped till we've made the +changes to credits and in-flight count. + +However, we used to drop the lock in order to avoid deadlock with +the recent srv_lock. This could cause the checks already made to be +invalidated. + +Fixed it by moving the server status check to before locking req_lock. + +Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data") +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 19 ++++++++++--------- + fs/smb/client/transport.c | 20 ++++++++++---------- + 2 files changed, 20 insertions(+), 19 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index d512440d35b6f..e6a191a7499e8 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -208,6 +208,16 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size, + + spin_lock(&server->req_lock); + while (1) { ++ spin_unlock(&server->req_lock); ++ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus == CifsExiting) { ++ spin_unlock(&server->srv_lock); ++ return -ENOENT; ++ } ++ spin_unlock(&server->srv_lock); ++ ++ spin_lock(&server->req_lock); + if (server->credits <= 0) { + spin_unlock(&server->req_lock); + cifs_num_waiters_inc(server); +@@ -218,15 +228,6 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size, + return rc; + spin_lock(&server->req_lock); + } else { +- spin_unlock(&server->req_lock); +- spin_lock(&server->srv_lock); +- if (server->tcpStatus == CifsExiting) { +- spin_unlock(&server->srv_lock); +- return -ENOENT; +- } +- spin_unlock(&server->srv_lock); +- +- spin_lock(&server->req_lock); + scredits = server->credits; + /* can deadlock with reopen */ + if (scredits <= 8) { +diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c +index c961b90f92b9f..e03ffcf7e201c 100644 +--- a/fs/smb/client/transport.c ++++ b/fs/smb/client/transport.c +@@ -549,6 +549,16 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits, + } + + while (1) { ++ spin_unlock(&server->req_lock); ++ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus == CifsExiting) { ++ spin_unlock(&server->srv_lock); ++ return -ENOENT; ++ } ++ spin_unlock(&server->srv_lock); ++ ++ spin_lock(&server->req_lock); + if (*credits < num_credits) { + scredits = *credits; + spin_unlock(&server->req_lock); +@@ -574,15 +584,6 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits, + return -ERESTARTSYS; + spin_lock(&server->req_lock); + } else { +- spin_unlock(&server->req_lock); +- +- spin_lock(&server->srv_lock); +- if (server->tcpStatus == CifsExiting) { +- spin_unlock(&server->srv_lock); +- return -ENOENT; +- } +- spin_unlock(&server->srv_lock); +- + /* + * For normal commands, reserve the last MAX_COMPOUND + * credits to compound requests. +@@ -596,7 +597,6 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits, + * for servers that are slow to hand out credits on + * new sessions. + */ +- spin_lock(&server->req_lock); + if (!optype && num_credits == 1 && + server->in_flight > 2 * MAX_COMPOUND && + *credits <= MAX_COMPOUND) { +-- +2.39.2 + diff --git a/queue-6.1/cifs-prevent-use-after-free-by-freeing-the-cfile-lat.patch b/queue-6.1/cifs-prevent-use-after-free-by-freeing-the-cfile-lat.patch new file mode 100644 index 00000000000..32735d35c4e --- /dev/null +++ b/queue-6.1/cifs-prevent-use-after-free-by-freeing-the-cfile-lat.patch @@ -0,0 +1,52 @@ +From 34ab99ef5cd99e7809c20e41c5a25bfb21723d03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 18:16:03 +0000 +Subject: cifs: prevent use-after-free by freeing the cfile later + +From: Shyam Prasad N + +[ Upstream commit 33f736187d08f6bc822117629f263b97d3df4165 ] + +In smb2_compound_op we have a possible use-after-free +which can cause hard to debug problems later on. + +This was revealed during stress testing with KASAN enabled +kernel. Fixing it by moving the cfile free call to +a few lines below, after the usage. + +Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index c97e049e29dd3..57526bdbab171 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -397,9 +397,6 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + rsp_iov); + + finished: +- if (cfile) +- cifsFileInfo_put(cfile); +- + SMB2_open_free(&rqst[0]); + if (rc == -EREMCHG) { + pr_warn_once("server share %s deleted\n", tcon->tree_name); +@@ -513,6 +510,9 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + break; + } + ++ if (cfile) ++ cifsFileInfo_put(cfile); ++ + if (rc && err_iov && err_buftype) { + memcpy(err_iov, rsp_iov, 3 * sizeof(*err_iov)); + memcpy(err_buftype, resp_buftype, 3 * sizeof(*err_buftype)); +-- +2.39.2 + diff --git a/queue-6.1/clk-bcm-rpi-fix-off-by-one-in-raspberrypi_discover_c.patch b/queue-6.1/clk-bcm-rpi-fix-off-by-one-in-raspberrypi_discover_c.patch new file mode 100644 index 00000000000..eba3edb20dc --- /dev/null +++ b/queue-6.1/clk-bcm-rpi-fix-off-by-one-in-raspberrypi_discover_c.patch @@ -0,0 +1,46 @@ +From 47da85e18961fae51330844cc208dfa547b9b71e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 13:41:01 +0300 +Subject: clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks() + +From: Dan Carpenter + +[ Upstream commit da2edb3e3c09fd1451b7f400ccd1070ef086619a ] + +Smatch detected an off by one in this code: + drivers/clk/bcm/clk-raspberrypi.c:374 raspberrypi_discover_clocks() + error: buffer overflow 'data->hws' 16 <= 16 + +The data->hws[] array has RPI_FIRMWARE_NUM_CLK_ID elements so the > +comparison needs to changed to >=. + +Fixes: 12c90f3f27bb ("clk: bcm: rpi: Add variant structure") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/5a850b08-d2f5-4794-aceb-a6b468965139@kili.mountain +Reviewed-by: Stefan Wahren +Reviewed-by: Florian Fainelli +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/bcm/clk-raspberrypi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c +index 679f4649a7efd..278f845572813 100644 +--- a/drivers/clk/bcm/clk-raspberrypi.c ++++ b/drivers/clk/bcm/clk-raspberrypi.c +@@ -375,9 +375,9 @@ static int raspberrypi_discover_clocks(struct raspberrypi_clk *rpi, + while (clks->id) { + struct raspberrypi_clk_variant *variant; + +- if (clks->id > RPI_FIRMWARE_NUM_CLK_ID) { ++ if (clks->id >= RPI_FIRMWARE_NUM_CLK_ID) { + dev_err(rpi->dev, "Unknown clock id: %u (max: %u)\n", +- clks->id, RPI_FIRMWARE_NUM_CLK_ID); ++ clks->id, RPI_FIRMWARE_NUM_CLK_ID - 1); + return -EINVAL; + } + +-- +2.39.2 + diff --git a/queue-6.1/clk-cdce925-check-return-value-of-kasprintf.patch b/queue-6.1/clk-cdce925-check-return-value-of-kasprintf.patch new file mode 100644 index 00000000000..175ead5d9d9 --- /dev/null +++ b/queue-6.1/clk-cdce925-check-return-value-of-kasprintf.patch @@ -0,0 +1,63 @@ +From 05269ac8be5fb66c44533214e805d73cd10d24b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:07 +0300 +Subject: clk: cdce925: check return value of kasprintf() + +From: Claudiu Beznea + +[ Upstream commit bb7d09ddbf361d51eae46f38e7c8a2b85914ea2a ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 19fbbbbcd3a3 ("Add TI CDCE925 I2C controlled clock synthesizer driver") +Depends-on: e665f029a283 ("clk: Convert to using %pOFn instead of device_node.name") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-3-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-cdce925.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/clk/clk-cdce925.c b/drivers/clk/clk-cdce925.c +index ef9a2d44e40c3..d88e1d681a2ce 100644 +--- a/drivers/clk/clk-cdce925.c ++++ b/drivers/clk/clk-cdce925.c +@@ -714,6 +714,10 @@ static int cdce925_probe(struct i2c_client *client) + for (i = 0; i < data->chip_info->num_plls; ++i) { + pll_clk_name[i] = kasprintf(GFP_KERNEL, "%pOFn.pll%d", + client->dev.of_node, i); ++ if (!pll_clk_name[i]) { ++ err = -ENOMEM; ++ goto error; ++ } + init.name = pll_clk_name[i]; + data->pll[i].chip = data; + data->pll[i].hw.init = &init; +@@ -755,6 +759,10 @@ static int cdce925_probe(struct i2c_client *client) + init.num_parents = 1; + init.parent_names = &parent_name; /* Mux Y1 to input */ + init.name = kasprintf(GFP_KERNEL, "%pOFn.Y1", client->dev.of_node); ++ if (!init.name) { ++ err = -ENOMEM; ++ goto error; ++ } + data->clk[0].chip = data; + data->clk[0].hw.init = &init; + data->clk[0].index = 0; +@@ -773,6 +781,10 @@ static int cdce925_probe(struct i2c_client *client) + for (i = 1; i < data->chip_info->num_outputs; ++i) { + init.name = kasprintf(GFP_KERNEL, "%pOFn.Y%d", + client->dev.of_node, i+1); ++ if (!init.name) { ++ err = -ENOMEM; ++ goto error; ++ } + data->clk[i].chip = data; + data->clk[i].hw.init = &init; + data->clk[i].index = i; +-- +2.39.2 + diff --git a/queue-6.1/clk-clocking-wizard-check-return-value-of-devm_kaspr.patch b/queue-6.1/clk-clocking-wizard-check-return-value-of-devm_kaspr.patch new file mode 100644 index 00000000000..f801957a322 --- /dev/null +++ b/queue-6.1/clk-clocking-wizard-check-return-value-of-devm_kaspr.patch @@ -0,0 +1,41 @@ +From 440417a3c14fc28382c09620dddee82df91b3835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:13 +0300 +Subject: clk: clocking-wizard: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit b1356ed1a4461de06dfdc02bf549c3e8750162e5 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 2046338dcbc6 ("ARM: mxs: Use soc bus infrastructure") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-9-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +index 5c362c622a866..77532c12b140d 100644 +--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c ++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +@@ -648,6 +648,11 @@ static int clk_wzrd_probe(struct platform_device *pdev) + } + + clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_out0", dev_name(&pdev->dev)); ++ if (!clkout_name) { ++ ret = -ENOMEM; ++ goto err_disable_clk; ++ } ++ + if (nr_outputs == 1) { + clk_wzrd->clkout[0] = clk_wzrd_register_divider + (&pdev->dev, clkout_name, +-- +2.39.2 + diff --git a/queue-6.1/clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch b/queue-6.1/clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch new file mode 100644 index 00000000000..68681f72a31 --- /dev/null +++ b/queue-6.1/clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch @@ -0,0 +1,40 @@ +From 190fdd8b43119b940d2c7456498ef4649ff52437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 20:01:20 +0300 +Subject: clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() + +From: Dan Carpenter + +[ Upstream commit 9c632a6396505a019ea6d12b5ab45e659a542a93 ] + +Smatch detected this potential error pointer dereference +clk_wzrd_register_divider(). If devm_clk_hw_register() fails then +it sets "hw" to an error pointer and then dereferences it on the +next line. Return the error directly instead. + +Fixes: 5a853722eb32 ("staging: clocking-wizard: Add support for dynamic reconfiguration") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/f0e39b5c-4554-41e0-80d9-54ca3fabd060@kili.mountain +Reviewed-by: Michal Simek +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +index eb1dfe7ecc1b4..4a23583933bcc 100644 +--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c ++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +@@ -354,7 +354,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + hw = &div->hw; + ret = devm_clk_hw_register(dev, hw); + if (ret) +- hw = ERR_PTR(ret); ++ return ERR_PTR(ret); + + return hw->clk; + } +-- +2.39.2 + diff --git a/queue-6.1/clk-export-clk_hw_forward_rate_request.patch b/queue-6.1/clk-export-clk_hw_forward_rate_request.patch new file mode 100644 index 00000000000..46de04eb875 --- /dev/null +++ b/queue-6.1/clk-export-clk_hw_forward_rate_request.patch @@ -0,0 +1,37 @@ +From 4bca1e5f69b3f1b87dd6cc2f6b3685d757bb6203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 13:25:03 +0200 +Subject: clk: Export clk_hw_forward_rate_request() + +From: Maxime Ripard + +[ Upstream commit ed046ac74da0b5602566073023a1519b5ae657b7 ] + +Commit 262ca38f4b6e ("clk: Stop forwarding clk_rate_requests to the +parent") introduced the public clk_hw_forward_rate_request() function, +but didn't export the symbol. Make sure it's the case. + +Fixes: 262ca38f4b6e ("clk: Stop forwarding clk_rate_requests to the parent") +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20221018-clk-range-checks-fixes-v4-1-971d5077e7d2@cerno.tech +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 57b83665e5c3a..d4a74759fe292 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -1525,6 +1525,7 @@ void clk_hw_forward_rate_request(const struct clk_hw *hw, + parent->core, req, + parent_rate); + } ++EXPORT_SYMBOL_GPL(clk_hw_forward_rate_request); + + static bool clk_core_can_round(struct clk_core * const core) + { +-- +2.39.2 + diff --git a/queue-6.1/clk-fix-memory-leak-in-devm_clk_notifier_register.patch b/queue-6.1/clk-fix-memory-leak-in-devm_clk_notifier_register.patch new file mode 100644 index 00000000000..a0267fd7d66 --- /dev/null +++ b/queue-6.1/clk-fix-memory-leak-in-devm_clk_notifier_register.patch @@ -0,0 +1,42 @@ +From 3aee52681fabbba2ec8e2ced48ea336ee26bb3e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 11:22:53 +0800 +Subject: clk: Fix memory leak in devm_clk_notifier_register() + +From: Fei Shao + +[ Upstream commit 7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff ] + +devm_clk_notifier_register() allocates a devres resource for clk +notifier but didn't register that to the device, so the notifier didn't +get unregistered on device detach and the allocated resource was leaked. + +Fix the issue by registering the resource through devres_add(). + +This issue was found with kmemleak on a Chromebook. + +Fixes: 6d30d50d037d ("clk: add devm variant of clk_notifier_register") +Signed-off-by: Fei Shao +Link: https://lore.kernel.org/r/20230619112253.v2.1.I13f060c10549ef181603e921291bdea95f83033c@changeid +Reviewed-by: Dan Carpenter +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index d4a74759fe292..e0de6565800d2 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -4651,6 +4651,7 @@ int devm_clk_notifier_register(struct device *dev, struct clk *clk, + if (!ret) { + devres->clk = clk; + devres->nb = nb; ++ devres_add(dev, devres); + } else { + devres_free(devres); + } +-- +2.39.2 + diff --git a/queue-6.1/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch b/queue-6.1/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch new file mode 100644 index 00000000000..9bf8f390868 --- /dev/null +++ b/queue-6.1/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch @@ -0,0 +1,58 @@ +From 11a6dd6ae43d28b905b073c438d714b3c9964ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 09:51:07 +0800 +Subject: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe + +From: Hao Luo + +[ Upstream commit 188d070de9132667956f5aadd98d2bd87d3eac89 ] + +Use devm_of_iomap() instead of of_iomap() to automatically handle +the unused ioremap region. + +If any error occurs, regions allocated by kzalloc() will leak, +but using devm_kzalloc() instead will automatically free the memory +using devm_kfree(). + +Fixes: daeb14545514 ("clk: imx: imx8mn: Switch to clk_hw based API") +Fixes: 96d6392b54db ("clk: imx: Add support for i.MX8MN clock driver") +Signed-off-by: Hao Luo +Reviewed-by: Dongliang Mu +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20230411015107.2645-1-m202171776@hust.edu.cn +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mn.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c +index 2afea905f7f3c..b2b8b8b3f0ab8 100644 +--- a/drivers/clk/imx/clk-imx8mn.c ++++ b/drivers/clk/imx/clk-imx8mn.c +@@ -323,7 +323,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev) + void __iomem *base; + int ret; + +- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, ++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, + IMX8MN_CLK_END), GFP_KERNEL); + if (WARN_ON(!clk_hw_data)) + return -ENOMEM; +@@ -340,10 +340,10 @@ static int imx8mn_clocks_probe(struct platform_device *pdev) + hws[IMX8MN_CLK_EXT4] = imx_obtain_fixed_clk_hw(np, "clk_ext4"); + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mn-anatop"); +- base = of_iomap(np, 0); ++ base = devm_of_iomap(dev, np, 0, NULL); + of_node_put(np); +- if (WARN_ON(!base)) { +- ret = -ENOMEM; ++ if (WARN_ON(IS_ERR(base))) { ++ ret = PTR_ERR(base); + goto unregister_hws; + } + +-- +2.39.2 + diff --git a/queue-6.1/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch b/queue-6.1/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch new file mode 100644 index 00000000000..0761b3b43e9 --- /dev/null +++ b/queue-6.1/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch @@ -0,0 +1,85 @@ +From 3dd94b1305bcb156ac187a998c3f03f563db1f47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 07:06:07 +0000 +Subject: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() + +From: Yuxing Liu + +[ Upstream commit 878b02d5f3b56cb090dbe2c70c89273be144087f ] + +Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc() +which can automatically release the related memory when the device +or driver is removed or unloaded to avoid potential memory leak. + +In this case, iounmap(anatop_base) in line 427,433 are removed +as manual release is not required. + +Besides, referring to clk-imx8mq.c, check the return code of +of_clk_add_hw_provider, if it returns negtive, print error info +and unregister hws, which makes the program more robust. + +Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver") +Signed-off-by: Yuxing Liu +Reviewed-by: Dongliang Mu +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230503070607.2462-1-lyx2022@hust.edu.cn +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index 5d68d975b4eb1..05c02f4e2a143 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -413,25 +413,22 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct device_node *np; + void __iomem *anatop_base, *ccm_base; ++ int err; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop"); +- anatop_base = of_iomap(np, 0); ++ anatop_base = devm_of_iomap(dev, np, 0, NULL); + of_node_put(np); +- if (WARN_ON(!anatop_base)) +- return -ENOMEM; ++ if (WARN_ON(IS_ERR(anatop_base))) ++ return PTR_ERR(anatop_base); + + np = dev->of_node; + ccm_base = devm_platform_ioremap_resource(pdev, 0); +- if (WARN_ON(IS_ERR(ccm_base))) { +- iounmap(anatop_base); ++ if (WARN_ON(IS_ERR(ccm_base))) + return PTR_ERR(ccm_base); +- } + +- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL); +- if (WARN_ON(!clk_hw_data)) { +- iounmap(anatop_base); ++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL); ++ if (WARN_ON(!clk_hw_data)) + return -ENOMEM; +- } + + clk_hw_data->num = IMX8MP_CLK_END; + hws = clk_hw_data->hws; +@@ -711,7 +708,12 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + + imx_check_clk_hws(hws, IMX8MP_CLK_END); + +- of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); ++ err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); ++ if (err < 0) { ++ dev_err(dev, "failed to register hws for i.MX8MP\n"); ++ imx_unregister_hw_clocks(hws, IMX8MP_CLK_END); ++ return err; ++ } + + imx_register_uart_clocks(4); + +-- +2.39.2 + diff --git a/queue-6.1/clk-imx-clk-imxrt1050-fix-memory-leak-in-imxrt1050_c.patch b/queue-6.1/clk-imx-clk-imxrt1050-fix-memory-leak-in-imxrt1050_c.patch new file mode 100644 index 00000000000..6a09799a6b1 --- /dev/null +++ b/queue-6.1/clk-imx-clk-imxrt1050-fix-memory-leak-in-imxrt1050_c.patch @@ -0,0 +1,88 @@ +From 144b0c747d3c52def686128b18006ba7ff1ce933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 11:34:51 +0000 +Subject: clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe + +From: Kai Ma + +[ Upstream commit 1b280598ab3bd8a2dc8b96a12530d5b1ee7a8f4a ] + +Use devm_of_iomap() instead of of_iomap() to automatically +handle the unused ioremap region. If any error occurs, regions allocated by +kzalloc() will leak, but using devm_kzalloc() instead will automatically +free the memory using devm_kfree(). + +Also, fix error handling of hws by adding unregister_hws label, which +unregisters remaining hws when iomap failed. + +Fixes: 7154b046d8f3 ("clk: imx: Add initial support for i.MXRT1050 clock driver") +Signed-off-by: Kai Ma +Reviewed-by: Peng Fan +Acked-by: Jesse Taube +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230418113451.151312-1-kaima@hust.edu.cn +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imxrt1050.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/imx/clk-imxrt1050.c b/drivers/clk/imx/clk-imxrt1050.c +index 26108e9f7e67a..64d8b65a81040 100644 +--- a/drivers/clk/imx/clk-imxrt1050.c ++++ b/drivers/clk/imx/clk-imxrt1050.c +@@ -42,7 +42,7 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev) + struct device_node *anp; + int ret; + +- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, ++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, + IMXRT1050_CLK_END), GFP_KERNEL); + if (WARN_ON(!clk_hw_data)) + return -ENOMEM; +@@ -53,10 +53,12 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev) + hws[IMXRT1050_CLK_OSC] = imx_obtain_fixed_clk_hw(np, "osc"); + + anp = of_find_compatible_node(NULL, NULL, "fsl,imxrt-anatop"); +- pll_base = of_iomap(anp, 0); ++ pll_base = devm_of_iomap(dev, anp, 0, NULL); + of_node_put(anp); +- if (WARN_ON(!pll_base)) +- return -ENOMEM; ++ if (WARN_ON(IS_ERR(pll_base))) { ++ ret = PTR_ERR(pll_base); ++ goto unregister_hws; ++ } + + /* Anatop clocks */ + hws[IMXRT1050_CLK_DUMMY] = imx_clk_hw_fixed("dummy", 0UL); +@@ -104,8 +106,10 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev) + + /* CCM clocks */ + ccm_base = devm_platform_ioremap_resource(pdev, 0); +- if (WARN_ON(IS_ERR(ccm_base))) +- return PTR_ERR(ccm_base); ++ if (WARN_ON(IS_ERR(ccm_base))) { ++ ret = PTR_ERR(ccm_base); ++ goto unregister_hws; ++ } + + hws[IMXRT1050_CLK_ARM_PODF] = imx_clk_hw_divider("arm_podf", "pll1_arm", ccm_base + 0x10, 0, 3); + hws[IMXRT1050_CLK_PRE_PERIPH_SEL] = imx_clk_hw_mux("pre_periph_sel", ccm_base + 0x18, 18, 2, +@@ -148,8 +152,12 @@ static int imxrt1050_clocks_probe(struct platform_device *pdev) + ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); + if (ret < 0) { + dev_err(dev, "Failed to register clks for i.MXRT1050.\n"); +- imx_unregister_hw_clocks(hws, IMXRT1050_CLK_END); ++ goto unregister_hws; + } ++ return 0; ++ ++unregister_hws: ++ imx_unregister_hw_clocks(hws, IMXRT1050_CLK_END); + return ret; + } + static const struct of_device_id imxrt1050_clk_of_match[] = { +-- +2.39.2 + diff --git a/queue-6.1/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch b/queue-6.1/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch new file mode 100644 index 00000000000..1b00f11bb1c --- /dev/null +++ b/queue-6.1/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch @@ -0,0 +1,44 @@ +From 809fb96797d9bab0fc81304b7fb60d439e446118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 17:23:01 +0300 +Subject: clk: imx: scu: use _safe list iterator to avoid a use after free + +From: Dan Carpenter + +[ Upstream commit 632c60ecd25dbacee54d5581fe3aeb834b57010a ] + +This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). +Otherwise it dereferences a freed variable to get the next item on the +loop. + +Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support") +Signed-off-by: Dan Carpenter +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/0793fbd1-d2b5-4ec2-9403-3c39343a3e2d@kili.mountain +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-scu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c +index 1e6870f3671f6..db307890e4c16 100644 +--- a/drivers/clk/imx/clk-scu.c ++++ b/drivers/clk/imx/clk-scu.c +@@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name, + + void imx_clk_scu_unregister(void) + { +- struct imx_scu_clk_node *clk; ++ struct imx_scu_clk_node *clk, *n; + int i; + + for (i = 0; i < IMX_SC_R_LAST; i++) { +- list_for_each_entry(clk, &imx_scu_clks[i], node) { ++ list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) { + clk_hw_unregister(clk->hw); + kfree(clk); + } +-- +2.39.2 + diff --git a/queue-6.1/clk-imx93-fix-memory-leak-and-missing-unwind-goto-in.patch b/queue-6.1/clk-imx93-fix-memory-leak-and-missing-unwind-goto-in.patch new file mode 100644 index 00000000000..b8cb8ad9237 --- /dev/null +++ b/queue-6.1/clk-imx93-fix-memory-leak-and-missing-unwind-goto-in.patch @@ -0,0 +1,84 @@ +From 6b2a85edefab9edbe2036b637a012ad8a2485ca9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 03:38:25 +0000 +Subject: clk: imx93: fix memory leak and missing unwind goto in + imx93_clocks_probe + +From: Zhanhao Hu + +[ Upstream commit e02ba11b457647050cb16e7cad16cec3c252fade ] + +In function probe(), it returns directly without unregistered hws +when error occurs. + +Fix this by adding 'goto unregister_hws;' on line 295 and +line 310. + +Use devm_kzalloc() instead of kzalloc() to automatically +free the memory using devm_kfree() when error occurs. + +Replace of_iomap() with devm_of_iomap() to automatically +handle the unused ioremap region and delete 'iounmap(anatop_base);' +in unregister_hws. + +Fixes: 24defbe194b6 ("clk: imx: add i.MX93 clk") +Signed-off-by: Zhanhao Hu +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230601033825.336558-1-zero12113@hust.edu.cn +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx93.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx93.c b/drivers/clk/imx/clk-imx93.c +index 02d6a9894521d..5e3d299190c89 100644 +--- a/drivers/clk/imx/clk-imx93.c ++++ b/drivers/clk/imx/clk-imx93.c +@@ -261,7 +261,7 @@ static int imx93_clocks_probe(struct platform_device *pdev) + void __iomem *base, *anatop_base; + int i, ret; + +- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, ++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, + IMX93_CLK_END), GFP_KERNEL); + if (!clk_hw_data) + return -ENOMEM; +@@ -285,10 +285,12 @@ static int imx93_clocks_probe(struct platform_device *pdev) + "sys_pll_pfd2", 1, 2); + + np = of_find_compatible_node(NULL, NULL, "fsl,imx93-anatop"); +- anatop_base = of_iomap(np, 0); ++ anatop_base = devm_of_iomap(dev, np, 0, NULL); + of_node_put(np); +- if (WARN_ON(!anatop_base)) +- return -ENOMEM; ++ if (WARN_ON(IS_ERR(anatop_base))) { ++ ret = PTR_ERR(base); ++ goto unregister_hws; ++ } + + clks[IMX93_CLK_AUDIO_PLL] = imx_clk_fracn_gppll("audio_pll", "osc_24m", anatop_base + 0x1200, + &imx_fracn_gppll); +@@ -298,8 +300,8 @@ static int imx93_clocks_probe(struct platform_device *pdev) + np = dev->of_node; + base = devm_platform_ioremap_resource(pdev, 0); + if (WARN_ON(IS_ERR(base))) { +- iounmap(anatop_base); +- return PTR_ERR(base); ++ ret = PTR_ERR(base); ++ goto unregister_hws; + } + + for (i = 0; i < ARRAY_SIZE(root_array); i++) { +@@ -329,7 +331,6 @@ static int imx93_clocks_probe(struct platform_device *pdev) + + unregister_hws: + imx_unregister_hw_clocks(clks, IMX93_CLK_END); +- iounmap(anatop_base); + + return ret; + } +-- +2.39.2 + diff --git a/queue-6.1/clk-keystone-sci-clk-check-return-value-of-kasprintf.patch b/queue-6.1/clk-keystone-sci-clk-check-return-value-of-kasprintf.patch new file mode 100644 index 00000000000..4226e756594 --- /dev/null +++ b/queue-6.1/clk-keystone-sci-clk-check-return-value-of-kasprintf.patch @@ -0,0 +1,40 @@ +From 74daa64c97e30934125aec61c305f31e42bae4f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:11 +0300 +Subject: clk: keystone: sci-clk: check return value of kasprintf() + +From: Claudiu Beznea + +[ Upstream commit b73ed981da6d25c921aaefa7ca3df85bbd85b7fc ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support") +Depends-on: 96488c09b0f4 ("clk: keystone: sci-clk: cut down the clock name length") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-7-claudiu.beznea@microchip.com +Reviewed-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/keystone/sci-clk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c +index d4b4e74e22da6..254f2cf24be21 100644 +--- a/drivers/clk/keystone/sci-clk.c ++++ b/drivers/clk/keystone/sci-clk.c +@@ -294,6 +294,8 @@ static int _sci_clk_build(struct sci_clk_provider *provider, + + name = kasprintf(GFP_KERNEL, "clk:%d:%d", sci_clk->dev_id, + sci_clk->clk_id); ++ if (!name) ++ return -ENOMEM; + + init.name = name; + +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-clk-gate-propagate-struct-device-with-m.patch b/queue-6.1/clk-mediatek-clk-gate-propagate-struct-device-with-m.patch new file mode 100644 index 00000000000..3cf4194411b --- /dev/null +++ b/queue-6.1/clk-mediatek-clk-gate-propagate-struct-device-with-m.patch @@ -0,0 +1,1236 @@ +From 9be0cd0c896be81d1ec3af652ab5fcee9f87589e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 10:20:33 +0100 +Subject: clk: mediatek: clk-gate: Propagate struct device with + mtk_clk_register_gates() + +From: AngeloGioacchino Del Regno + +[ Upstream commit 20498d52c9c1a68b1d92c42bce1dc893d3e74f30 ] + +Commit e4c23e19aa2a ("clk: mediatek: Register clock gate with device") +introduces a helper function for the sole purpose of propagating a +struct device pointer to the clk API when registering the mtk-gate +clocks to take advantage of Runtime PM when/where needed and where +a power domain is defined in devicetree. + +Function mtk_clk_register_gates() then becomes a wrapper around the +new mtk_clk_register_gates_with_dev() function that will simply pass +NULL as struct device: this is essential when registering drivers +with CLK_OF_DECLARE instead of as a platform device, as there will +be no struct device to pass... but we can as well simply have only +one function that always takes such pointer as a param and pass NULL +when unavoidable. + +This commit removes the mtk_clk_register_gates() wrapper and renames +mtk_clk_register_gates_with_dev() to the former and all of the calls +to either of the two functions were fixed in all drivers in order to +reflect this change; also, to improve consistency with other kernel +functions, the pointer to struct device was moved as the first param. + +Since a lot of MediaTek clock drivers are actually registering as a +platform device, but were still registering the mtk-gate clocks +without passing any struct device to the clock framework, they've +been changed to pass a valid one now, as to make all those platforms +able to use runtime power management where available. + +While at it, some much needed indentation changes were also done. + +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Reviewed-by: Markus Schneider-Pargmann +Tested-by: Miles Chen +Link: https://lore.kernel.org/r/20230120092053.182923-4-angelogioacchino.delregno@collabora.com +Tested-by: Mingming Su +Signed-off-by: Stephen Boyd +Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-gate.c | 23 ++++++------------- + drivers/clk/mediatek/clk-gate.h | 7 +----- + drivers/clk/mediatek/clk-mt2701-aud.c | 4 ++-- + drivers/clk/mediatek/clk-mt2701-eth.c | 4 ++-- + drivers/clk/mediatek/clk-mt2701-g3d.c | 2 +- + drivers/clk/mediatek/clk-mt2701-hif.c | 4 ++-- + drivers/clk/mediatek/clk-mt2701-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt2701.c | 12 +++++----- + drivers/clk/mediatek/clk-mt2712-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt2712.c | 12 +++++----- + drivers/clk/mediatek/clk-mt6765.c | 10 ++++---- + drivers/clk/mediatek/clk-mt6779-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt6779.c | 6 ++--- + drivers/clk/mediatek/clk-mt6795-infracfg.c | 3 ++- + drivers/clk/mediatek/clk-mt6795-mm.c | 3 ++- + drivers/clk/mediatek/clk-mt6795-pericfg.c | 3 ++- + drivers/clk/mediatek/clk-mt6797-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt6797.c | 4 ++-- + drivers/clk/mediatek/clk-mt7622-aud.c | 4 ++-- + drivers/clk/mediatek/clk-mt7622-eth.c | 8 +++---- + drivers/clk/mediatek/clk-mt7622-hif.c | 8 +++---- + drivers/clk/mediatek/clk-mt7622.c | 14 ++++++------ + drivers/clk/mediatek/clk-mt7629-eth.c | 7 +++--- + drivers/clk/mediatek/clk-mt7629-hif.c | 8 +++---- + drivers/clk/mediatek/clk-mt7629.c | 10 ++++---- + drivers/clk/mediatek/clk-mt7986-eth.c | 10 ++++---- + drivers/clk/mediatek/clk-mt7986-infracfg.c | 4 ++-- + drivers/clk/mediatek/clk-mt8135.c | 8 +++---- + drivers/clk/mediatek/clk-mt8167-aud.c | 2 +- + drivers/clk/mediatek/clk-mt8167-img.c | 2 +- + drivers/clk/mediatek/clk-mt8167-mfgcfg.c | 2 +- + drivers/clk/mediatek/clk-mt8167-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt8167-vdec.c | 3 ++- + drivers/clk/mediatek/clk-mt8167.c | 2 +- + drivers/clk/mediatek/clk-mt8173-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt8173.c | 24 ++++++++++---------- + drivers/clk/mediatek/clk-mt8183-audio.c | 4 ++-- + drivers/clk/mediatek/clk-mt8183-mm.c | 4 ++-- + drivers/clk/mediatek/clk-mt8183.c | 16 ++++++------- + drivers/clk/mediatek/clk-mt8186-mm.c | 3 ++- + drivers/clk/mediatek/clk-mt8192-aud.c | 3 ++- + drivers/clk/mediatek/clk-mt8192-mm.c | 3 ++- + drivers/clk/mediatek/clk-mt8192.c | 17 +++++++------- + drivers/clk/mediatek/clk-mt8195-apmixedsys.c | 3 ++- + drivers/clk/mediatek/clk-mt8195-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt8195-vdo0.c | 3 ++- + drivers/clk/mediatek/clk-mt8195-vdo1.c | 3 ++- + drivers/clk/mediatek/clk-mt8365-mm.c | 5 ++-- + drivers/clk/mediatek/clk-mt8365.c | 4 ++-- + drivers/clk/mediatek/clk-mt8516-aud.c | 2 +- + drivers/clk/mediatek/clk-mt8516.c | 2 +- + drivers/clk/mediatek/clk-mtk.c | 4 ++-- + 52 files changed, 156 insertions(+), 160 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-gate.c b/drivers/clk/mediatek/clk-gate.c +index 0c867136e49d7..67d9e741c5e73 100644 +--- a/drivers/clk/mediatek/clk-gate.c ++++ b/drivers/clk/mediatek/clk-gate.c +@@ -152,12 +152,12 @@ const struct clk_ops mtk_clk_gate_ops_no_setclr_inv = { + }; + EXPORT_SYMBOL_GPL(mtk_clk_gate_ops_no_setclr_inv); + +-static struct clk_hw *mtk_clk_register_gate(const char *name, ++static struct clk_hw *mtk_clk_register_gate(struct device *dev, const char *name, + const char *parent_name, + struct regmap *regmap, int set_ofs, + int clr_ofs, int sta_ofs, u8 bit, + const struct clk_ops *ops, +- unsigned long flags, struct device *dev) ++ unsigned long flags) + { + struct mtk_clk_gate *cg; + int ret; +@@ -202,10 +202,9 @@ static void mtk_clk_unregister_gate(struct clk_hw *hw) + kfree(cg); + } + +-int mtk_clk_register_gates_with_dev(struct device_node *node, +- const struct mtk_gate *clks, int num, +- struct clk_hw_onecell_data *clk_data, +- struct device *dev) ++int mtk_clk_register_gates(struct device *dev, struct device_node *node, ++ const struct mtk_gate *clks, int num, ++ struct clk_hw_onecell_data *clk_data) + { + int i; + struct clk_hw *hw; +@@ -229,13 +228,13 @@ int mtk_clk_register_gates_with_dev(struct device_node *node, + continue; + } + +- hw = mtk_clk_register_gate(gate->name, gate->parent_name, ++ hw = mtk_clk_register_gate(dev, gate->name, gate->parent_name, + regmap, + gate->regs->set_ofs, + gate->regs->clr_ofs, + gate->regs->sta_ofs, + gate->shift, gate->ops, +- gate->flags, dev); ++ gate->flags); + + if (IS_ERR(hw)) { + pr_err("Failed to register clk %s: %pe\n", gate->name, +@@ -261,14 +260,6 @@ int mtk_clk_register_gates_with_dev(struct device_node *node, + + return PTR_ERR(hw); + } +-EXPORT_SYMBOL_GPL(mtk_clk_register_gates_with_dev); +- +-int mtk_clk_register_gates(struct device_node *node, +- const struct mtk_gate *clks, int num, +- struct clk_hw_onecell_data *clk_data) +-{ +- return mtk_clk_register_gates_with_dev(node, clks, num, clk_data, NULL); +-} + EXPORT_SYMBOL_GPL(mtk_clk_register_gates); + + void mtk_clk_unregister_gates(const struct mtk_gate *clks, int num, +diff --git a/drivers/clk/mediatek/clk-gate.h b/drivers/clk/mediatek/clk-gate.h +index d9897ef535284..1a46b4c56fc5d 100644 +--- a/drivers/clk/mediatek/clk-gate.h ++++ b/drivers/clk/mediatek/clk-gate.h +@@ -50,15 +50,10 @@ struct mtk_gate { + #define GATE_MTK(_id, _name, _parent, _regs, _shift, _ops) \ + GATE_MTK_FLAGS(_id, _name, _parent, _regs, _shift, _ops, 0) + +-int mtk_clk_register_gates(struct device_node *node, ++int mtk_clk_register_gates(struct device *dev, struct device_node *node, + const struct mtk_gate *clks, int num, + struct clk_hw_onecell_data *clk_data); + +-int mtk_clk_register_gates_with_dev(struct device_node *node, +- const struct mtk_gate *clks, int num, +- struct clk_hw_onecell_data *clk_data, +- struct device *dev); +- + void mtk_clk_unregister_gates(const struct mtk_gate *clks, int num, + struct clk_hw_onecell_data *clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt2701-aud.c b/drivers/clk/mediatek/clk-mt2701-aud.c +index 4287bd3f545ee..03ab212aa7f4e 100644 +--- a/drivers/clk/mediatek/clk-mt2701-aud.c ++++ b/drivers/clk/mediatek/clk-mt2701-aud.c +@@ -127,8 +127,8 @@ static int clk_mt2701_aud_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_AUD_NR); + +- mtk_clk_register_gates(node, audio_clks, ARRAY_SIZE(audio_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, audio_clks, ++ ARRAY_SIZE(audio_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) { +diff --git a/drivers/clk/mediatek/clk-mt2701-eth.c b/drivers/clk/mediatek/clk-mt2701-eth.c +index 601358748750e..924725d67c13e 100644 +--- a/drivers/clk/mediatek/clk-mt2701-eth.c ++++ b/drivers/clk/mediatek/clk-mt2701-eth.c +@@ -51,8 +51,8 @@ static int clk_mt2701_eth_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_ETHSYS_NR); + +- mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, eth_clks, ++ ARRAY_SIZE(eth_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt2701-g3d.c b/drivers/clk/mediatek/clk-mt2701-g3d.c +index 8d1fc8e3336eb..501fb99bb41a2 100644 +--- a/drivers/clk/mediatek/clk-mt2701-g3d.c ++++ b/drivers/clk/mediatek/clk-mt2701-g3d.c +@@ -45,7 +45,7 @@ static int clk_mt2701_g3dsys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_G3DSYS_NR); + +- mtk_clk_register_gates(node, g3d_clks, ARRAY_SIZE(g3d_clks), ++ mtk_clk_register_gates(&pdev->dev, node, g3d_clks, ARRAY_SIZE(g3d_clks), + clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); +diff --git a/drivers/clk/mediatek/clk-mt2701-hif.c b/drivers/clk/mediatek/clk-mt2701-hif.c +index edeeb033a2350..1ddefc21d6a0d 100644 +--- a/drivers/clk/mediatek/clk-mt2701-hif.c ++++ b/drivers/clk/mediatek/clk-mt2701-hif.c +@@ -48,8 +48,8 @@ static int clk_mt2701_hif_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_HIFSYS_NR); + +- mtk_clk_register_gates(node, hif_clks, ARRAY_SIZE(hif_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, hif_clks, ++ ARRAY_SIZE(hif_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) { +diff --git a/drivers/clk/mediatek/clk-mt2701-mm.c b/drivers/clk/mediatek/clk-mt2701-mm.c +index eb069f3bc9a2b..f4885dffb324f 100644 +--- a/drivers/clk/mediatek/clk-mt2701-mm.c ++++ b/drivers/clk/mediatek/clk-mt2701-mm.c +@@ -76,8 +76,8 @@ static int clk_mt2701_mm_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MM_NR); + +- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c +index 1c3a93143dc5e..6c9350e1240fa 100644 +--- a/drivers/clk/mediatek/clk-mt2701.c ++++ b/drivers/clk/mediatek/clk-mt2701.c +@@ -683,8 +683,8 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), + base, &mt2701_clk_lock, clk_data); + +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +@@ -783,8 +783,8 @@ static int mtk_infrasys_init(struct platform_device *pdev) + } + } + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- infra_clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), infra_clk_data); + mtk_clk_register_factors(infra_fixed_divs, ARRAY_SIZE(infra_fixed_divs), + infra_clk_data); + +@@ -894,8 +894,8 @@ static int mtk_pericfg_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR); + +- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, peri_clks, ++ ARRAY_SIZE(peri_clks), clk_data); + + mtk_clk_register_composites(peri_muxs, ARRAY_SIZE(peri_muxs), base, + &mt2701_clk_lock, clk_data); +diff --git a/drivers/clk/mediatek/clk-mt2712-mm.c b/drivers/clk/mediatek/clk-mt2712-mm.c +index ad6daa8f28a83..e5264f1ce60d0 100644 +--- a/drivers/clk/mediatek/clk-mt2712-mm.c ++++ b/drivers/clk/mediatek/clk-mt2712-mm.c +@@ -117,8 +117,8 @@ static int clk_mt2712_mm_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK); + +- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c +index d6c2cc183b1a1..78ebb4f2335c1 100644 +--- a/drivers/clk/mediatek/clk-mt2712.c ++++ b/drivers/clk/mediatek/clk-mt2712.c +@@ -1324,8 +1324,8 @@ static int clk_mt2712_top_probe(struct platform_device *pdev) + &mt2712_clk_lock, top_clk_data); + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, + &mt2712_clk_lock, top_clk_data); +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), +- top_clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), top_clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, top_clk_data); + +@@ -1344,8 +1344,8 @@ static int clk_mt2712_infra_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +@@ -1366,8 +1366,8 @@ static int clk_mt2712_peri_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK); + +- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, peri_clks, ++ ARRAY_SIZE(peri_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c +index 665981fc411f5..a94851d11d774 100644 +--- a/drivers/clk/mediatek/clk-mt6765.c ++++ b/drivers/clk/mediatek/clk-mt6765.c +@@ -741,7 +741,7 @@ static int clk_mt6765_apmixed_probe(struct platform_device *pdev) + + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); + +- mtk_clk_register_gates(node, apmixed_clks, ++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, + ARRAY_SIZE(apmixed_clks), clk_data); + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +@@ -780,8 +780,8 @@ static int clk_mt6765_top_probe(struct platform_device *pdev) + clk_data); + mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node, + &mt6765_clk_lock, clk_data); +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +@@ -814,8 +814,8 @@ static int clk_mt6765_ifr_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK); + +- mtk_clk_register_gates(node, ifr_clks, ARRAY_SIZE(ifr_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, ifr_clks, ++ ARRAY_SIZE(ifr_clks), clk_data); + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + + if (r) +diff --git a/drivers/clk/mediatek/clk-mt6779-mm.c b/drivers/clk/mediatek/clk-mt6779-mm.c +index eda8cbee3d234..2cccf62d3b36f 100644 +--- a/drivers/clk/mediatek/clk-mt6779-mm.c ++++ b/drivers/clk/mediatek/clk-mt6779-mm.c +@@ -93,8 +93,8 @@ static int clk_mt6779_mm_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK); + +- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c +index 0d0a90ee5eb2c..559d4d596e0c3 100644 +--- a/drivers/clk/mediatek/clk-mt6779.c ++++ b/drivers/clk/mediatek/clk-mt6779.c +@@ -1221,7 +1221,7 @@ static int clk_mt6779_apmixed_probe(struct platform_device *pdev) + + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); + +- mtk_clk_register_gates(node, apmixed_clks, ++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, + ARRAY_SIZE(apmixed_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); +@@ -1263,8 +1263,8 @@ static int clk_mt6779_infra_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +diff --git a/drivers/clk/mediatek/clk-mt6795-infracfg.c b/drivers/clk/mediatek/clk-mt6795-infracfg.c +index df7eed6e071e3..8025d171d6923 100644 +--- a/drivers/clk/mediatek/clk-mt6795-infracfg.c ++++ b/drivers/clk/mediatek/clk-mt6795-infracfg.c +@@ -101,7 +101,8 @@ static int clk_mt6795_infracfg_probe(struct platform_device *pdev) + if (ret) + goto free_clk_data; + +- ret = mtk_clk_register_gates(node, infra_gates, ARRAY_SIZE(infra_gates), clk_data); ++ ret = mtk_clk_register_gates(&pdev->dev, node, infra_gates, ++ ARRAY_SIZE(infra_gates), clk_data); + if (ret) + goto free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt6795-mm.c b/drivers/clk/mediatek/clk-mt6795-mm.c +index fd73f202f2925..eebb6143ada22 100644 +--- a/drivers/clk/mediatek/clk-mt6795-mm.c ++++ b/drivers/clk/mediatek/clk-mt6795-mm.c +@@ -87,7 +87,8 @@ static int clk_mt6795_mm_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- ret = mtk_clk_register_gates(node, mm_gates, ARRAY_SIZE(mm_gates), clk_data); ++ ret = mtk_clk_register_gates(&pdev->dev, node, mm_gates, ++ ARRAY_SIZE(mm_gates), clk_data); + if (ret) + goto free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt6795-pericfg.c b/drivers/clk/mediatek/clk-mt6795-pericfg.c +index cb28d35dad59b..f69e715e0c1f3 100644 +--- a/drivers/clk/mediatek/clk-mt6795-pericfg.c ++++ b/drivers/clk/mediatek/clk-mt6795-pericfg.c +@@ -109,7 +109,8 @@ static int clk_mt6795_pericfg_probe(struct platform_device *pdev) + if (ret) + goto free_clk_data; + +- ret = mtk_clk_register_gates(node, peri_gates, ARRAY_SIZE(peri_gates), clk_data); ++ ret = mtk_clk_register_gates(&pdev->dev, node, peri_gates, ++ ARRAY_SIZE(peri_gates), clk_data); + if (ret) + goto free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt6797-mm.c b/drivers/clk/mediatek/clk-mt6797-mm.c +index 99a63f46642fa..d5e9fe445e308 100644 +--- a/drivers/clk/mediatek/clk-mt6797-mm.c ++++ b/drivers/clk/mediatek/clk-mt6797-mm.c +@@ -89,8 +89,8 @@ static int clk_mt6797_mm_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MM_NR); + +- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c +index 78339cb35beb0..9cb7d4eb4918d 100644 +--- a/drivers/clk/mediatek/clk-mt6797.c ++++ b/drivers/clk/mediatek/clk-mt6797.c +@@ -578,8 +578,8 @@ static int mtk_infrasys_init(struct platform_device *pdev) + } + } + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- infra_clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), infra_clk_data); + mtk_clk_register_factors(infra_fixed_divs, ARRAY_SIZE(infra_fixed_divs), + infra_clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt7622-aud.c b/drivers/clk/mediatek/clk-mt7622-aud.c +index b17731fa11445..e9070d0bea8d6 100644 +--- a/drivers/clk/mediatek/clk-mt7622-aud.c ++++ b/drivers/clk/mediatek/clk-mt7622-aud.c +@@ -114,8 +114,8 @@ static int clk_mt7622_audiosys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_AUDIO_NR_CLK); + +- mtk_clk_register_gates(node, audio_clks, ARRAY_SIZE(audio_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, audio_clks, ++ ARRAY_SIZE(audio_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) { +diff --git a/drivers/clk/mediatek/clk-mt7622-eth.c b/drivers/clk/mediatek/clk-mt7622-eth.c +index a60190e834186..ece0f7a7c5f62 100644 +--- a/drivers/clk/mediatek/clk-mt7622-eth.c ++++ b/drivers/clk/mediatek/clk-mt7622-eth.c +@@ -69,8 +69,8 @@ static int clk_mt7622_ethsys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK); + +- mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, eth_clks, ++ ARRAY_SIZE(eth_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -91,8 +91,8 @@ static int clk_mt7622_sgmiisys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK); + +- mtk_clk_register_gates(node, sgmii_clks, ARRAY_SIZE(sgmii_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, sgmii_clks, ++ ARRAY_SIZE(sgmii_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt7622-hif.c b/drivers/clk/mediatek/clk-mt7622-hif.c +index 55baa6d06a205..c57ac2273c4e2 100644 +--- a/drivers/clk/mediatek/clk-mt7622-hif.c ++++ b/drivers/clk/mediatek/clk-mt7622-hif.c +@@ -80,8 +80,8 @@ static int clk_mt7622_ssusbsys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_SSUSB_NR_CLK); + +- mtk_clk_register_gates(node, ssusb_clks, ARRAY_SIZE(ssusb_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, ssusb_clks, ++ ARRAY_SIZE(ssusb_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -102,8 +102,8 @@ static int clk_mt7622_pciesys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PCIE_NR_CLK); + +- mtk_clk_register_gates(node, pcie_clks, ARRAY_SIZE(pcie_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, pcie_clks, ++ ARRAY_SIZE(pcie_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c +index eebbb87906930..bba88018f056a 100644 +--- a/drivers/clk/mediatek/clk-mt7622.c ++++ b/drivers/clk/mediatek/clk-mt7622.c +@@ -621,8 +621,8 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), + base, &mt7622_clk_lock, clk_data); + +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +@@ -635,8 +635,8 @@ static int mtk_infrasys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + mtk_clk_register_cpumuxes(node, infra_muxes, ARRAY_SIZE(infra_muxes), + clk_data); +@@ -663,7 +663,7 @@ static int mtk_apmixedsys_init(struct platform_device *pdev) + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), + clk_data); + +- mtk_clk_register_gates(node, apmixed_clks, ++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, + ARRAY_SIZE(apmixed_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); +@@ -682,8 +682,8 @@ static int mtk_pericfg_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK); + +- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, peri_clks, ++ ARRAY_SIZE(peri_clks), clk_data); + + mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base, + &mt7622_clk_lock, clk_data); +diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c +index b0c8fa3b8bbec..719a47fef7980 100644 +--- a/drivers/clk/mediatek/clk-mt7629-eth.c ++++ b/drivers/clk/mediatek/clk-mt7629-eth.c +@@ -80,7 +80,8 @@ static int clk_mt7629_ethsys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK); + +- mtk_clk_register_gates(node, eth_clks, CLK_ETH_NR_CLK, clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, eth_clks, ++ CLK_ETH_NR_CLK, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -102,8 +103,8 @@ static int clk_mt7629_sgmiisys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK); + +- mtk_clk_register_gates(node, sgmii_clks[id++], CLK_SGMII_NR_CLK, +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, sgmii_clks[id++], ++ CLK_SGMII_NR_CLK, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt7629-hif.c b/drivers/clk/mediatek/clk-mt7629-hif.c +index 3628811a2f57f..804900792e490 100644 +--- a/drivers/clk/mediatek/clk-mt7629-hif.c ++++ b/drivers/clk/mediatek/clk-mt7629-hif.c +@@ -75,8 +75,8 @@ static int clk_mt7629_ssusbsys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_SSUSB_NR_CLK); + +- mtk_clk_register_gates(node, ssusb_clks, ARRAY_SIZE(ssusb_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, ssusb_clks, ++ ARRAY_SIZE(ssusb_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -97,8 +97,8 @@ static int clk_mt7629_pciesys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PCIE_NR_CLK); + +- mtk_clk_register_gates(node, pcie_clks, ARRAY_SIZE(pcie_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, pcie_clks, ++ ARRAY_SIZE(pcie_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c +index 0bc88b7d171b5..6642e00cfc7a7 100644 +--- a/drivers/clk/mediatek/clk-mt7629.c ++++ b/drivers/clk/mediatek/clk-mt7629.c +@@ -581,8 +581,8 @@ static int mtk_infrasys_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + mtk_clk_register_cpumuxes(node, infra_muxes, ARRAY_SIZE(infra_muxes), + clk_data); +@@ -604,8 +604,8 @@ static int mtk_pericfg_init(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK); + +- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, peri_clks, ++ ARRAY_SIZE(peri_clks), clk_data); + + mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base, + &mt7629_clk_lock, clk_data); +@@ -631,7 +631,7 @@ static int mtk_apmixedsys_init(struct platform_device *pdev) + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), + clk_data); + +- mtk_clk_register_gates(node, apmixed_clks, ++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, + ARRAY_SIZE(apmixed_clks), clk_data); + + clk_prepare_enable(clk_data->hws[CLK_APMIXED_ARMPLL]->clk); +diff --git a/drivers/clk/mediatek/clk-mt7986-eth.c b/drivers/clk/mediatek/clk-mt7986-eth.c +index c21e1d672384a..e04bc6845ea6d 100644 +--- a/drivers/clk/mediatek/clk-mt7986-eth.c ++++ b/drivers/clk/mediatek/clk-mt7986-eth.c +@@ -72,8 +72,8 @@ static void __init mtk_sgmiisys_0_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii0_clks)); + +- mtk_clk_register_gates(node, sgmii0_clks, ARRAY_SIZE(sgmii0_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, sgmii0_clks, ++ ARRAY_SIZE(sgmii0_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -90,8 +90,8 @@ static void __init mtk_sgmiisys_1_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(ARRAY_SIZE(sgmii1_clks)); + +- mtk_clk_register_gates(node, sgmii1_clks, ARRAY_SIZE(sgmii1_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, sgmii1_clks, ++ ARRAY_SIZE(sgmii1_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +@@ -109,7 +109,7 @@ static void __init mtk_ethsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(ARRAY_SIZE(eth_clks)); + +- mtk_clk_register_gates(node, eth_clks, ARRAY_SIZE(eth_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, eth_clks, ARRAY_SIZE(eth_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt7986-infracfg.c b/drivers/clk/mediatek/clk-mt7986-infracfg.c +index 74e68a7197301..578f150e0ee52 100644 +--- a/drivers/clk/mediatek/clk-mt7986-infracfg.c ++++ b/drivers/clk/mediatek/clk-mt7986-infracfg.c +@@ -180,8 +180,8 @@ static int clk_mt7986_infracfg_probe(struct platform_device *pdev) + mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data); + mtk_clk_register_muxes(infra_muxes, ARRAY_SIZE(infra_muxes), node, + &mt7986_clk_lock, clk_data); +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) { +diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c +index 3ea06d2ec2f11..8137cf2252724 100644 +--- a/drivers/clk/mediatek/clk-mt8135.c ++++ b/drivers/clk/mediatek/clk-mt8135.c +@@ -553,8 +553,8 @@ static void __init mtk_infrasys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -579,8 +579,8 @@ static void __init mtk_pericfg_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK); + +- mtk_clk_register_gates(node, peri_gates, ARRAY_SIZE(peri_gates), +- clk_data); ++ mtk_clk_register_gates(NULL, node, peri_gates, ++ ARRAY_SIZE(peri_gates), clk_data); + mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base, + &mt8135_clk_lock, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt8167-aud.c b/drivers/clk/mediatek/clk-mt8167-aud.c +index b5ac196cd9454..47a7d89d5777c 100644 +--- a/drivers/clk/mediatek/clk-mt8167-aud.c ++++ b/drivers/clk/mediatek/clk-mt8167-aud.c +@@ -50,7 +50,7 @@ static void __init mtk_audsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_AUD_NR_CLK); + +- mtk_clk_register_gates(node, aud_clks, ARRAY_SIZE(aud_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, aud_clks, ARRAY_SIZE(aud_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8167-img.c b/drivers/clk/mediatek/clk-mt8167-img.c +index 4e7c0772b4f99..e196b3b894a16 100644 +--- a/drivers/clk/mediatek/clk-mt8167-img.c ++++ b/drivers/clk/mediatek/clk-mt8167-img.c +@@ -42,7 +42,7 @@ static void __init mtk_imgsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_IMG_NR_CLK); + +- mtk_clk_register_gates(node, img_clks, ARRAY_SIZE(img_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, img_clks, ARRAY_SIZE(img_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c +index 192714498b2ec..602d25f4cb2e2 100644 +--- a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c ++++ b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c +@@ -40,7 +40,7 @@ static void __init mtk_mfgcfg_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_MFG_NR_CLK); + +- mtk_clk_register_gates(node, mfg_clks, ARRAY_SIZE(mfg_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, mfg_clks, ARRAY_SIZE(mfg_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt8167-mm.c b/drivers/clk/mediatek/clk-mt8167-mm.c +index a94961b7b8cc6..abc70e1221bf9 100644 +--- a/drivers/clk/mediatek/clk-mt8167-mm.c ++++ b/drivers/clk/mediatek/clk-mt8167-mm.c +@@ -98,8 +98,8 @@ static int clk_mt8167_mm_probe(struct platform_device *pdev) + + data = &mt8167_mmsys_driver_data; + +- ret = mtk_clk_register_gates(node, data->gates_clk, data->gates_num, +- clk_data); ++ ret = mtk_clk_register_gates(&pdev->dev, node, data->gates_clk, ++ data->gates_num, clk_data); + if (ret) + return ret; + +diff --git a/drivers/clk/mediatek/clk-mt8167-vdec.c b/drivers/clk/mediatek/clk-mt8167-vdec.c +index 38f0ba357d599..92bc05d997985 100644 +--- a/drivers/clk/mediatek/clk-mt8167-vdec.c ++++ b/drivers/clk/mediatek/clk-mt8167-vdec.c +@@ -49,7 +49,8 @@ static void __init mtk_vdecsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_VDEC_NR_CLK); + +- mtk_clk_register_gates(node, vdec_clks, ARRAY_SIZE(vdec_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, vdec_clks, ARRAY_SIZE(vdec_clks), ++ clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt8167.c b/drivers/clk/mediatek/clk-mt8167.c +index f900ac4bf7b8d..59fe82ba5c7a1 100644 +--- a/drivers/clk/mediatek/clk-mt8167.c ++++ b/drivers/clk/mediatek/clk-mt8167.c +@@ -937,7 +937,7 @@ static void __init mtk_topckgen_init(struct device_node *node) + + mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks), + clk_data); +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data); + + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); + mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +diff --git a/drivers/clk/mediatek/clk-mt8173-mm.c b/drivers/clk/mediatek/clk-mt8173-mm.c +index 5826eabdc9c77..444a3d58c8bf5 100644 +--- a/drivers/clk/mediatek/clk-mt8173-mm.c ++++ b/drivers/clk/mediatek/clk-mt8173-mm.c +@@ -112,8 +112,8 @@ static int clk_mt8173_mm_probe(struct platform_device *pdev) + + data = &mt8173_mmsys_driver_data; + +- ret = mtk_clk_register_gates(node, data->gates_clk, data->gates_num, +- clk_data); ++ ret = mtk_clk_register_gates(&pdev->dev, node, data->gates_clk, ++ data->gates_num, clk_data); + if (ret) + return ret; + +diff --git a/drivers/clk/mediatek/clk-mt8173.c b/drivers/clk/mediatek/clk-mt8173.c +index b8529ee7199da..74ed7dd129f47 100644 +--- a/drivers/clk/mediatek/clk-mt8173.c ++++ b/drivers/clk/mediatek/clk-mt8173.c +@@ -888,8 +888,8 @@ static void __init mtk_infrasys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data); + + mtk_clk_register_cpumuxes(node, cpu_muxes, ARRAY_SIZE(cpu_muxes), +@@ -918,8 +918,8 @@ static void __init mtk_pericfg_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK); + +- mtk_clk_register_gates(node, peri_gates, ARRAY_SIZE(peri_gates), +- clk_data); ++ mtk_clk_register_gates(NULL, node, peri_gates, ++ ARRAY_SIZE(peri_gates), clk_data); + mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base, + &mt8173_clk_lock, clk_data); + +@@ -1062,8 +1062,8 @@ static void __init mtk_imgsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_IMG_NR_CLK); + +- mtk_clk_register_gates(node, img_clks, ARRAY_SIZE(img_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, img_clks, ++ ARRAY_SIZE(img_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +@@ -1080,8 +1080,8 @@ static void __init mtk_vdecsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_VDEC_NR_CLK); + +- mtk_clk_register_gates(node, vdec_clks, ARRAY_SIZE(vdec_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, vdec_clks, ++ ARRAY_SIZE(vdec_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -1097,8 +1097,8 @@ static void __init mtk_vencsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_VENC_NR_CLK); + +- mtk_clk_register_gates(node, venc_clks, ARRAY_SIZE(venc_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, venc_clks, ++ ARRAY_SIZE(venc_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -1114,8 +1114,8 @@ static void __init mtk_vencltsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_VENCLT_NR_CLK); + +- mtk_clk_register_gates(node, venclt_clks, ARRAY_SIZE(venclt_clks), +- clk_data); ++ mtk_clk_register_gates(NULL, node, venclt_clks, ++ ARRAY_SIZE(venclt_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8183-audio.c b/drivers/clk/mediatek/clk-mt8183-audio.c +index b2d7746eddbed..f358a6e7a3408 100644 +--- a/drivers/clk/mediatek/clk-mt8183-audio.c ++++ b/drivers/clk/mediatek/clk-mt8183-audio.c +@@ -75,8 +75,8 @@ static int clk_mt8183_audio_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_AUDIO_NR_CLK); + +- mtk_clk_register_gates(node, audio_clks, ARRAY_SIZE(audio_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, audio_clks, ++ ARRAY_SIZE(audio_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8183-mm.c b/drivers/clk/mediatek/clk-mt8183-mm.c +index 11ecc6fb0065b..3580315309132 100644 +--- a/drivers/clk/mediatek/clk-mt8183-mm.c ++++ b/drivers/clk/mediatek/clk-mt8183-mm.c +@@ -90,8 +90,8 @@ static int clk_mt8183_mm_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK); + +- mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c +index 1860a35a723a5..ba0d6ba10b359 100644 +--- a/drivers/clk/mediatek/clk-mt8183.c ++++ b/drivers/clk/mediatek/clk-mt8183.c +@@ -1172,8 +1172,8 @@ static int clk_mt8183_apmixed_probe(struct platform_device *pdev) + + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); + +- mtk_clk_register_gates(node, apmixed_clks, ARRAY_SIZE(apmixed_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, ++ ARRAY_SIZE(apmixed_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +@@ -1247,8 +1247,8 @@ static int clk_mt8183_top_probe(struct platform_device *pdev) + mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs), + base, &mt8183_clk_lock, top_clk_data); + +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), +- top_clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), top_clk_data); + + ret = clk_mt8183_reg_mfg_mux_notifier(&pdev->dev, + top_clk_data->hws[CLK_TOP_MUX_MFG]->clk); +@@ -1267,8 +1267,8 @@ static int clk_mt8183_infra_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK); + +- mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) { +@@ -1290,8 +1290,8 @@ static int clk_mt8183_peri_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK); + +- mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), +- clk_data); ++ mtk_clk_register_gates(&pdev->dev, node, peri_clks, ++ ARRAY_SIZE(peri_clks), clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +diff --git a/drivers/clk/mediatek/clk-mt8186-mm.c b/drivers/clk/mediatek/clk-mt8186-mm.c +index 1d33be4079470..0b72607777fa1 100644 +--- a/drivers/clk/mediatek/clk-mt8186-mm.c ++++ b/drivers/clk/mediatek/clk-mt8186-mm.c +@@ -69,7 +69,8 @@ static int clk_mt8186_mm_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + if (r) + goto free_mm_data; + +diff --git a/drivers/clk/mediatek/clk-mt8192-aud.c b/drivers/clk/mediatek/clk-mt8192-aud.c +index 8c989bffd8c72..f524188fe4c2d 100644 +--- a/drivers/clk/mediatek/clk-mt8192-aud.c ++++ b/drivers/clk/mediatek/clk-mt8192-aud.c +@@ -87,7 +87,8 @@ static int clk_mt8192_aud_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, aud_clks, ARRAY_SIZE(aud_clks), clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, aud_clks, ++ ARRAY_SIZE(aud_clks), clk_data); + if (r) + return r; + +diff --git a/drivers/clk/mediatek/clk-mt8192-mm.c b/drivers/clk/mediatek/clk-mt8192-mm.c +index 1be3ff4d407db..e9eb4cf8349ac 100644 +--- a/drivers/clk/mediatek/clk-mt8192-mm.c ++++ b/drivers/clk/mediatek/clk-mt8192-mm.c +@@ -91,7 +91,8 @@ static int clk_mt8192_mm_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, mm_clks, ARRAY_SIZE(mm_clks), clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + if (r) + return r; + +diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c +index 508af9bbcc46c..ac1eee513649b 100644 +--- a/drivers/clk/mediatek/clk-mt8192.c ++++ b/drivers/clk/mediatek/clk-mt8192.c +@@ -1127,8 +1127,8 @@ static int clk_mt8192_top_probe(struct platform_device *pdev) + if (r) + goto unregister_top_composites; + +- r = mtk_clk_register_gates_with_dev(node, top_clks, ARRAY_SIZE(top_clks), +- top_clk_data, &pdev->dev); ++ r = mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), top_clk_data); + if (r) + goto unregister_adj_divs_composites; + +@@ -1171,8 +1171,8 @@ static int clk_mt8192_infra_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates_with_dev(node, infra_clks, ARRAY_SIZE(infra_clks), +- clk_data, &pdev->dev); ++ r = mtk_clk_register_gates(&pdev->dev, node, infra_clks, ++ ARRAY_SIZE(infra_clks), clk_data); + if (r) + goto free_clk_data; + +@@ -1203,8 +1203,8 @@ static int clk_mt8192_peri_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates_with_dev(node, peri_clks, ARRAY_SIZE(peri_clks), +- clk_data, &pdev->dev); ++ r = mtk_clk_register_gates(&pdev->dev, node, peri_clks, ++ ARRAY_SIZE(peri_clks), clk_data); + if (r) + goto free_clk_data; + +@@ -1232,9 +1232,8 @@ static int clk_mt8192_apmixed_probe(struct platform_device *pdev) + return -ENOMEM; + + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); +- r = mtk_clk_register_gates_with_dev(node, apmixed_clks, +- ARRAY_SIZE(apmixed_clks), clk_data, +- &pdev->dev); ++ r = mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, ++ ARRAY_SIZE(apmixed_clks), clk_data); + if (r) + goto free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt8195-apmixedsys.c b/drivers/clk/mediatek/clk-mt8195-apmixedsys.c +index 0dfed6ec4d155..1bc917f2667e4 100644 +--- a/drivers/clk/mediatek/clk-mt8195-apmixedsys.c ++++ b/drivers/clk/mediatek/clk-mt8195-apmixedsys.c +@@ -124,7 +124,8 @@ static int clk_mt8195_apmixed_probe(struct platform_device *pdev) + if (r) + goto free_apmixed_data; + +- r = mtk_clk_register_gates(node, apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, apmixed_clks, ++ ARRAY_SIZE(apmixed_clks), clk_data); + if (r) + goto unregister_plls; + +diff --git a/drivers/clk/mediatek/clk-mt8195-topckgen.c b/drivers/clk/mediatek/clk-mt8195-topckgen.c +index 1e016329c1d23..e6e0298d64494 100644 +--- a/drivers/clk/mediatek/clk-mt8195-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt8195-topckgen.c +@@ -1286,7 +1286,8 @@ static int clk_mt8195_topck_probe(struct platform_device *pdev) + if (r) + goto unregister_muxes; + +- r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, top_clks, ++ ARRAY_SIZE(top_clks), top_clk_data); + if (r) + goto unregister_composite_divs; + +diff --git a/drivers/clk/mediatek/clk-mt8195-vdo0.c b/drivers/clk/mediatek/clk-mt8195-vdo0.c +index 07b46bfd50406..839b730688acb 100644 +--- a/drivers/clk/mediatek/clk-mt8195-vdo0.c ++++ b/drivers/clk/mediatek/clk-mt8195-vdo0.c +@@ -104,7 +104,8 @@ static int clk_mt8195_vdo0_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, vdo0_clks, ARRAY_SIZE(vdo0_clks), clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, vdo0_clks, ++ ARRAY_SIZE(vdo0_clks), clk_data); + if (r) + goto free_vdo0_data; + +diff --git a/drivers/clk/mediatek/clk-mt8195-vdo1.c b/drivers/clk/mediatek/clk-mt8195-vdo1.c +index 835335b9d87bb..7df695b289258 100644 +--- a/drivers/clk/mediatek/clk-mt8195-vdo1.c ++++ b/drivers/clk/mediatek/clk-mt8195-vdo1.c +@@ -131,7 +131,8 @@ static int clk_mt8195_vdo1_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, vdo1_clks, ARRAY_SIZE(vdo1_clks), clk_data); ++ r = mtk_clk_register_gates(&pdev->dev, node, vdo1_clks, ++ ARRAY_SIZE(vdo1_clks), clk_data); + if (r) + goto free_vdo1_data; + +diff --git a/drivers/clk/mediatek/clk-mt8365-mm.c b/drivers/clk/mediatek/clk-mt8365-mm.c +index 5c8bf18ab1f1d..22c75a03a6452 100644 +--- a/drivers/clk/mediatek/clk-mt8365-mm.c ++++ b/drivers/clk/mediatek/clk-mt8365-mm.c +@@ -81,9 +81,8 @@ static int clk_mt8365_mm_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MM_NR_CLK); + +- ret = mtk_clk_register_gates_with_dev(node, mm_clks, +- ARRAY_SIZE(mm_clks), clk_data, +- dev); ++ ret = mtk_clk_register_gates(dev, node, mm_clks, ++ ARRAY_SIZE(mm_clks), clk_data); + if (ret) + goto err_free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt8365.c b/drivers/clk/mediatek/clk-mt8365.c +index adfecb618f102..b30cbeae1c3d3 100644 +--- a/drivers/clk/mediatek/clk-mt8365.c ++++ b/drivers/clk/mediatek/clk-mt8365.c +@@ -1019,8 +1019,8 @@ static int clk_mt8365_infra_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- ret = mtk_clk_register_gates(node, ifr_clks, ARRAY_SIZE(ifr_clks), +- clk_data); ++ ret = mtk_clk_register_gates(&pdev->dev, node, ifr_clks, ++ ARRAY_SIZE(ifr_clks), clk_data); + if (ret) + goto free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt8516-aud.c b/drivers/clk/mediatek/clk-mt8516-aud.c +index a3dafc719799c..a6ae8003b9ff6 100644 +--- a/drivers/clk/mediatek/clk-mt8516-aud.c ++++ b/drivers/clk/mediatek/clk-mt8516-aud.c +@@ -48,7 +48,7 @@ static void __init mtk_audsys_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_AUD_NR_CLK); + +- mtk_clk_register_gates(node, aud_clks, ARRAY_SIZE(aud_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, aud_clks, ARRAY_SIZE(aud_clks), clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c +index 056953d594c66..bde0b8c761d47 100644 +--- a/drivers/clk/mediatek/clk-mt8516.c ++++ b/drivers/clk/mediatek/clk-mt8516.c +@@ -655,7 +655,7 @@ static void __init mtk_topckgen_init(struct device_node *node) + + mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks), + clk_data); +- mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), clk_data); ++ mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data); + + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); + mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c +index d31f01d0ba1c2..6123b234d3c3b 100644 +--- a/drivers/clk/mediatek/clk-mtk.c ++++ b/drivers/clk/mediatek/clk-mtk.c +@@ -459,8 +459,8 @@ int mtk_clk_simple_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates_with_dev(node, mcd->clks, mcd->num_clks, +- clk_data, &pdev->dev); ++ r = mtk_clk_register_gates(&pdev->dev, node, mcd->clks, mcd->num_clks, ++ clk_data); + if (r) + goto free_data; + +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-clk-mtk-extend-mtk_clk_simple_probe.patch b/queue-6.1/clk-mediatek-clk-mtk-extend-mtk_clk_simple_probe.patch new file mode 100644 index 00000000000..c35288f9d87 --- /dev/null +++ b/queue-6.1/clk-mediatek-clk-mtk-extend-mtk_clk_simple_probe.patch @@ -0,0 +1,202 @@ +From d737465cca1c48d0aad0e8faf2fbfd06d7df0b09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 10:20:42 +0100 +Subject: clk: mediatek: clk-mtk: Extend mtk_clk_simple_probe() + +From: AngeloGioacchino Del Regno + +[ Upstream commit 7b6183108c8ccf0dc295f39cdf78bd8078455636 ] + +As a preparation to increase probe functions commonization across +various MediaTek SoC clock controller drivers, extend function +mtk_clk_simple_probe() to be able to register not only gates, but +also fixed clocks, factors, muxes and composites. + +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Miles Chen +Reviewed-by: Chen-Yu Tsai +Tested-by: Miles Chen +Link: https://lore.kernel.org/r/20230120092053.182923-13-angelogioacchino.delregno@collabora.com +Tested-by: Mingming Su +Signed-off-by: Stephen Boyd +Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mtk.c | 101 ++++++++++++++++++++++++++++++--- + drivers/clk/mediatek/clk-mtk.h | 10 ++++ + 2 files changed, 103 insertions(+), 8 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c +index 152f3d906ef8a..bfabd94a474a5 100644 +--- a/drivers/clk/mediatek/clk-mtk.c ++++ b/drivers/clk/mediatek/clk-mtk.c +@@ -11,12 +11,14 @@ + #include + #include + #include ++#include + #include + #include + #include + + #include "clk-mtk.h" + #include "clk-gate.h" ++#include "clk-mux.h" + + static void mtk_init_clk_data(struct clk_hw_onecell_data *clk_data, + unsigned int clk_num) +@@ -450,20 +452,71 @@ int mtk_clk_simple_probe(struct platform_device *pdev) + const struct mtk_clk_desc *mcd; + struct clk_hw_onecell_data *clk_data; + struct device_node *node = pdev->dev.of_node; +- int r; ++ void __iomem *base; ++ int num_clks, r; + + mcd = of_device_get_match_data(&pdev->dev); + if (!mcd) + return -EINVAL; + +- clk_data = mtk_alloc_clk_data(mcd->num_clks); ++ /* Composite clocks needs us to pass iomem pointer */ ++ if (mcd->composite_clks) { ++ if (!mcd->shared_io) ++ base = devm_platform_ioremap_resource(pdev, 0); ++ else ++ base = of_iomap(node, 0); ++ ++ if (IS_ERR_OR_NULL(base)) ++ return IS_ERR(base) ? PTR_ERR(base) : -ENOMEM; ++ } ++ ++ /* Calculate how many clk_hw_onecell_data entries to allocate */ ++ num_clks = mcd->num_clks + mcd->num_composite_clks; ++ num_clks += mcd->num_fixed_clks + mcd->num_factor_clks; ++ num_clks += mcd->num_mux_clks; ++ ++ clk_data = mtk_alloc_clk_data(num_clks); + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(&pdev->dev, node, mcd->clks, mcd->num_clks, +- clk_data); +- if (r) +- goto free_data; ++ if (mcd->fixed_clks) { ++ r = mtk_clk_register_fixed_clks(mcd->fixed_clks, ++ mcd->num_fixed_clks, clk_data); ++ if (r) ++ goto free_data; ++ } ++ ++ if (mcd->factor_clks) { ++ r = mtk_clk_register_factors(mcd->factor_clks, ++ mcd->num_factor_clks, clk_data); ++ if (r) ++ goto unregister_fixed_clks; ++ } ++ ++ if (mcd->mux_clks) { ++ r = mtk_clk_register_muxes(&pdev->dev, mcd->mux_clks, ++ mcd->num_mux_clks, node, ++ mcd->clk_lock, clk_data); ++ if (r) ++ goto unregister_factors; ++ }; ++ ++ if (mcd->composite_clks) { ++ /* We don't check composite_lock because it's optional */ ++ r = mtk_clk_register_composites(&pdev->dev, ++ mcd->composite_clks, ++ mcd->num_composite_clks, ++ base, mcd->clk_lock, clk_data); ++ if (r) ++ goto unregister_muxes; ++ } ++ ++ if (mcd->clks) { ++ r = mtk_clk_register_gates(&pdev->dev, node, mcd->clks, ++ mcd->num_clks, clk_data); ++ if (r) ++ goto unregister_composites; ++ } + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -481,9 +534,28 @@ int mtk_clk_simple_probe(struct platform_device *pdev) + return r; + + unregister_clks: +- mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data); ++ if (mcd->clks) ++ mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data); ++unregister_composites: ++ if (mcd->composite_clks) ++ mtk_clk_unregister_composites(mcd->composite_clks, ++ mcd->num_composite_clks, clk_data); ++unregister_muxes: ++ if (mcd->mux_clks) ++ mtk_clk_unregister_muxes(mcd->mux_clks, ++ mcd->num_mux_clks, clk_data); ++unregister_factors: ++ if (mcd->factor_clks) ++ mtk_clk_unregister_factors(mcd->factor_clks, ++ mcd->num_factor_clks, clk_data); ++unregister_fixed_clks: ++ if (mcd->fixed_clks) ++ mtk_clk_unregister_fixed_clks(mcd->fixed_clks, ++ mcd->num_fixed_clks, clk_data); + free_data: + mtk_free_clk_data(clk_data); ++ if (mcd->shared_io && base) ++ iounmap(base); + return r; + } + EXPORT_SYMBOL_GPL(mtk_clk_simple_probe); +@@ -495,7 +567,20 @@ int mtk_clk_simple_remove(struct platform_device *pdev) + struct device_node *node = pdev->dev.of_node; + + of_clk_del_provider(node); +- mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data); ++ if (mcd->clks) ++ mtk_clk_unregister_gates(mcd->clks, mcd->num_clks, clk_data); ++ if (mcd->composite_clks) ++ mtk_clk_unregister_composites(mcd->composite_clks, ++ mcd->num_composite_clks, clk_data); ++ if (mcd->mux_clks) ++ mtk_clk_unregister_muxes(mcd->mux_clks, ++ mcd->num_mux_clks, clk_data); ++ if (mcd->factor_clks) ++ mtk_clk_unregister_factors(mcd->factor_clks, ++ mcd->num_factor_clks, clk_data); ++ if (mcd->fixed_clks) ++ mtk_clk_unregister_fixed_clks(mcd->fixed_clks, ++ mcd->num_fixed_clks, clk_data); + mtk_free_clk_data(clk_data); + + return 0; +diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h +index 3993a60738c77..880b3d6d80119 100644 +--- a/drivers/clk/mediatek/clk-mtk.h ++++ b/drivers/clk/mediatek/clk-mtk.h +@@ -196,7 +196,17 @@ void mtk_clk_unregister_ref2usb_tx(struct clk_hw *hw); + struct mtk_clk_desc { + const struct mtk_gate *clks; + size_t num_clks; ++ const struct mtk_composite *composite_clks; ++ size_t num_composite_clks; ++ const struct mtk_fixed_clk *fixed_clks; ++ size_t num_fixed_clks; ++ const struct mtk_fixed_factor *factor_clks; ++ size_t num_factor_clks; ++ const struct mtk_mux *mux_clks; ++ size_t num_mux_clks; + const struct mtk_clk_rst_desc *rst_desc; ++ spinlock_t *clk_lock; ++ bool shared_io; + }; + + int mtk_clk_simple_probe(struct platform_device *pdev); +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-clk-mtk-propagate-struct-device-for-com.patch b/queue-6.1/clk-mediatek-clk-mtk-propagate-struct-device-for-com.patch new file mode 100644 index 00000000000..5328e11aefd --- /dev/null +++ b/queue-6.1/clk-mediatek-clk-mtk-propagate-struct-device-for-com.patch @@ -0,0 +1,518 @@ +From da5fa141146026b6e8774f73ec8c7358fc0fe45d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 10:20:35 +0100 +Subject: clk: mediatek: clk-mtk: Propagate struct device for composites + +From: AngeloGioacchino Del Regno + +[ Upstream commit 01a6c1ab57c3a474c8d23c7d82c3fcce85f62612 ] + +Like done for cpumux clocks, propagate struct device for composite +clocks registered through clk-mtk helpers to be able to get runtime +pm support for MTK clocks. + +Signed-off-by: AngeloGioacchino Del Regno +Tested-by: Miles Chen +Link: https://lore.kernel.org/r/20230120092053.182923-6-angelogioacchino.delregno@collabora.com +Tested-by: Mingming Su +Signed-off-by: Stephen Boyd +Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt2701.c | 10 ++++++---- + drivers/clk/mediatek/clk-mt2712.c | 12 ++++++++---- + drivers/clk/mediatek/clk-mt6779.c | 10 ++++++---- + drivers/clk/mediatek/clk-mt6795-pericfg.c | 3 ++- + drivers/clk/mediatek/clk-mt6795-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt6797.c | 3 ++- + drivers/clk/mediatek/clk-mt7622.c | 8 +++++--- + drivers/clk/mediatek/clk-mt7629.c | 8 +++++--- + drivers/clk/mediatek/clk-mt8135.c | 10 ++++++---- + drivers/clk/mediatek/clk-mt8167.c | 10 ++++++---- + drivers/clk/mediatek/clk-mt8173.c | 10 ++++++---- + drivers/clk/mediatek/clk-mt8183.c | 15 +++++++++------ + drivers/clk/mediatek/clk-mt8186-mcu.c | 3 ++- + drivers/clk/mediatek/clk-mt8186-topckgen.c | 6 ++++-- + drivers/clk/mediatek/clk-mt8192.c | 6 ++++-- + drivers/clk/mediatek/clk-mt8195-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt8365.c | 7 ++++--- + drivers/clk/mediatek/clk-mt8516.c | 10 ++++++---- + drivers/clk/mediatek/clk-mtk.c | 11 ++++++----- + drivers/clk/mediatek/clk-mtk.h | 3 ++- + 20 files changed, 93 insertions(+), 58 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c +index 6c9350e1240fa..d63385d710f3f 100644 +--- a/drivers/clk/mediatek/clk-mt2701.c ++++ b/drivers/clk/mediatek/clk-mt2701.c +@@ -677,8 +677,9 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_factors(top_fixed_divs, ARRAY_SIZE(top_fixed_divs), + clk_data); + +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), +- base, &mt2701_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt2701_clk_lock, clk_data); + + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), + base, &mt2701_clk_lock, clk_data); +@@ -897,8 +898,9 @@ static int mtk_pericfg_init(struct platform_device *pdev) + mtk_clk_register_gates(&pdev->dev, node, peri_clks, + ARRAY_SIZE(peri_clks), clk_data); + +- mtk_clk_register_composites(peri_muxs, ARRAY_SIZE(peri_muxs), base, +- &mt2701_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, peri_muxs, ++ ARRAY_SIZE(peri_muxs), base, ++ &mt2701_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c +index 78ebb4f2335c1..a0f0c9ed48d10 100644 +--- a/drivers/clk/mediatek/clk-mt2712.c ++++ b/drivers/clk/mediatek/clk-mt2712.c +@@ -1320,8 +1320,9 @@ static int clk_mt2712_top_probe(struct platform_device *pdev) + mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs), + top_clk_data); + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data); +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +- &mt2712_clk_lock, top_clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt2712_clk_lock, top_clk_data); + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, + &mt2712_clk_lock, top_clk_data); + mtk_clk_register_gates(&pdev->dev, node, top_clks, +@@ -1395,8 +1396,11 @@ static int clk_mt2712_mcu_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MCU_NR_CLK); + +- mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base, +- &mt2712_clk_lock, clk_data); ++ r = mtk_clk_register_composites(&pdev->dev, mcu_muxes, ++ ARRAY_SIZE(mcu_muxes), base, ++ &mt2712_clk_lock, clk_data); ++ if (r) ++ dev_err(&pdev->dev, "Could not register composites: %d\n", r); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + +diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c +index 559d4d596e0c3..a1c387d9731a7 100644 +--- a/drivers/clk/mediatek/clk-mt6779.c ++++ b/drivers/clk/mediatek/clk-mt6779.c +@@ -1247,11 +1247,13 @@ static int clk_mt6779_top_probe(struct platform_device *pdev) + mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), + node, &mt6779_clk_lock, clk_data); + +- mtk_clk_register_composites(top_aud_muxes, ARRAY_SIZE(top_aud_muxes), +- base, &mt6779_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_aud_muxes, ++ ARRAY_SIZE(top_aud_muxes), base, ++ &mt6779_clk_lock, clk_data); + +- mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs), +- base, &mt6779_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_aud_divs, ++ ARRAY_SIZE(top_aud_divs), base, ++ &mt6779_clk_lock, clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +diff --git a/drivers/clk/mediatek/clk-mt6795-pericfg.c b/drivers/clk/mediatek/clk-mt6795-pericfg.c +index f69e715e0c1f3..08aaa9b09c363 100644 +--- a/drivers/clk/mediatek/clk-mt6795-pericfg.c ++++ b/drivers/clk/mediatek/clk-mt6795-pericfg.c +@@ -114,7 +114,8 @@ static int clk_mt6795_pericfg_probe(struct platform_device *pdev) + if (ret) + goto free_clk_data; + +- ret = mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base, ++ ret = mtk_clk_register_composites(&pdev->dev, peri_clks, ++ ARRAY_SIZE(peri_clks), base, + &mt6795_peri_clk_lock, clk_data); + if (ret) + goto unregister_gates; +diff --git a/drivers/clk/mediatek/clk-mt6795-topckgen.c b/drivers/clk/mediatek/clk-mt6795-topckgen.c +index 2948dd1aee8fa..845cc87049303 100644 +--- a/drivers/clk/mediatek/clk-mt6795-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt6795-topckgen.c +@@ -557,7 +557,8 @@ static int clk_mt6795_topckgen_probe(struct platform_device *pdev) + if (ret) + goto unregister_factors; + +- ret = mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs), base, ++ ret = mtk_clk_register_composites(&pdev->dev, top_aud_divs, ++ ARRAY_SIZE(top_aud_divs), base, + &mt6795_top_clk_lock, clk_data); + if (ret) + goto unregister_muxes; +diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c +index 9cb7d4eb4918d..17b23ee4faee6 100644 +--- a/drivers/clk/mediatek/clk-mt6797.c ++++ b/drivers/clk/mediatek/clk-mt6797.c +@@ -396,7 +396,8 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_factors(top_fixed_divs, ARRAY_SIZE(top_fixed_divs), + clk_data); + +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, ++ mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, + &mt6797_clk_lock, clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); +diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c +index bba88018f056a..67a296646722f 100644 +--- a/drivers/clk/mediatek/clk-mt7622.c ++++ b/drivers/clk/mediatek/clk-mt7622.c +@@ -615,8 +615,9 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), + clk_data); + +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), +- base, &mt7622_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt7622_clk_lock, clk_data); + + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), + base, &mt7622_clk_lock, clk_data); +@@ -685,7 +686,8 @@ static int mtk_pericfg_init(struct platform_device *pdev) + mtk_clk_register_gates(&pdev->dev, node, peri_clks, + ARRAY_SIZE(peri_clks), clk_data); + +- mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base, ++ mtk_clk_register_composites(&pdev->dev, peri_muxes, ++ ARRAY_SIZE(peri_muxes), base, + &mt7622_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); +diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c +index 6642e00cfc7a7..ec4e506bdf459 100644 +--- a/drivers/clk/mediatek/clk-mt7629.c ++++ b/drivers/clk/mediatek/clk-mt7629.c +@@ -564,8 +564,9 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), + clk_data); + +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), +- base, &mt7629_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt7629_clk_lock, clk_data); + + clk_prepare_enable(clk_data->hws[CLK_TOP_AXI_SEL]->clk); + clk_prepare_enable(clk_data->hws[CLK_TOP_MEM_SEL]->clk); +@@ -607,7 +608,8 @@ static int mtk_pericfg_init(struct platform_device *pdev) + mtk_clk_register_gates(&pdev->dev, node, peri_clks, + ARRAY_SIZE(peri_clks), clk_data); + +- mtk_clk_register_composites(peri_muxes, ARRAY_SIZE(peri_muxes), base, ++ mtk_clk_register_composites(&pdev->dev, peri_muxes, ++ ARRAY_SIZE(peri_muxes), base, + &mt7629_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); +diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c +index 8137cf2252724..a39ad58e27418 100644 +--- a/drivers/clk/mediatek/clk-mt8135.c ++++ b/drivers/clk/mediatek/clk-mt8135.c +@@ -536,8 +536,9 @@ static void __init mtk_topckgen_init(struct device_node *node) + + mtk_clk_register_factors(root_clk_alias, ARRAY_SIZE(root_clk_alias), clk_data); + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +- &mt8135_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt8135_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -581,8 +582,9 @@ static void __init mtk_pericfg_init(struct device_node *node) + + mtk_clk_register_gates(NULL, node, peri_gates, + ARRAY_SIZE(peri_gates), clk_data); +- mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base, +- &mt8135_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, peri_clks, ++ ARRAY_SIZE(peri_clks), base, ++ &mt8135_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8167.c b/drivers/clk/mediatek/clk-mt8167.c +index 59fe82ba5c7a1..91669ebafaf9b 100644 +--- a/drivers/clk/mediatek/clk-mt8167.c ++++ b/drivers/clk/mediatek/clk-mt8167.c +@@ -940,8 +940,9 @@ static void __init mtk_topckgen_init(struct device_node *node) + mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data); + + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +- &mt8167_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt8167_clk_lock, clk_data); + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), + base, &mt8167_clk_lock, clk_data); + +@@ -966,8 +967,9 @@ static void __init mtk_infracfg_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK); + +- mtk_clk_register_composites(ifr_muxes, ARRAY_SIZE(ifr_muxes), base, +- &mt8167_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, ifr_muxes, ++ ARRAY_SIZE(ifr_muxes), base, ++ &mt8167_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8173.c b/drivers/clk/mediatek/clk-mt8173.c +index 74ed7dd129f47..d05c1109b4f87 100644 +--- a/drivers/clk/mediatek/clk-mt8173.c ++++ b/drivers/clk/mediatek/clk-mt8173.c +@@ -869,8 +869,9 @@ static void __init mtk_topckgen_init(struct device_node *node) + + mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks), clk_data); + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +- &mt8173_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt8173_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +@@ -920,8 +921,9 @@ static void __init mtk_pericfg_init(struct device_node *node) + + mtk_clk_register_gates(NULL, node, peri_gates, + ARRAY_SIZE(peri_gates), clk_data); +- mtk_clk_register_composites(peri_clks, ARRAY_SIZE(peri_clks), base, +- &mt8173_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, peri_clks, ++ ARRAY_SIZE(peri_clks), base, ++ &mt8173_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c +index ba0d6ba10b359..bf7b342332536 100644 +--- a/drivers/clk/mediatek/clk-mt8183.c ++++ b/drivers/clk/mediatek/clk-mt8183.c +@@ -1241,11 +1241,13 @@ static int clk_mt8183_top_probe(struct platform_device *pdev) + mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), + node, &mt8183_clk_lock, top_clk_data); + +- mtk_clk_register_composites(top_aud_muxes, ARRAY_SIZE(top_aud_muxes), +- base, &mt8183_clk_lock, top_clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_aud_muxes, ++ ARRAY_SIZE(top_aud_muxes), base, ++ &mt8183_clk_lock, top_clk_data); + +- mtk_clk_register_composites(top_aud_divs, ARRAY_SIZE(top_aud_divs), +- base, &mt8183_clk_lock, top_clk_data); ++ mtk_clk_register_composites(&pdev->dev, top_aud_divs, ++ ARRAY_SIZE(top_aud_divs), base, ++ &mt8183_clk_lock, top_clk_data); + + mtk_clk_register_gates(&pdev->dev, node, top_clks, + ARRAY_SIZE(top_clks), top_clk_data); +@@ -1308,8 +1310,9 @@ static int clk_mt8183_mcu_probe(struct platform_device *pdev) + + clk_data = mtk_alloc_clk_data(CLK_MCU_NR_CLK); + +- mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base, +- &mt8183_clk_lock, clk_data); ++ mtk_clk_register_composites(&pdev->dev, mcu_muxes, ++ ARRAY_SIZE(mcu_muxes), base, ++ &mt8183_clk_lock, clk_data); + + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } +diff --git a/drivers/clk/mediatek/clk-mt8186-mcu.c b/drivers/clk/mediatek/clk-mt8186-mcu.c +index dfc305c1fc5d8..e52a2d986c99c 100644 +--- a/drivers/clk/mediatek/clk-mt8186-mcu.c ++++ b/drivers/clk/mediatek/clk-mt8186-mcu.c +@@ -65,7 +65,8 @@ static int clk_mt8186_mcu_probe(struct platform_device *pdev) + goto free_mcu_data; + } + +- r = mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), base, ++ r = mtk_clk_register_composites(&pdev->dev, mcu_muxes, ++ ARRAY_SIZE(mcu_muxes), base, + NULL, clk_data); + if (r) + goto free_mcu_data; +diff --git a/drivers/clk/mediatek/clk-mt8186-topckgen.c b/drivers/clk/mediatek/clk-mt8186-topckgen.c +index d7f2c4663c853..4ac157320a6b9 100644 +--- a/drivers/clk/mediatek/clk-mt8186-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt8186-topckgen.c +@@ -720,12 +720,14 @@ static int clk_mt8186_topck_probe(struct platform_device *pdev) + if (r) + goto unregister_factors; + +- r = mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, ++ r = mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, + &mt8186_clk_lock, clk_data); + if (r) + goto unregister_muxes; + +- r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, ++ r = mtk_clk_register_composites(&pdev->dev, top_adj_divs, ++ ARRAY_SIZE(top_adj_divs), base, + &mt8186_clk_lock, clk_data); + if (r) + goto unregister_composite_muxes; +diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c +index ac1eee513649b..ab856d0276184 100644 +--- a/drivers/clk/mediatek/clk-mt8192.c ++++ b/drivers/clk/mediatek/clk-mt8192.c +@@ -1117,12 +1117,14 @@ static int clk_mt8192_top_probe(struct platform_device *pdev) + if (r) + goto unregister_factors; + +- r = mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, ++ r = mtk_clk_register_composites(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), base, + &mt8192_clk_lock, top_clk_data); + if (r) + goto unregister_muxes; + +- r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, ++ r = mtk_clk_register_composites(&pdev->dev, top_adj_divs, ++ ARRAY_SIZE(top_adj_divs), base, + &mt8192_clk_lock, top_clk_data); + if (r) + goto unregister_top_composites; +diff --git a/drivers/clk/mediatek/clk-mt8195-topckgen.c b/drivers/clk/mediatek/clk-mt8195-topckgen.c +index e6e0298d64494..aae31ef3903de 100644 +--- a/drivers/clk/mediatek/clk-mt8195-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt8195-topckgen.c +@@ -1281,7 +1281,8 @@ static int clk_mt8195_topck_probe(struct platform_device *pdev) + if (r) + goto unregister_muxes; + +- r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, ++ r = mtk_clk_register_composites(&pdev->dev, top_adj_divs, ++ ARRAY_SIZE(top_adj_divs), base, + &mt8195_clk_lock, top_clk_data); + if (r) + goto unregister_muxes; +diff --git a/drivers/clk/mediatek/clk-mt8365.c b/drivers/clk/mediatek/clk-mt8365.c +index b30cbeae1c3d3..0482a8aa43cc9 100644 +--- a/drivers/clk/mediatek/clk-mt8365.c ++++ b/drivers/clk/mediatek/clk-mt8365.c +@@ -952,7 +952,7 @@ static int clk_mt8365_top_probe(struct platform_device *pdev) + if (ret) + goto unregister_factors; + +- ret = mtk_clk_register_composites(top_misc_mux_gates, ++ ret = mtk_clk_register_composites(&pdev->dev, top_misc_mux_gates, + ARRAY_SIZE(top_misc_mux_gates), base, + &mt8365_clk_lock, clk_data); + if (ret) +@@ -1080,8 +1080,9 @@ static int clk_mt8365_mcu_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- ret = mtk_clk_register_composites(mcu_muxes, ARRAY_SIZE(mcu_muxes), +- base, &mt8365_clk_lock, clk_data); ++ ret = mtk_clk_register_composites(&pdev->dev, mcu_muxes, ++ ARRAY_SIZE(mcu_muxes), base, ++ &mt8365_clk_lock, clk_data); + if (ret) + goto free_clk_data; + +diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c +index bde0b8c761d47..6983d3a48dc9a 100644 +--- a/drivers/clk/mediatek/clk-mt8516.c ++++ b/drivers/clk/mediatek/clk-mt8516.c +@@ -658,8 +658,9 @@ static void __init mtk_topckgen_init(struct device_node *node) + mtk_clk_register_gates(NULL, node, top_clks, ARRAY_SIZE(top_clks), clk_data); + + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, +- &mt8516_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, top_muxes, ++ ARRAY_SIZE(top_muxes), base, ++ &mt8516_clk_lock, clk_data); + mtk_clk_register_dividers(top_adj_divs, ARRAY_SIZE(top_adj_divs), + base, &mt8516_clk_lock, clk_data); + +@@ -684,8 +685,9 @@ static void __init mtk_infracfg_init(struct device_node *node) + + clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK); + +- mtk_clk_register_composites(ifr_muxes, ARRAY_SIZE(ifr_muxes), base, +- &mt8516_clk_lock, clk_data); ++ mtk_clk_register_composites(NULL, ifr_muxes, ++ ARRAY_SIZE(ifr_muxes), base, ++ &mt8516_clk_lock, clk_data); + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c +index 6123b234d3c3b..152f3d906ef8a 100644 +--- a/drivers/clk/mediatek/clk-mtk.c ++++ b/drivers/clk/mediatek/clk-mtk.c +@@ -197,8 +197,8 @@ void mtk_clk_unregister_factors(const struct mtk_fixed_factor *clks, int num, + } + EXPORT_SYMBOL_GPL(mtk_clk_unregister_factors); + +-static struct clk_hw *mtk_clk_register_composite(const struct mtk_composite *mc, +- void __iomem *base, spinlock_t *lock) ++static struct clk_hw *mtk_clk_register_composite(struct device *dev, ++ const struct mtk_composite *mc, void __iomem *base, spinlock_t *lock) + { + struct clk_hw *hw; + struct clk_mux *mux = NULL; +@@ -264,7 +264,7 @@ static struct clk_hw *mtk_clk_register_composite(const struct mtk_composite *mc, + div_ops = &clk_divider_ops; + } + +- hw = clk_hw_register_composite(NULL, mc->name, parent_names, num_parents, ++ hw = clk_hw_register_composite(dev, mc->name, parent_names, num_parents, + mux_hw, mux_ops, + div_hw, div_ops, + gate_hw, gate_ops, +@@ -308,7 +308,8 @@ static void mtk_clk_unregister_composite(struct clk_hw *hw) + kfree(mux); + } + +-int mtk_clk_register_composites(const struct mtk_composite *mcs, int num, ++int mtk_clk_register_composites(struct device *dev, ++ const struct mtk_composite *mcs, int num, + void __iomem *base, spinlock_t *lock, + struct clk_hw_onecell_data *clk_data) + { +@@ -327,7 +328,7 @@ int mtk_clk_register_composites(const struct mtk_composite *mcs, int num, + continue; + } + +- hw = mtk_clk_register_composite(mc, base, lock); ++ hw = mtk_clk_register_composite(dev, mc, base, lock); + + if (IS_ERR(hw)) { + pr_err("Failed to register clk %s: %pe\n", mc->name, +diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h +index 63ae7941aa92f..3993a60738c77 100644 +--- a/drivers/clk/mediatek/clk-mtk.h ++++ b/drivers/clk/mediatek/clk-mtk.h +@@ -149,7 +149,8 @@ struct mtk_composite { + .flags = 0, \ + } + +-int mtk_clk_register_composites(const struct mtk_composite *mcs, int num, ++int mtk_clk_register_composites(struct device *dev, ++ const struct mtk_composite *mcs, int num, + void __iomem *base, spinlock_t *lock, + struct clk_hw_onecell_data *clk_data); + void mtk_clk_unregister_composites(const struct mtk_composite *mcs, int num, +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-clk-mux-propagate-struct-device-for-mtk.patch b/queue-6.1/clk-mediatek-clk-mux-propagate-struct-device-for-mtk.patch new file mode 100644 index 00000000000..9fe06b6f78c --- /dev/null +++ b/queue-6.1/clk-mediatek-clk-mux-propagate-struct-device-for-mtk.patch @@ -0,0 +1,241 @@ +From 90e4007dc588c979a45cb4c7af8c10e38bed0cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 10:20:36 +0100 +Subject: clk: mediatek: clk-mux: Propagate struct device for mtk-mux + +From: AngeloGioacchino Del Regno + +[ Upstream commit d3d6bd5e25cdc460df33ae1db4f051c4bdd3aa60 ] + +Like done for other clocks, propagate struct device for mtk mux clocks +registered through clk-mux helpers to enable runtime pm support. + +Signed-off-by: AngeloGioacchino Del Regno +Tested-by: Miles Chen +Link: https://lore.kernel.org/r/20230120092053.182923-7-angelogioacchino.delregno@collabora.com +Tested-by: Mingming Su +Signed-off-by: Stephen Boyd +Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt6765.c | 3 ++- + drivers/clk/mediatek/clk-mt6779.c | 5 +++-- + drivers/clk/mediatek/clk-mt6795-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt7986-infracfg.c | 3 ++- + drivers/clk/mediatek/clk-mt7986-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt8183.c | 5 +++-- + drivers/clk/mediatek/clk-mt8186-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt8192.c | 3 ++- + drivers/clk/mediatek/clk-mt8195-topckgen.c | 3 ++- + drivers/clk/mediatek/clk-mt8365.c | 3 ++- + drivers/clk/mediatek/clk-mux.c | 14 ++++++++------ + drivers/clk/mediatek/clk-mux.h | 3 ++- + 12 files changed, 32 insertions(+), 19 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c +index a94851d11d774..0c20ce678350e 100644 +--- a/drivers/clk/mediatek/clk-mt6765.c ++++ b/drivers/clk/mediatek/clk-mt6765.c +@@ -778,7 +778,8 @@ static int clk_mt6765_top_probe(struct platform_device *pdev) + clk_data); + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), + clk_data); +- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node, ++ mtk_clk_register_muxes(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), node, + &mt6765_clk_lock, clk_data); + mtk_clk_register_gates(&pdev->dev, node, top_clks, + ARRAY_SIZE(top_clks), clk_data); +diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c +index a1c387d9731a7..248aaa50ced14 100644 +--- a/drivers/clk/mediatek/clk-mt6779.c ++++ b/drivers/clk/mediatek/clk-mt6779.c +@@ -1244,8 +1244,9 @@ static int clk_mt6779_top_probe(struct platform_device *pdev) + + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); + +- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), +- node, &mt6779_clk_lock, clk_data); ++ mtk_clk_register_muxes(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), node, ++ &mt6779_clk_lock, clk_data); + + mtk_clk_register_composites(&pdev->dev, top_aud_muxes, + ARRAY_SIZE(top_aud_muxes), base, +diff --git a/drivers/clk/mediatek/clk-mt6795-topckgen.c b/drivers/clk/mediatek/clk-mt6795-topckgen.c +index 845cc87049303..2ab8bf5d6d6d9 100644 +--- a/drivers/clk/mediatek/clk-mt6795-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt6795-topckgen.c +@@ -552,7 +552,8 @@ static int clk_mt6795_topckgen_probe(struct platform_device *pdev) + if (ret) + goto unregister_fixed_clks; + +- ret = mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node, ++ ret = mtk_clk_register_muxes(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), node, + &mt6795_top_clk_lock, clk_data); + if (ret) + goto unregister_factors; +diff --git a/drivers/clk/mediatek/clk-mt7986-infracfg.c b/drivers/clk/mediatek/clk-mt7986-infracfg.c +index 578f150e0ee52..0a4bf87ee1607 100644 +--- a/drivers/clk/mediatek/clk-mt7986-infracfg.c ++++ b/drivers/clk/mediatek/clk-mt7986-infracfg.c +@@ -178,7 +178,8 @@ static int clk_mt7986_infracfg_probe(struct platform_device *pdev) + return -ENOMEM; + + mtk_clk_register_factors(infra_divs, ARRAY_SIZE(infra_divs), clk_data); +- mtk_clk_register_muxes(infra_muxes, ARRAY_SIZE(infra_muxes), node, ++ mtk_clk_register_muxes(&pdev->dev, infra_muxes, ++ ARRAY_SIZE(infra_muxes), node, + &mt7986_clk_lock, clk_data); + mtk_clk_register_gates(&pdev->dev, node, infra_clks, + ARRAY_SIZE(infra_clks), clk_data); +diff --git a/drivers/clk/mediatek/clk-mt7986-topckgen.c b/drivers/clk/mediatek/clk-mt7986-topckgen.c +index de5121cf28774..c9bf47e6098fd 100644 +--- a/drivers/clk/mediatek/clk-mt7986-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt7986-topckgen.c +@@ -303,7 +303,8 @@ static int clk_mt7986_topckgen_probe(struct platform_device *pdev) + mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), + clk_data); + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data); +- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node, ++ mtk_clk_register_muxes(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), node, + &mt7986_clk_lock, clk_data); + + clk_prepare_enable(clk_data->hws[CLK_TOP_SYSAXI_SEL]->clk); +diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c +index bf7b342332536..78620244144e8 100644 +--- a/drivers/clk/mediatek/clk-mt8183.c ++++ b/drivers/clk/mediatek/clk-mt8183.c +@@ -1238,8 +1238,9 @@ static int clk_mt8183_top_probe(struct platform_device *pdev) + + mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data); + +- mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), +- node, &mt8183_clk_lock, top_clk_data); ++ mtk_clk_register_muxes(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), node, ++ &mt8183_clk_lock, top_clk_data); + + mtk_clk_register_composites(&pdev->dev, top_aud_muxes, + ARRAY_SIZE(top_aud_muxes), base, +diff --git a/drivers/clk/mediatek/clk-mt8186-topckgen.c b/drivers/clk/mediatek/clk-mt8186-topckgen.c +index 4ac157320a6b9..70b6e008a188b 100644 +--- a/drivers/clk/mediatek/clk-mt8186-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt8186-topckgen.c +@@ -715,7 +715,8 @@ static int clk_mt8186_topck_probe(struct platform_device *pdev) + if (r) + goto unregister_fixed_clks; + +- r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node, ++ r = mtk_clk_register_muxes(&pdev->dev, top_mtk_muxes, ++ ARRAY_SIZE(top_mtk_muxes), node, + &mt8186_clk_lock, clk_data); + if (r) + goto unregister_factors; +diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c +index ab856d0276184..16feb86dcb1b8 100644 +--- a/drivers/clk/mediatek/clk-mt8192.c ++++ b/drivers/clk/mediatek/clk-mt8192.c +@@ -1112,7 +1112,8 @@ static int clk_mt8192_top_probe(struct platform_device *pdev) + if (r) + goto unregister_early_factors; + +- r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node, ++ r = mtk_clk_register_muxes(&pdev->dev, top_mtk_muxes, ++ ARRAY_SIZE(top_mtk_muxes), node, + &mt8192_clk_lock, top_clk_data); + if (r) + goto unregister_factors; +diff --git a/drivers/clk/mediatek/clk-mt8195-topckgen.c b/drivers/clk/mediatek/clk-mt8195-topckgen.c +index aae31ef3903de..3485ebb17ab83 100644 +--- a/drivers/clk/mediatek/clk-mt8195-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt8195-topckgen.c +@@ -1262,7 +1262,8 @@ static int clk_mt8195_topck_probe(struct platform_device *pdev) + if (r) + goto unregister_fixed_clks; + +- r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node, ++ r = mtk_clk_register_muxes(&pdev->dev, top_mtk_muxes, ++ ARRAY_SIZE(top_mtk_muxes), node, + &mt8195_clk_lock, top_clk_data); + if (r) + goto unregister_factors; +diff --git a/drivers/clk/mediatek/clk-mt8365.c b/drivers/clk/mediatek/clk-mt8365.c +index 0482a8aa43cc9..c9faa07ec0a64 100644 +--- a/drivers/clk/mediatek/clk-mt8365.c ++++ b/drivers/clk/mediatek/clk-mt8365.c +@@ -947,7 +947,8 @@ static int clk_mt8365_top_probe(struct platform_device *pdev) + if (ret) + goto unregister_fixed_clks; + +- ret = mtk_clk_register_muxes(top_muxes, ARRAY_SIZE(top_muxes), node, ++ ret = mtk_clk_register_muxes(&pdev->dev, top_muxes, ++ ARRAY_SIZE(top_muxes), node, + &mt8365_clk_lock, clk_data); + if (ret) + goto unregister_factors; +diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c +index ba1720b9e2310..c8593554239d6 100644 +--- a/drivers/clk/mediatek/clk-mux.c ++++ b/drivers/clk/mediatek/clk-mux.c +@@ -154,9 +154,10 @@ const struct clk_ops mtk_mux_gate_clr_set_upd_ops = { + }; + EXPORT_SYMBOL_GPL(mtk_mux_gate_clr_set_upd_ops); + +-static struct clk_hw *mtk_clk_register_mux(const struct mtk_mux *mux, +- struct regmap *regmap, +- spinlock_t *lock) ++static struct clk_hw *mtk_clk_register_mux(struct device *dev, ++ const struct mtk_mux *mux, ++ struct regmap *regmap, ++ spinlock_t *lock) + { + struct mtk_clk_mux *clk_mux; + struct clk_init_data init = {}; +@@ -177,7 +178,7 @@ static struct clk_hw *mtk_clk_register_mux(const struct mtk_mux *mux, + clk_mux->lock = lock; + clk_mux->hw.init = &init; + +- ret = clk_hw_register(NULL, &clk_mux->hw); ++ ret = clk_hw_register(dev, &clk_mux->hw); + if (ret) { + kfree(clk_mux); + return ERR_PTR(ret); +@@ -198,7 +199,8 @@ static void mtk_clk_unregister_mux(struct clk_hw *hw) + kfree(mux); + } + +-int mtk_clk_register_muxes(const struct mtk_mux *muxes, ++int mtk_clk_register_muxes(struct device *dev, ++ const struct mtk_mux *muxes, + int num, struct device_node *node, + spinlock_t *lock, + struct clk_hw_onecell_data *clk_data) +@@ -222,7 +224,7 @@ int mtk_clk_register_muxes(const struct mtk_mux *muxes, + continue; + } + +- hw = mtk_clk_register_mux(mux, regmap, lock); ++ hw = mtk_clk_register_mux(dev, mux, regmap, lock); + + if (IS_ERR(hw)) { + pr_err("Failed to register clk %s: %pe\n", mux->name, +diff --git a/drivers/clk/mediatek/clk-mux.h b/drivers/clk/mediatek/clk-mux.h +index 83ff420f4ebe6..7ecb963b0ec68 100644 +--- a/drivers/clk/mediatek/clk-mux.h ++++ b/drivers/clk/mediatek/clk-mux.h +@@ -83,7 +83,8 @@ extern const struct clk_ops mtk_mux_gate_clr_set_upd_ops; + 0, _upd_ofs, _upd, CLK_SET_RATE_PARENT, \ + mtk_mux_clr_set_upd_ops) + +-int mtk_clk_register_muxes(const struct mtk_mux *muxes, ++int mtk_clk_register_muxes(struct device *dev, ++ const struct mtk_mux *muxes, + int num, struct device_node *node, + spinlock_t *lock, + struct clk_hw_onecell_data *clk_data); +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-fix-of_iomap-memory-leak.patch b/queue-6.1/clk-mediatek-fix-of_iomap-memory-leak.patch new file mode 100644 index 00000000000..ceb828bd39a --- /dev/null +++ b/queue-6.1/clk-mediatek-fix-of_iomap-memory-leak.patch @@ -0,0 +1,56 @@ +From 20dc2f887e6793acb93a1af56ab3c7038d56b852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Apr 2023 08:43:31 +0000 +Subject: clk: mediatek: fix of_iomap memory leak + +From: Bosi Zhang + +[ Upstream commit 3db7285e044144fd88a356f5b641b9cd4b231a77 ] + +Smatch reports: +drivers/clk/mediatek/clk-mtk.c:583 mtk_clk_simple_probe() warn: + 'base' from of_iomap() not released on lines: 496. + +This problem was also found in linux-next. In mtk_clk_simple_probe(), +base is not released when handling errors +if clk_data is not existed, which may cause a leak. +So free_base should be added here to release base. + +Fixes: c58cd0e40ffa ("clk: mediatek: Add mtk_clk_simple_probe() to simplify clock providers") +Signed-off-by: Bosi Zhang +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230422084331.47198-1-u201911157@hust.edu.cn +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mtk.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mtk.c b/drivers/clk/mediatek/clk-mtk.c +index bfabd94a474a5..bb89963e5e1fa 100644 +--- a/drivers/clk/mediatek/clk-mtk.c ++++ b/drivers/clk/mediatek/clk-mtk.c +@@ -476,8 +476,10 @@ int mtk_clk_simple_probe(struct platform_device *pdev) + num_clks += mcd->num_mux_clks; + + clk_data = mtk_alloc_clk_data(num_clks); +- if (!clk_data) +- return -ENOMEM; ++ if (!clk_data) { ++ r = -ENOMEM; ++ goto free_base; ++ } + + if (mcd->fixed_clks) { + r = mtk_clk_register_fixed_clks(mcd->fixed_clks, +@@ -554,6 +556,7 @@ int mtk_clk_simple_probe(struct platform_device *pdev) + mcd->num_fixed_clks, clk_data); + free_data: + mtk_free_clk_data(clk_data); ++free_base: + if (mcd->shared_io && base) + iounmap(base); + return r; +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-mt8192-correctly-unregister-and-free-cl.patch b/queue-6.1/clk-mediatek-mt8192-correctly-unregister-and-free-cl.patch new file mode 100644 index 00000000000..db63e4a1d84 --- /dev/null +++ b/queue-6.1/clk-mediatek-mt8192-correctly-unregister-and-free-cl.patch @@ -0,0 +1,160 @@ +From 9c5b8c494328f83883334a908d43b8a072a9a9c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 10:20:31 +0100 +Subject: clk: mediatek: mt8192: Correctly unregister and free clocks on + failure + +From: AngeloGioacchino Del Regno + +[ Upstream commit 0cbe12694990501be92f997d987925132002dbe5 ] + +If anything fails during probe of the clock controller(s), unregister +(and kfree!) whatever we have previously registered to leave with a +clean state and prevent leaks. + +Fixes: 710573dee31b ("clk: mediatek: Add MT8192 basic clocks support") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Reviewed-by: Markus Schneider-Pargmann +Tested-by: Miles Chen +Link: https://lore.kernel.org/r/20230120092053.182923-2-angelogioacchino.delregno@collabora.com +Tested-by: Mingming Su +Signed-off-by: Stephen Boyd +Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8192.c | 77 ++++++++++++++++++++++++------- + 1 file changed, 60 insertions(+), 17 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c +index d0f2269310706..74bd8bac94a35 100644 +--- a/drivers/clk/mediatek/clk-mt8192.c ++++ b/drivers/clk/mediatek/clk-mt8192.c +@@ -1100,27 +1100,64 @@ static int clk_mt8192_top_probe(struct platform_device *pdev) + if (IS_ERR(base)) + return PTR_ERR(base); + +- mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), top_clk_data); +- mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs), top_clk_data); +- mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data); +- mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node, &mt8192_clk_lock, +- top_clk_data); +- mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, &mt8192_clk_lock, +- top_clk_data); +- mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, &mt8192_clk_lock, +- top_clk_data); +- r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data); ++ r = mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), top_clk_data); + if (r) + return r; + ++ r = mtk_clk_register_factors(top_early_divs, ARRAY_SIZE(top_early_divs), top_clk_data); ++ if (r) ++ goto unregister_fixed_clks; ++ ++ r = mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data); ++ if (r) ++ goto unregister_early_factors; ++ ++ r = mtk_clk_register_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), node, ++ &mt8192_clk_lock, top_clk_data); ++ if (r) ++ goto unregister_factors; ++ ++ r = mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, ++ &mt8192_clk_lock, top_clk_data); ++ if (r) ++ goto unregister_muxes; ++ ++ r = mtk_clk_register_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), base, ++ &mt8192_clk_lock, top_clk_data); ++ if (r) ++ goto unregister_top_composites; ++ ++ r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data); ++ if (r) ++ goto unregister_adj_divs_composites; ++ + r = clk_mt8192_reg_mfg_mux_notifier(&pdev->dev, + top_clk_data->hws[CLK_TOP_MFG_PLL_SEL]->clk); + if (r) +- return r; +- ++ goto unregister_gates; + +- return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, ++ r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, top_clk_data); ++ if (r) ++ goto unregister_gates; ++ ++ return 0; ++ ++unregister_gates: ++ mtk_clk_unregister_gates(top_clks, ARRAY_SIZE(top_clks), top_clk_data); ++unregister_adj_divs_composites: ++ mtk_clk_unregister_composites(top_adj_divs, ARRAY_SIZE(top_adj_divs), top_clk_data); ++unregister_top_composites: ++ mtk_clk_unregister_composites(top_muxes, ARRAY_SIZE(top_muxes), top_clk_data); ++unregister_muxes: ++ mtk_clk_unregister_muxes(top_mtk_muxes, ARRAY_SIZE(top_mtk_muxes), top_clk_data); ++unregister_factors: ++ mtk_clk_unregister_factors(top_divs, ARRAY_SIZE(top_divs), top_clk_data); ++unregister_early_factors: ++ mtk_clk_unregister_factors(top_early_divs, ARRAY_SIZE(top_early_divs), top_clk_data); ++unregister_fixed_clks: ++ mtk_clk_unregister_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), + top_clk_data); ++ return r; + } + + static int clk_mt8192_infra_probe(struct platform_device *pdev) +@@ -1139,14 +1176,16 @@ static int clk_mt8192_infra_probe(struct platform_device *pdev) + + r = mtk_register_reset_controller_with_dev(&pdev->dev, &clk_rst_desc); + if (r) +- goto free_clk_data; ++ goto unregister_gates; + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +- goto free_clk_data; ++ goto unregister_gates; + + return r; + ++unregister_gates: ++ mtk_clk_unregister_gates(infra_clks, ARRAY_SIZE(infra_clks), clk_data); + free_clk_data: + mtk_free_clk_data(clk_data); + return r; +@@ -1168,10 +1207,12 @@ static int clk_mt8192_peri_probe(struct platform_device *pdev) + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +- goto free_clk_data; ++ goto unregister_gates; + + return r; + ++unregister_gates: ++ mtk_clk_unregister_gates(peri_clks, ARRAY_SIZE(peri_clks), clk_data); + free_clk_data: + mtk_free_clk_data(clk_data); + return r; +@@ -1194,10 +1235,12 @@ static int clk_mt8192_apmixed_probe(struct platform_device *pdev) + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) +- goto free_clk_data; ++ goto unregister_gates; + + return r; + ++unregister_gates: ++ mtk_clk_unregister_gates(apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data); + free_clk_data: + mtk_free_clk_data(clk_data); + return r; +-- +2.39.2 + diff --git a/queue-6.1/clk-mediatek-mt8192-propagate-struct-device-for-gate.patch b/queue-6.1/clk-mediatek-mt8192-propagate-struct-device-for-gate.patch new file mode 100644 index 00000000000..d2be99f0c9e --- /dev/null +++ b/queue-6.1/clk-mediatek-mt8192-propagate-struct-device-for-gate.patch @@ -0,0 +1,73 @@ +From 2d3bb8ca091ed11a86744720d6daa56d9d206f07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 10:20:32 +0100 +Subject: clk: mediatek: mt8192: Propagate struct device for gate clocks + +From: AngeloGioacchino Del Regno + +[ Upstream commit fdc325c8f79cb4155009db8394db19793c4d07cd ] + +Convert instances of mtk_clk_register_gates() to use the newer +mtk_clk_register_gates_with_dev() to propagate struct device to +the clk framework. + +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Tested-by: Miles Chen +Link: https://lore.kernel.org/r/20230120092053.182923-3-angelogioacchino.delregno@collabora.com +Tested-by: Mingming Su +Signed-off-by: Stephen Boyd +Stable-dep-of: 3db7285e0441 ("clk: mediatek: fix of_iomap memory leak") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8192.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt8192.c b/drivers/clk/mediatek/clk-mt8192.c +index 74bd8bac94a35..508af9bbcc46c 100644 +--- a/drivers/clk/mediatek/clk-mt8192.c ++++ b/drivers/clk/mediatek/clk-mt8192.c +@@ -1127,7 +1127,8 @@ static int clk_mt8192_top_probe(struct platform_device *pdev) + if (r) + goto unregister_top_composites; + +- r = mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), top_clk_data); ++ r = mtk_clk_register_gates_with_dev(node, top_clks, ARRAY_SIZE(top_clks), ++ top_clk_data, &pdev->dev); + if (r) + goto unregister_adj_divs_composites; + +@@ -1170,7 +1171,8 @@ static int clk_mt8192_infra_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), clk_data); ++ r = mtk_clk_register_gates_with_dev(node, infra_clks, ARRAY_SIZE(infra_clks), ++ clk_data, &pdev->dev); + if (r) + goto free_clk_data; + +@@ -1201,7 +1203,8 @@ static int clk_mt8192_peri_probe(struct platform_device *pdev) + if (!clk_data) + return -ENOMEM; + +- r = mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), clk_data); ++ r = mtk_clk_register_gates_with_dev(node, peri_clks, ARRAY_SIZE(peri_clks), ++ clk_data, &pdev->dev); + if (r) + goto free_clk_data; + +@@ -1229,7 +1232,9 @@ static int clk_mt8192_apmixed_probe(struct platform_device *pdev) + return -ENOMEM; + + mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); +- r = mtk_clk_register_gates(node, apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data); ++ r = mtk_clk_register_gates_with_dev(node, apmixed_clks, ++ ARRAY_SIZE(apmixed_clks), clk_data, ++ &pdev->dev); + if (r) + goto free_clk_data; + +-- +2.39.2 + diff --git a/queue-6.1/clk-renesas-rzg2l-fix-cpg_sipll5_clk1-register-write.patch b/queue-6.1/clk-renesas-rzg2l-fix-cpg_sipll5_clk1-register-write.patch new file mode 100644 index 00000000000..d311c2a900a --- /dev/null +++ b/queue-6.1/clk-renesas-rzg2l-fix-cpg_sipll5_clk1-register-write.patch @@ -0,0 +1,59 @@ +From 657ad75f80e771da9db4c651e1ca6f4dbb43e330 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 16:23:34 +0100 +Subject: clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write + +From: Biju Das + +[ Upstream commit d1c20885d3b01e6a62e920af4b227abd294d22f3 ] + +As per the RZ/G2L HW(Rev.1.30 May2023) manual, there are no "write enable" +bits in the CPG_SIPLL5_CLK1 register. So fix the CPG_SIPLL5_CLK register +write by removing the "write enable" bits. + +Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230518152334.514922-1-biju.das.jz@bp.renesas.com +[geert: Remove CPG_SIPLL5_CLK1_*_WEN bit definitions] +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/rzg2l-cpg.c | 6 ++---- + drivers/clk/renesas/rzg2l-cpg.h | 3 --- + 2 files changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c +index 3ff6ecd617565..2c877576c5729 100644 +--- a/drivers/clk/renesas/rzg2l-cpg.c ++++ b/drivers/clk/renesas/rzg2l-cpg.c +@@ -600,10 +600,8 @@ static int rzg2l_cpg_sipll5_set_rate(struct clk_hw *hw, + } + + /* Output clock setting 1 */ +- writel(CPG_SIPLL5_CLK1_POSTDIV1_WEN | CPG_SIPLL5_CLK1_POSTDIV2_WEN | +- CPG_SIPLL5_CLK1_REFDIV_WEN | (params.pl5_postdiv1 << 0) | +- (params.pl5_postdiv2 << 4) | (params.pl5_refdiv << 8), +- priv->base + CPG_SIPLL5_CLK1); ++ writel((params.pl5_postdiv1 << 0) | (params.pl5_postdiv2 << 4) | ++ (params.pl5_refdiv << 8), priv->base + CPG_SIPLL5_CLK1); + + /* Output clock setting, SSCG modulation value setting 3 */ + writel((params.pl5_fracin << 8), priv->base + CPG_SIPLL5_CLK3); +diff --git a/drivers/clk/renesas/rzg2l-cpg.h b/drivers/clk/renesas/rzg2l-cpg.h +index cecbdf5e4f93a..b33a3e79161b6 100644 +--- a/drivers/clk/renesas/rzg2l-cpg.h ++++ b/drivers/clk/renesas/rzg2l-cpg.h +@@ -32,9 +32,6 @@ + #define CPG_SIPLL5_STBY_RESETB_WEN BIT(16) + #define CPG_SIPLL5_STBY_SSCG_EN_WEN BIT(18) + #define CPG_SIPLL5_STBY_DOWNSPREAD_WEN BIT(20) +-#define CPG_SIPLL5_CLK1_POSTDIV1_WEN BIT(16) +-#define CPG_SIPLL5_CLK1_POSTDIV2_WEN BIT(20) +-#define CPG_SIPLL5_CLK1_REFDIV_WEN BIT(24) + #define CPG_SIPLL5_CLK4_RESV_LSB (0xFF) + #define CPG_SIPLL5_MON_PLL5_LOCK BIT(4) + +-- +2.39.2 + diff --git a/queue-6.1/clk-rs9-fix-.driver_data-content-in-i2c_device_id.patch b/queue-6.1/clk-rs9-fix-.driver_data-content-in-i2c_device_id.patch new file mode 100644 index 00000000000..cca935122d0 --- /dev/null +++ b/queue-6.1/clk-rs9-fix-.driver_data-content-in-i2c_device_id.patch @@ -0,0 +1,43 @@ +From 743ce560e19703c8c7294288f3a87d752ac2e73a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 15:39:06 +0200 +Subject: clk: rs9: Fix .driver_data content in i2c_device_id + +From: Marek Vasut + +[ Upstream commit ad527ca87e4ea42d7baad2ce710b44069287931b ] + +The .driver_data content in i2c_device_id table must match the +.data content in of_device_id table, else device_get_match_data() +would return bogus value on i2c_device_id match. Align the two +tables. + +The i2c_device_id table is now converted from of_device_id using +'s@.compatible = "renesas,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@' + +Fixes: 892e0ddea1aa ("clk: rs9: Add Renesas 9-series PCIe clock generator driver") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230507133906.15061-3-marek.vasut+renesas@mailbox.org +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-renesas-pcie.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c +index 3e98a16eba6bb..35b2519f16961 100644 +--- a/drivers/clk/clk-renesas-pcie.c ++++ b/drivers/clk/clk-renesas-pcie.c +@@ -353,7 +353,7 @@ static const struct rs9_chip_info renesas_9fgv0241_info = { + }; + + static const struct i2c_device_id rs9_id[] = { +- { "9fgv0241", .driver_data = RENESAS_9FGV0241 }, ++ { "9fgv0241", .driver_data = (kernel_ulong_t)&renesas_9fgv0241_info }, + { } + }; + MODULE_DEVICE_TABLE(i2c, rs9_id); +-- +2.39.2 + diff --git a/queue-6.1/clk-si5341-check-return-value-of-devm_-kasprintf.patch b/queue-6.1/clk-si5341-check-return-value-of-devm_-kasprintf.patch new file mode 100644 index 00000000000..6cd6604c787 --- /dev/null +++ b/queue-6.1/clk-si5341-check-return-value-of-devm_-kasprintf.patch @@ -0,0 +1,51 @@ +From e9f0b29ee563de20777d882554978ef2ebae4814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:09 +0300 +Subject: clk: si5341: check return value of {devm_}kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 36e4ef82016a2b785cf2317eade77e76699b7bff ] + +{devm_}kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-5-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 6dca3288c8940..b2cf7edc8b308 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1697,6 +1697,10 @@ static int si5341_probe(struct i2c_client *client) + for (i = 0; i < data->num_synth; ++i) { + synth_clock_names[i] = devm_kasprintf(&client->dev, GFP_KERNEL, + "%s.N%u", client->dev.of_node->name, i); ++ if (!synth_clock_names[i]) { ++ err = -ENOMEM; ++ goto free_clk_names; ++ } + init.name = synth_clock_names[i]; + data->synth[i].index = i; + data->synth[i].data = data; +@@ -1715,6 +1719,10 @@ static int si5341_probe(struct i2c_client *client) + for (i = 0; i < data->num_outputs; ++i) { + init.name = kasprintf(GFP_KERNEL, "%s.%d", + client->dev.of_node->name, i); ++ if (!init.name) { ++ err = -ENOMEM; ++ goto free_clk_names; ++ } + init.flags = config[i].synth_master ? CLK_SET_RATE_PARENT : 0; + data->clk[i].index = i; + data->clk[i].data = data; +-- +2.39.2 + diff --git a/queue-6.1/clk-si5341-free-unused-memory-on-probe-failure.patch b/queue-6.1/clk-si5341-free-unused-memory-on-probe-failure.patch new file mode 100644 index 00000000000..a2a99d5f376 --- /dev/null +++ b/queue-6.1/clk-si5341-free-unused-memory-on-probe-failure.patch @@ -0,0 +1,86 @@ +From 62c7d403a3ef7907f4e53763d5d750a62266a6a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:10 +0300 +Subject: clk: si5341: free unused memory on probe failure + +From: Claudiu Beznea + +[ Upstream commit 267ad94b13c53d8c99a336f0841b1fa1595b1d0f ] + +Pointers from synth_clock_names[] should be freed at the end of probe +either on probe success or failure path. + +Fixes: b7bbf6ec4940 ("clk: si5341: Allow different output VDD_SEL values") +Fixes: 9b13ff4340df ("clk: si5341: Add sysfs properties to allow checking/resetting device faults") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-6-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index b2cf7edc8b308..c7d8cbd22bacc 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1744,7 +1744,7 @@ static int si5341_probe(struct i2c_client *client) + if (err) { + dev_err(&client->dev, + "output %u registration failed\n", i); +- goto cleanup; ++ goto free_clk_names; + } + if (config[i].always_on) + clk_prepare(data->clk[i].hw.clk); +@@ -1754,7 +1754,7 @@ static int si5341_probe(struct i2c_client *client) + data); + if (err) { + dev_err(&client->dev, "unable to add clk provider\n"); +- goto cleanup; ++ goto free_clk_names; + } + + if (initialization_required) { +@@ -1762,11 +1762,11 @@ static int si5341_probe(struct i2c_client *client) + regcache_cache_only(data->regmap, false); + err = regcache_sync(data->regmap); + if (err < 0) +- goto cleanup; ++ goto free_clk_names; + + err = si5341_finalize_defaults(data); + if (err < 0) +- goto cleanup; ++ goto free_clk_names; + } + + /* wait for device to report input clock present and PLL lock */ +@@ -1775,21 +1775,19 @@ static int si5341_probe(struct i2c_client *client) + 10000, 250000); + if (err) { + dev_err(&client->dev, "Error waiting for input clock or PLL lock\n"); +- goto cleanup; ++ goto free_clk_names; + } + + /* clear sticky alarm bits from initialization */ + err = regmap_write(data->regmap, SI5341_STATUS_STICKY, 0); + if (err) { + dev_err(&client->dev, "unable to clear sticky status\n"); +- goto cleanup; ++ goto free_clk_names; + } + + err = sysfs_create_files(&client->dev.kobj, si5341_attributes); +- if (err) { ++ if (err) + dev_err(&client->dev, "unable to create sysfs files\n"); +- goto cleanup; +- } + + free_clk_names: + /* Free the names, clk framework makes copies */ +-- +2.39.2 + diff --git a/queue-6.1/clk-si5341-return-error-if-one-synth-clock-registrat.patch b/queue-6.1/clk-si5341-return-error-if-one-synth-clock-registrat.patch new file mode 100644 index 00000000000..55285f9d5a8 --- /dev/null +++ b/queue-6.1/clk-si5341-return-error-if-one-synth-clock-registrat.patch @@ -0,0 +1,72 @@ +From f724f68f6d43d78c447f972663d0223f1469b67c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:08 +0300 +Subject: clk: si5341: return error if one synth clock registration fails + +From: Claudiu Beznea + +[ Upstream commit 2560114c06d7a752b3f4639f28cece58fed11267 ] + +In case devm_clk_hw_register() fails for one of synth clocks the probe +continues. Later on, when registering output clocks which have as parents +all the synth clocks, in case there is registration failure for at least +one synth clock the information passed to clk core for registering output +clock is not right: init.num_parents is fixed but init.parents may contain +an array with less parents. + +Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-4-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 0e528d7ba656e..6dca3288c8940 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1553,7 +1553,7 @@ static int si5341_probe(struct i2c_client *client) + struct clk_init_data init; + struct clk *input; + const char *root_clock_name; +- const char *synth_clock_names[SI5341_NUM_SYNTH]; ++ const char *synth_clock_names[SI5341_NUM_SYNTH] = { NULL }; + int err; + unsigned int i; + struct clk_si5341_output_config config[SI5341_MAX_NUM_OUTPUTS]; +@@ -1705,6 +1705,7 @@ static int si5341_probe(struct i2c_client *client) + if (err) { + dev_err(&client->dev, + "synth N%u registration failed\n", i); ++ goto free_clk_names; + } + } + +@@ -1782,16 +1783,17 @@ static int si5341_probe(struct i2c_client *client) + goto cleanup; + } + ++free_clk_names: + /* Free the names, clk framework makes copies */ + for (i = 0; i < data->num_synth; ++i) + devm_kfree(&client->dev, (void *)synth_clock_names[i]); + +- return 0; +- + cleanup: +- for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) { +- if (data->clk[i].vddo_reg) +- regulator_disable(data->clk[i].vddo_reg); ++ if (err) { ++ for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) { ++ if (data->clk[i].vddo_reg) ++ regulator_disable(data->clk[i].vddo_reg); ++ } + } + return err; + } +-- +2.39.2 + diff --git a/queue-6.1/clk-tegra-tegra124-emc-fix-potential-memory-leak.patch b/queue-6.1/clk-tegra-tegra124-emc-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..cf6523a6310 --- /dev/null +++ b/queue-6.1/clk-tegra-tegra124-emc-fix-potential-memory-leak.patch @@ -0,0 +1,45 @@ +From 01b81d38b3568d9bc93dffb69b52c29d11a01074 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 09:41:24 +0000 +Subject: clk: tegra: tegra124-emc: Fix potential memory leak + +From: Yuan Can + +[ Upstream commit 53a06e5924c0d43c11379a08c5a78529c3e61595 ] + +The tegra and tegra needs to be freed in the error handling path, otherwise +it will be leaked. + +Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") +Signed-off-by: Yuan Can +Link: https://lore.kernel.org/r/20221209094124.71043-1-yuancan@huawei.com +Acked-by: Thierry Reding +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra124-emc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c +index 219c80653dbdb..2a6db04342815 100644 +--- a/drivers/clk/tegra/clk-tegra124-emc.c ++++ b/drivers/clk/tegra/clk-tegra124-emc.c +@@ -464,6 +464,7 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra, + err = load_one_timing_from_dt(tegra, timing, child); + if (err) { + of_node_put(child); ++ kfree(tegra->timings); + return err; + } + +@@ -515,6 +516,7 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np + err = load_timings_from_dt(tegra, node, node_ram_code); + if (err) { + of_node_put(node); ++ kfree(tegra); + return ERR_PTR(err); + } + } +-- +2.39.2 + diff --git a/queue-6.1/clk-ti-clkctrl-check-return-value-of-kasprintf.patch b/queue-6.1/clk-ti-clkctrl-check-return-value-of-kasprintf.patch new file mode 100644 index 00000000000..c69aa0e6214 --- /dev/null +++ b/queue-6.1/clk-ti-clkctrl-check-return-value-of-kasprintf.patch @@ -0,0 +1,52 @@ +From f66c7776f72f482b69a26727a78e529ead7a0104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:12 +0300 +Subject: clk: ti: clkctrl: check return value of kasprintf() + +From: Claudiu Beznea + +[ Upstream commit bd46cd0b802d9c9576ca78007aa084ae3e74907b ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 852049594b9a ("clk: ti: clkctrl: convert subclocks to use proper names also") +Fixes: 6c3090520554 ("clk: ti: clkctrl: Fix hidden dependency to node name") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-8-claudiu.beznea@microchip.com +Reviewed-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clkctrl.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index ae58628794176..57611bfb299c1 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -258,6 +258,9 @@ static const char * __init clkctrl_get_clock_name(struct device_node *np, + if (clkctrl_name && !legacy_naming) { + clock_name = kasprintf(GFP_KERNEL, "%s-clkctrl:%04x:%d", + clkctrl_name, offset, index); ++ if (!clock_name) ++ return NULL; ++ + strreplace(clock_name, '_', '-'); + + return clock_name; +@@ -586,6 +589,10 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node) + if (clkctrl_name) { + provider->clkdm_name = kasprintf(GFP_KERNEL, + "%s_clkdm", clkctrl_name); ++ if (!provider->clkdm_name) { ++ kfree(provider); ++ return; ++ } + goto clkdm_found; + } + +-- +2.39.2 + diff --git a/queue-6.1/clk-vc5-check-memory-returned-by-kasprintf.patch b/queue-6.1/clk-vc5-check-memory-returned-by-kasprintf.patch new file mode 100644 index 00000000000..00ee6180dcd --- /dev/null +++ b/queue-6.1/clk-vc5-check-memory-returned-by-kasprintf.patch @@ -0,0 +1,108 @@ +From 7a86f295ea30b9ee101b1d8a1181ca5ed682e5ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:06 +0300 +Subject: clk: vc5: check memory returned by kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 144601f6228de5598f03e693822b60a95c367a17 ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: f491276a5168 ("clk: vc5: Allow Versaclock driver to support multiple instances") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-2-claudiu.beznea@microchip.com +Reviewed-by: Luca Ceresoli +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index 5f2c9093c5b94..ef50ab78dd90d 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -1027,6 +1027,11 @@ static int vc5_probe(struct i2c_client *client) + } + + init.name = kasprintf(GFP_KERNEL, "%pOFn.mux", client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } ++ + init.ops = &vc5_mux_ops; + init.flags = 0; + init.parent_names = parent_names; +@@ -1041,6 +1046,10 @@ static int vc5_probe(struct i2c_client *client) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.dbl", + client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_dbl_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1056,6 +1065,10 @@ static int vc5_probe(struct i2c_client *client) + /* Register PFD */ + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.pfd", client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_pfd_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1073,6 +1086,10 @@ static int vc5_probe(struct i2c_client *client) + /* Register PLL */ + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.pll", client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_pll_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1092,6 +1109,10 @@ static int vc5_probe(struct i2c_client *client) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.fod%d", + client->dev.of_node, idx); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_fod_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1110,6 +1131,10 @@ static int vc5_probe(struct i2c_client *client) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.out0_sel_i2cb", + client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_clk_out_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1136,6 +1161,10 @@ static int vc5_probe(struct i2c_client *client) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.out%d", + client->dev.of_node, idx + 1); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_clk_out_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +-- +2.39.2 + diff --git a/queue-6.1/clk-vc5-fix-.driver_data-content-in-i2c_device_id.patch b/queue-6.1/clk-vc5-fix-.driver_data-content-in-i2c_device_id.patch new file mode 100644 index 00000000000..e70ee31506b --- /dev/null +++ b/queue-6.1/clk-vc5-fix-.driver_data-content-in-i2c_device_id.patch @@ -0,0 +1,56 @@ +From f67113914350c27689b18c59114d777591de3eb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 15:39:04 +0200 +Subject: clk: vc5: Fix .driver_data content in i2c_device_id + +From: Marek Vasut + +[ Upstream commit be3471c5bd9b921c9adfab7948e8021611639164 ] + +The .driver_data content in i2c_device_id table must match the +.data content in of_device_id table, else device_get_match_data() +would return bogus value on i2c_device_id match. Align the two +tables. + +The i2c_device_id table is now converted from of_device_id using +'s@.compatible = "idt,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@' + +Fixes: 9adddb01ce5f ("clk: vc5: Add structure to describe particular chip features") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230507133906.15061-1-marek.vasut+renesas@mailbox.org +Reviewed-by: Luca Ceresoli +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index abfe59ac4e487..5f2c9093c5b94 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -1255,13 +1255,13 @@ static const struct vc5_chip_info idt_5p49v6975_info = { + }; + + static const struct i2c_device_id vc5_id[] = { +- { "5p49v5923", .driver_data = IDT_VC5_5P49V5923 }, +- { "5p49v5925", .driver_data = IDT_VC5_5P49V5925 }, +- { "5p49v5933", .driver_data = IDT_VC5_5P49V5933 }, +- { "5p49v5935", .driver_data = IDT_VC5_5P49V5935 }, +- { "5p49v6901", .driver_data = IDT_VC6_5P49V6901 }, +- { "5p49v6965", .driver_data = IDT_VC6_5P49V6965 }, +- { "5p49v6975", .driver_data = IDT_VC6_5P49V6975 }, ++ { "5p49v5923", .driver_data = (kernel_ulong_t)&idt_5p49v5923_info }, ++ { "5p49v5925", .driver_data = (kernel_ulong_t)&idt_5p49v5925_info }, ++ { "5p49v5933", .driver_data = (kernel_ulong_t)&idt_5p49v5933_info }, ++ { "5p49v5935", .driver_data = (kernel_ulong_t)&idt_5p49v5935_info }, ++ { "5p49v6901", .driver_data = (kernel_ulong_t)&idt_5p49v6901_info }, ++ { "5p49v6965", .driver_data = (kernel_ulong_t)&idt_5p49v6965_info }, ++ { "5p49v6975", .driver_data = (kernel_ulong_t)&idt_5p49v6975_info }, + { } + }; + MODULE_DEVICE_TABLE(i2c, vc5_id); +-- +2.39.2 + diff --git a/queue-6.1/clk-vc5-use-clamp-to-restrict-pll-range.patch b/queue-6.1/clk-vc5-use-clamp-to-restrict-pll-range.patch new file mode 100644 index 00000000000..78b35de3adc --- /dev/null +++ b/queue-6.1/clk-vc5-use-clamp-to-restrict-pll-range.patch @@ -0,0 +1,44 @@ +From 199c1b56c309c06378cf291d3cca9985f4ff6158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 15:34:58 -0800 +Subject: clk: vc5: Use `clamp()` to restrict PLL range + +From: Lars-Peter Clausen + +[ Upstream commit 3ed741db04f58e8df0d46cec7ecfc4bfd075f047 ] + +The VCO frequency needs to be within a certain range and the driver +enforces this. + +Make use of the clamp macro to implement this instead of open-coding it. +This makes the code a bit shorter and also semanticly stronger. + +Signed-off-by: Lars-Peter Clausen +Link: https://lore.kernel.org/r/20230114233500.3294789-1-lars@metafoo.de +Reviewed-by: Luca Ceresoli +Signed-off-by: Stephen Boyd +Stable-dep-of: be3471c5bd9b ("clk: vc5: Fix .driver_data content in i2c_device_id") +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index 88689415aff9c..abfe59ac4e487 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -450,10 +450,7 @@ static long vc5_pll_round_rate(struct clk_hw *hw, unsigned long rate, + u32 div_int; + u64 div_frc; + +- if (rate < VC5_PLL_VCO_MIN) +- rate = VC5_PLL_VCO_MIN; +- if (rate > VC5_PLL_VCO_MAX) +- rate = VC5_PLL_VCO_MAX; ++ rate = clamp(rate, VC5_PLL_VCO_MIN, VC5_PLL_VCO_MAX); + + /* Determine integer part, which is 12 bit wide */ + div_int = rate / *parent_rate; +-- +2.39.2 + diff --git a/queue-6.1/clk-vc7-fix-.driver_data-content-in-i2c_device_id.patch b/queue-6.1/clk-vc7-fix-.driver_data-content-in-i2c_device_id.patch new file mode 100644 index 00000000000..18dfb84ee0f --- /dev/null +++ b/queue-6.1/clk-vc7-fix-.driver_data-content-in-i2c_device_id.patch @@ -0,0 +1,43 @@ +From 430dc9dc9c031dd843b79e7c4c5d3d5fa2bb8c16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 15:39:05 +0200 +Subject: clk: vc7: Fix .driver_data content in i2c_device_id + +From: Marek Vasut + +[ Upstream commit b5e10beeafaa3266559c582dde7534ae3fe8cefb ] + +The .driver_data content in i2c_device_id table must match the +.data content in of_device_id table, else device_get_match_data() +would return bogus value on i2c_device_id match. Align the two +tables. + +The i2c_device_id table is now converted from of_device_id using +'s@.compatible = "renesas,\([^"]\+"\), .data = \(.*\)@"\1, .driver_data = (kernel_ulong_t)\2@' + +Fixes: 48c5e98fedd9 ("clk: Renesas versaclock7 ccf device driver") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230507133906.15061-2-marek.vasut+renesas@mailbox.org +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock7.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/clk-versaclock7.c b/drivers/clk/clk-versaclock7.c +index 8e4f86e852aa0..0ae191f50b4b2 100644 +--- a/drivers/clk/clk-versaclock7.c ++++ b/drivers/clk/clk-versaclock7.c +@@ -1282,7 +1282,7 @@ static const struct regmap_config vc7_regmap_config = { + }; + + static const struct i2c_device_id vc7_i2c_id[] = { +- { "rc21008a", VC7_RC21008A }, ++ { "rc21008a", .driver_data = (kernel_ulong_t)&vc7_rc21008a_info }, + {} + }; + MODULE_DEVICE_TABLE(i2c, vc7_i2c_id); +-- +2.39.2 + diff --git a/queue-6.1/clocking-wizard-support-higher-frequency-accuracy.patch b/queue-6.1/clocking-wizard-support-higher-frequency-accuracy.patch new file mode 100644 index 00000000000..509f96bb625 --- /dev/null +++ b/queue-6.1/clocking-wizard-support-higher-frequency-accuracy.patch @@ -0,0 +1,414 @@ +From 73c4d4f5ed37557ff69a04021aae626425913f0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 11:56:37 +0530 +Subject: clocking-wizard: Support higher frequency accuracy + +From: Shubhrajyoti Datta + +[ Upstream commit 595c88cda65d30c6b36277c232193295a45406dc ] + +Change the multipliers and divisors to support a higher +frequency accuracy if there is only one output. +Currently only O is changed now we are changing M, D and O. +For multiple output case the earlier behavior is retained. + +Signed-off-by: Shubhrajyoti Datta +Link: https://lore.kernel.org/r/20230327062637.22237-1-shubhrajyoti.datta@amd.com +Signed-off-by: Stephen Boyd +Stable-dep-of: b1356ed1a446 ("clk: clocking-wizard: check return value of devm_kasprintf()") +Signed-off-by: Sasha Levin +--- + drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 228 ++++++++++++++++++--- + 1 file changed, 204 insertions(+), 24 deletions(-) + +diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +index 4a23583933bcc..5c362c622a866 100644 +--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c ++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c +@@ -8,12 +8,14 @@ + * + */ + ++#include + #include + #include + #include + #include + #include + #include ++#include + #include + #include + #include +@@ -37,6 +39,7 @@ + #define WZRD_CLKOUT_DIVIDE_MASK (0xff << WZRD_DIVCLK_DIVIDE_SHIFT) + #define WZRD_CLKOUT_FRAC_SHIFT 8 + #define WZRD_CLKOUT_FRAC_MASK 0x3ff ++#define WZRD_CLKOUT0_FRAC_MASK GENMASK(17, 8) + + #define WZRD_DR_MAX_INT_DIV_VALUE 255 + #define WZRD_DR_STATUS_REG_OFFSET 0x04 +@@ -49,6 +52,22 @@ + + #define WZRD_USEC_POLL 10 + #define WZRD_TIMEOUT_POLL 1000 ++ ++/* Divider limits, from UG572 Table 3-4 for Ultrascale+ */ ++#define DIV_O 0x01 ++#define DIV_ALL 0x03 ++ ++#define WZRD_M_MIN 2 ++#define WZRD_M_MAX 128 ++#define WZRD_D_MIN 1 ++#define WZRD_D_MAX 106 ++#define WZRD_VCO_MIN 800000000 ++#define WZRD_VCO_MAX 1600000000 ++#define WZRD_O_MIN 1 ++#define WZRD_O_MAX 128 ++#define WZRD_MIN_ERR 20000 ++#define WZRD_FRAC_POINTS 1000 ++ + /* Get the mask from width */ + #define div_mask(width) ((1 << (width)) - 1) + +@@ -97,6 +116,9 @@ struct clk_wzrd { + * @width: width of the divider bit field + * @flags: clk_wzrd divider flags + * @table: array of value/divider pairs, last entry should have div = 0 ++ * @m: value of the multiplier ++ * @d: value of the common divider ++ * @o: value of the leaf divider + * @lock: register lock + */ + struct clk_wzrd_divider { +@@ -107,6 +129,9 @@ struct clk_wzrd_divider { + u8 width; + u8 flags; + const struct clk_div_table *table; ++ u32 m; ++ u32 d; ++ u32 o; + spinlock_t *lock; /* divider lock */ + }; + +@@ -198,12 +223,155 @@ static long clk_wzrd_round_rate(struct clk_hw *hw, unsigned long rate, + return *prate / div; + } + ++static int clk_wzrd_get_divisors(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long vco_freq, freq, diff; ++ u32 m, d, o; ++ ++ for (m = WZRD_M_MIN; m <= WZRD_M_MAX; m++) { ++ for (d = WZRD_D_MIN; d <= WZRD_D_MAX; d++) { ++ vco_freq = DIV_ROUND_CLOSEST((parent_rate * m), d); ++ if (vco_freq >= WZRD_VCO_MIN && vco_freq <= WZRD_VCO_MAX) { ++ for (o = WZRD_O_MIN; o <= WZRD_O_MAX; o++) { ++ freq = DIV_ROUND_CLOSEST_ULL(vco_freq, o); ++ diff = abs(freq - rate); ++ ++ if (diff < WZRD_MIN_ERR) { ++ divider->m = m; ++ divider->d = d; ++ divider->o = o; ++ return 0; ++ } ++ } ++ } ++ } ++ } ++ return -EBUSY; ++} ++ ++static int clk_wzrd_dynamic_all_nolock(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long vco_freq, rate_div, clockout0_div; ++ u32 reg, pre, value, f; ++ int err; ++ ++ err = clk_wzrd_get_divisors(hw, rate, parent_rate); ++ if (err) ++ return err; ++ ++ vco_freq = DIV_ROUND_CLOSEST(parent_rate * divider->m, divider->d); ++ rate_div = DIV_ROUND_CLOSEST_ULL((vco_freq * WZRD_FRAC_POINTS), rate); ++ ++ clockout0_div = div_u64(rate_div, WZRD_FRAC_POINTS); ++ ++ pre = DIV_ROUND_CLOSEST_ULL(vco_freq * WZRD_FRAC_POINTS, rate); ++ f = (pre - (clockout0_div * WZRD_FRAC_POINTS)); ++ f &= WZRD_CLKOUT_FRAC_MASK; ++ ++ reg = FIELD_PREP(WZRD_CLKOUT_DIVIDE_MASK, clockout0_div) | ++ FIELD_PREP(WZRD_CLKOUT0_FRAC_MASK, f); ++ ++ writel(reg, divider->base + WZRD_CLK_CFG_REG(2)); ++ /* Set divisor and clear phase offset */ ++ reg = FIELD_PREP(WZRD_CLKFBOUT_MULT_MASK, divider->m) | ++ FIELD_PREP(WZRD_DIVCLK_DIVIDE_MASK, divider->d); ++ writel(reg, divider->base + WZRD_CLK_CFG_REG(0)); ++ writel(divider->o, divider->base + WZRD_CLK_CFG_REG(2)); ++ writel(0, divider->base + WZRD_CLK_CFG_REG(3)); ++ /* Check status register */ ++ err = readl_poll_timeout(divider->base + WZRD_DR_STATUS_REG_OFFSET, value, ++ value & WZRD_DR_LOCK_BIT_MASK, ++ WZRD_USEC_POLL, WZRD_TIMEOUT_POLL); ++ if (err) ++ return -ETIMEDOUT; ++ ++ /* Initiate reconfiguration */ ++ writel(WZRD_DR_BEGIN_DYNA_RECONF, ++ divider->base + WZRD_DR_INIT_REG_OFFSET); ++ ++ /* Check status register */ ++ return readl_poll_timeout(divider->base + WZRD_DR_STATUS_REG_OFFSET, value, ++ value & WZRD_DR_LOCK_BIT_MASK, ++ WZRD_USEC_POLL, WZRD_TIMEOUT_POLL); ++} ++ ++static int clk_wzrd_dynamic_all(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long flags = 0; ++ int ret; ++ ++ spin_lock_irqsave(divider->lock, flags); ++ ++ ret = clk_wzrd_dynamic_all_nolock(hw, rate, parent_rate); ++ ++ spin_unlock_irqrestore(divider->lock, flags); ++ ++ return ret; ++} ++ ++static unsigned long clk_wzrd_recalc_rate_all(struct clk_hw *hw, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ u32 m, d, o, div, reg, f; ++ ++ reg = readl(divider->base + WZRD_CLK_CFG_REG(0)); ++ d = FIELD_GET(WZRD_DIVCLK_DIVIDE_MASK, reg); ++ m = FIELD_GET(WZRD_CLKFBOUT_MULT_MASK, reg); ++ reg = readl(divider->base + WZRD_CLK_CFG_REG(2)); ++ o = FIELD_GET(WZRD_DIVCLK_DIVIDE_MASK, reg); ++ f = FIELD_GET(WZRD_CLKOUT0_FRAC_MASK, reg); ++ ++ div = DIV_ROUND_CLOSEST(d * (WZRD_FRAC_POINTS * o + f), WZRD_FRAC_POINTS); ++ return divider_recalc_rate(hw, parent_rate * m, div, divider->table, ++ divider->flags, divider->width); ++} ++ ++static long clk_wzrd_round_rate_all(struct clk_hw *hw, unsigned long rate, ++ unsigned long *prate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long int_freq; ++ u32 m, d, o, div, f; ++ int err; ++ ++ err = clk_wzrd_get_divisors(hw, rate, *prate); ++ if (err) ++ return err; ++ ++ m = divider->m; ++ d = divider->d; ++ o = divider->o; ++ ++ div = d * o; ++ int_freq = divider_recalc_rate(hw, *prate * m, div, divider->table, ++ divider->flags, divider->width); ++ ++ if (rate > int_freq) { ++ f = DIV_ROUND_CLOSEST_ULL(rate * WZRD_FRAC_POINTS, int_freq); ++ rate = DIV_ROUND_CLOSEST(int_freq * f, WZRD_FRAC_POINTS); ++ } ++ return rate; ++} ++ + static const struct clk_ops clk_wzrd_clk_divider_ops = { + .round_rate = clk_wzrd_round_rate, + .set_rate = clk_wzrd_dynamic_reconfig, + .recalc_rate = clk_wzrd_recalc_rate, + }; + ++static const struct clk_ops clk_wzrd_clk_div_all_ops = { ++ .round_rate = clk_wzrd_round_rate_all, ++ .set_rate = clk_wzrd_dynamic_all, ++ .recalc_rate = clk_wzrd_recalc_rate_all, ++}; ++ + static unsigned long clk_wzrd_recalc_ratef(struct clk_hw *hw, + unsigned long parent_rate) + { +@@ -280,7 +448,7 @@ static struct clk *clk_wzrd_register_divf(struct device *dev, + void __iomem *base, u16 offset, + u8 shift, u8 width, + u8 clk_divider_flags, +- const struct clk_div_table *table, ++ u32 div_type, + spinlock_t *lock) + { + struct clk_wzrd_divider *div; +@@ -307,7 +475,6 @@ static struct clk *clk_wzrd_register_divf(struct device *dev, + div->flags = clk_divider_flags; + div->lock = lock; + div->hw.init = &init; +- div->table = table; + + hw = &div->hw; + ret = devm_clk_hw_register(dev, hw); +@@ -324,7 +491,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + void __iomem *base, u16 offset, + u8 shift, u8 width, + u8 clk_divider_flags, +- const struct clk_div_table *table, ++ u32 div_type, + spinlock_t *lock) + { + struct clk_wzrd_divider *div; +@@ -337,7 +504,12 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + return ERR_PTR(-ENOMEM); + + init.name = name; +- init.ops = &clk_wzrd_clk_divider_ops; ++ if (clk_divider_flags & CLK_DIVIDER_READ_ONLY) ++ init.ops = &clk_divider_ro_ops; ++ else if (div_type == DIV_O) ++ init.ops = &clk_wzrd_clk_divider_ops; ++ else ++ init.ops = &clk_wzrd_clk_div_all_ops; + init.flags = flags; + init.parent_names = &parent_name; + init.num_parents = 1; +@@ -349,7 +521,6 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + div->flags = clk_divider_flags; + div->lock = lock; + div->hw.init = &init; +- div->table = table; + + hw = &div->hw; + ret = devm_clk_hw_register(dev, hw); +@@ -425,6 +596,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + const char *clk_name; + void __iomem *ctrl_reg; + struct clk_wzrd *clk_wzrd; ++ const char *clkout_name; + struct device_node *np = pdev->dev.of_node; + int nr_outputs; + unsigned long flags = 0; +@@ -469,6 +641,26 @@ static int clk_wzrd_probe(struct platform_device *pdev) + goto err_disable_clk; + } + ++ ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs); ++ if (ret || nr_outputs > WZRD_NUM_OUTPUTS) { ++ ret = -EINVAL; ++ goto err_disable_clk; ++ } ++ ++ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_out0", dev_name(&pdev->dev)); ++ if (nr_outputs == 1) { ++ clk_wzrd->clkout[0] = clk_wzrd_register_divider ++ (&pdev->dev, clkout_name, ++ __clk_get_name(clk_wzrd->clk_in1), 0, ++ clk_wzrd->base, WZRD_CLK_CFG_REG(3), ++ WZRD_CLKOUT_DIVIDE_SHIFT, ++ WZRD_CLKOUT_DIVIDE_WIDTH, ++ CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO, ++ DIV_ALL, &clkwzrd_lock); ++ ++ goto out; ++ } ++ + reg = readl(clk_wzrd->base + WZRD_CLK_CFG_REG(0)); + reg_f = reg & WZRD_CLKFBOUT_FRAC_MASK; + reg_f = reg_f >> WZRD_CLKFBOUT_FRAC_SHIFT; +@@ -476,20 +668,11 @@ static int clk_wzrd_probe(struct platform_device *pdev) + reg = reg & WZRD_CLKFBOUT_MULT_MASK; + reg = reg >> WZRD_CLKFBOUT_MULT_SHIFT; + mult = (reg * 1000) + reg_f; +- clk_name = kasprintf(GFP_KERNEL, "%s_mul", dev_name(&pdev->dev)); ++ clk_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_mul", dev_name(&pdev->dev)); + if (!clk_name) { + ret = -ENOMEM; + goto err_disable_clk; + } +- +- ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs); +- if (ret || nr_outputs > WZRD_NUM_OUTPUTS) { +- ret = -EINVAL; +- goto err_disable_clk; +- } +- if (nr_outputs == 1) +- flags = CLK_SET_RATE_PARENT; +- + clk_wzrd->clks_internal[wzrd_clk_mul] = clk_register_fixed_factor + (&pdev->dev, clk_name, + __clk_get_name(clk_wzrd->clk_in1), +@@ -500,7 +683,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + goto err_disable_clk; + } + +- clk_name = kasprintf(GFP_KERNEL, "%s_mul_div", dev_name(&pdev->dev)); ++ clk_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_mul_div", dev_name(&pdev->dev)); + if (!clk_name) { + ret = -ENOMEM; + goto err_rm_int_clk; +@@ -521,9 +704,8 @@ static int clk_wzrd_probe(struct platform_device *pdev) + + /* register div per output */ + for (i = nr_outputs - 1; i >= 0 ; i--) { +- const char *clkout_name; +- +- clkout_name = kasprintf(GFP_KERNEL, "%s_out%d", dev_name(&pdev->dev), i); ++ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, ++ "%s_out%d", dev_name(&pdev->dev), i); + if (!clkout_name) { + ret = -ENOMEM; + goto err_rm_int_clk; +@@ -537,7 +719,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + WZRD_CLKOUT_DIVIDE_SHIFT, + WZRD_CLKOUT_DIVIDE_WIDTH, + CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO, +- NULL, &clkwzrd_lock); ++ DIV_O, &clkwzrd_lock); + else + clk_wzrd->clkout[i] = clk_wzrd_register_divider + (&pdev->dev, clkout_name, +@@ -546,7 +728,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + WZRD_CLKOUT_DIVIDE_SHIFT, + WZRD_CLKOUT_DIVIDE_WIDTH, + CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO, +- NULL, &clkwzrd_lock); ++ DIV_O, &clkwzrd_lock); + if (IS_ERR(clk_wzrd->clkout[i])) { + int j; + +@@ -559,8 +741,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + } + } + +- kfree(clk_name); +- ++out: + clk_wzrd->clk_data.clks = clk_wzrd->clkout; + clk_wzrd->clk_data.clk_num = ARRAY_SIZE(clk_wzrd->clkout); + of_clk_add_provider(np, of_clk_src_onecell_get, &clk_wzrd->clk_data); +@@ -585,7 +766,6 @@ static int clk_wzrd_probe(struct platform_device *pdev) + err_rm_int_clks: + clk_unregister(clk_wzrd->clks_internal[1]); + err_rm_int_clk: +- kfree(clk_name); + clk_unregister(clk_wzrd->clks_internal[0]); + err_disable_clk: + clk_disable_unprepare(clk_wzrd->axi_clk); +-- +2.39.2 + diff --git a/queue-6.1/clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch b/queue-6.1/clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch new file mode 100644 index 00000000000..1316f200c00 --- /dev/null +++ b/queue-6.1/clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch @@ -0,0 +1,81 @@ +From 1497484de9ea811c66bf72fcb9f51bdb30de0a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 06:56:11 +0000 +Subject: clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe + +From: Feng Mingxi + +[ Upstream commit 8b5bf64c89c7100c921bd807ba39b2eb003061ab ] + +Smatch reports: +drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe() +warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516. + +timer_baseaddr may have the problem of not being released after use, +I replaced it with the devm_of_iomap() function and added the clk_put() +function to cleanup the "clk_ce" and "clk_cs". + +Fixes: e932900a3279 ("arm: zynq: Use standard timer binding") +Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error") +Signed-off-by: Feng Mingxi +Reviewed-by: Dongliang Mu +Acked-by: Michal Simek +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20230425065611.702917-1-m202271825@hust.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-cadence-ttc.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c +index 4efd0cf3b602d..0d52e28fea4de 100644 +--- a/drivers/clocksource/timer-cadence-ttc.c ++++ b/drivers/clocksource/timer-cadence-ttc.c +@@ -486,10 +486,10 @@ static int __init ttc_timer_probe(struct platform_device *pdev) + * and use it. Note that the event timer uses the interrupt and it's the + * 2nd TTC hence the irq_of_parse_and_map(,1) + */ +- timer_baseaddr = of_iomap(timer, 0); +- if (!timer_baseaddr) { ++ timer_baseaddr = devm_of_iomap(&pdev->dev, timer, 0, NULL); ++ if (IS_ERR(timer_baseaddr)) { + pr_err("ERROR: invalid timer base address\n"); +- return -ENXIO; ++ return PTR_ERR(timer_baseaddr); + } + + irq = irq_of_parse_and_map(timer, 1); +@@ -513,20 +513,27 @@ static int __init ttc_timer_probe(struct platform_device *pdev) + clk_ce = of_clk_get(timer, clksel); + if (IS_ERR(clk_ce)) { + pr_err("ERROR: timer input clock not found\n"); +- return PTR_ERR(clk_ce); ++ ret = PTR_ERR(clk_ce); ++ goto put_clk_cs; + } + + ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width); + if (ret) +- return ret; ++ goto put_clk_ce; + + ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq); + if (ret) +- return ret; ++ goto put_clk_ce; + + pr_info("%pOFn #0 at %p, irq=%d\n", timer, timer_baseaddr, irq); + + return 0; ++ ++put_clk_ce: ++ clk_put(clk_ce); ++put_clk_cs: ++ clk_put(clk_cs); ++ return ret; + } + + static const struct of_device_id ttc_timer_of_match[] = { +-- +2.39.2 + diff --git a/queue-6.1/cpufreq-intel_pstate-fix-energy_performance_preferen.patch b/queue-6.1/cpufreq-intel_pstate-fix-energy_performance_preferen.patch new file mode 100644 index 00000000000..70da0c4a19a --- /dev/null +++ b/queue-6.1/cpufreq-intel_pstate-fix-energy_performance_preferen.patch @@ -0,0 +1,42 @@ +From e60ee600c082734943dec1116ae2e74c21073abe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 09:58:39 +0300 +Subject: cpufreq: intel_pstate: Fix energy_performance_preference for passive + +From: Tero Kristo + +[ Upstream commit 03f44ffb3d5be2fceda375d92c70ab6de4df7081 ] + +If the intel_pstate driver is set to passive mode, then writing the +same value to the energy_performance_preference sysfs twice will fail. +This is caused by the wrong return value used (index of the matched +energy_perf_string), instead of the length of the passed in parameter. +Fix by forcing the internal return value to zero when the same +preference is passed in by user. This same issue is not present when +active mode is used for the driver. + +Fixes: f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive mode with HWP enabled") +Reported-by: Niklas Neronin +Signed-off-by: Tero Kristo +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 6ff73c30769fa..818eb2503cdd5 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -837,6 +837,8 @@ static ssize_t store_energy_performance_preference( + err = cpufreq_start_governor(policy); + if (!ret) + ret = err; ++ } else { ++ ret = 0; + } + } + +-- +2.39.2 + diff --git a/queue-6.1/crypto-jitter-correct-health-test-during-initializat.patch b/queue-6.1/crypto-jitter-correct-health-test-during-initializat.patch new file mode 100644 index 00000000000..9597a4118db --- /dev/null +++ b/queue-6.1/crypto-jitter-correct-health-test-during-initializat.patch @@ -0,0 +1,72 @@ +From 48baee0a8045a9a4b117c3f67f9b341224c69766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 19:00:05 +0200 +Subject: crypto: jitter - correct health test during initialization +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stephan Müller + +[ Upstream commit d23659769ad1bf2cbafaa0efcbae20ef1a74f77e ] + +With the update of the permanent and intermittent health errors, the +actual indicator for the health test indicates a potential error only +for the one offending time stamp gathered in the current iteration +round. The next iteration round will "overwrite" the health test result. + +Thus, the entropy collection loop in jent_gen_entropy checks for +the health test failure upon each loop iteration. However, the +initialization operation checked for the APT health test once for +an APT window which implies it would not catch most errors. + +Thus, the check for all health errors is now invoked unconditionally +during each loop iteration for the startup test. + +With the change, the error JENT_ERCT becomes unused as all health +errors are only reported with the JENT_HEALTH return code. This +allows the removal of the error indicator. + +Fixes: 3fde2fe99aa6 ("crypto: jitter - permanent and intermittent health errors" +) +Reported-by: Joachim Vandersmissen +Signed-off-by: Stephan Mueller +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/jitterentropy.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/crypto/jitterentropy.c b/crypto/jitterentropy.c +index 22f48bf4c6f57..227cedfa4f0ae 100644 +--- a/crypto/jitterentropy.c ++++ b/crypto/jitterentropy.c +@@ -117,7 +117,6 @@ struct rand_data { + * zero). */ + #define JENT_ESTUCK 8 /* Too many stuck results during init. */ + #define JENT_EHEALTH 9 /* Health test failed during initialization */ +-#define JENT_ERCT 10 /* RCT failed during initialization */ + + /* + * The output n bits can receive more than n bits of min entropy, of course, +@@ -762,14 +761,12 @@ int jent_entropy_init(void) + if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) { + jent_apt_reset(&ec, + delta & JENT_APT_WORD_MASK); +- if (jent_health_failure(&ec)) +- return JENT_EHEALTH; + } + } + +- /* Validate RCT */ +- if (jent_rct_failure(&ec)) +- return JENT_ERCT; ++ /* Validate health test result */ ++ if (jent_health_failure(&ec)) ++ return JENT_EHEALTH; + + /* test whether we have an increasing timer */ + if (!(time2 > time)) +-- +2.39.2 + diff --git a/queue-6.1/crypto-kpp-add-helper-to-set-reqsize.patch b/queue-6.1/crypto-kpp-add-helper-to-set-reqsize.patch new file mode 100644 index 00000000000..49d1b912e09 --- /dev/null +++ b/queue-6.1/crypto-kpp-add-helper-to-set-reqsize.patch @@ -0,0 +1,39 @@ +From 719f6b203d4fa278388e71d412a054e81d714c2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 17:24:01 +0800 +Subject: crypto: kpp - Add helper to set reqsize + +From: Herbert Xu + +[ Upstream commit 56861cbde1b9f3b34d300e6ba87f2c3de1a9c309 ] + +The value of reqsize should only be changed through a helper. +To do so we need to first add a helper for this. + +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + include/crypto/internal/kpp.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/crypto/internal/kpp.h b/include/crypto/internal/kpp.h +index 9cb0662ebe871..31ff3c1986ef0 100644 +--- a/include/crypto/internal/kpp.h ++++ b/include/crypto/internal/kpp.h +@@ -50,6 +50,12 @@ static inline void *kpp_request_ctx(struct kpp_request *req) + return req->__ctx; + } + ++static inline void kpp_set_reqsize(struct crypto_kpp *kpp, ++ unsigned int reqsize) ++{ ++ crypto_kpp_alg(kpp)->reqsize = reqsize; ++} ++ + static inline void *kpp_tfm_ctx(struct crypto_kpp *tfm) + { + return tfm->base.__crt_ctx; +-- +2.39.2 + diff --git a/queue-6.1/crypto-marvell-cesa-fix-type-mismatch-warning.patch b/queue-6.1/crypto-marvell-cesa-fix-type-mismatch-warning.patch new file mode 100644 index 00000000000..759330342e1 --- /dev/null +++ b/queue-6.1/crypto-marvell-cesa-fix-type-mismatch-warning.patch @@ -0,0 +1,49 @@ +From 9f29f880e1407141f0c40d9103c80ec497c4a4e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 10:33:04 +0200 +Subject: crypto: marvell/cesa - Fix type mismatch warning + +From: Arnd Bergmann + +[ Upstream commit efbc7764c4446566edb76ca05e903b5905673d2e ] + +Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") uncovered +a type mismatch in cesa 3des support that leads to a memcpy beyond the +end of a structure: + +In function 'fortify_memcpy_chk', + inlined from 'mv_cesa_des3_ede_setkey' at drivers/crypto/marvell/cesa/cipher.c:307:2: +include/linux/fortify-string.h:583:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 583 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This is probably harmless as the actual data that is copied has the correct +type, but clearly worth fixing nonetheless. + +Fixes: 4ada48397823 ("crypto: marvell/cesa - add Triple-DES support") +Cc: Kees Cook +Cc: Gustavo A. R. Silva" +Signed-off-by: Arnd Bergmann +Reviewed-by: Kees Cook +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/cesa/cipher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c +index c6f2fa753b7c0..0f37dfd42d850 100644 +--- a/drivers/crypto/marvell/cesa/cipher.c ++++ b/drivers/crypto/marvell/cesa/cipher.c +@@ -297,7 +297,7 @@ static int mv_cesa_des_setkey(struct crypto_skcipher *cipher, const u8 *key, + static int mv_cesa_des3_ede_setkey(struct crypto_skcipher *cipher, + const u8 *key, unsigned int len) + { +- struct mv_cesa_des_ctx *ctx = crypto_skcipher_ctx(cipher); ++ struct mv_cesa_des3_ctx *ctx = crypto_skcipher_ctx(cipher); + int err; + + err = verify_skcipher_des3_key(cipher, key); +-- +2.39.2 + diff --git a/queue-6.1/crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch b/queue-6.1/crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch new file mode 100644 index 00000000000..285d092d564 --- /dev/null +++ b/queue-6.1/crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch @@ -0,0 +1,88 @@ +From 6036f2b3eea6d00a6ce11cff03529f3d79df5662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 15:33:34 -0700 +Subject: crypto: nx - fix build warnings when DEBUG_FS is not enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit b04b076fb56560b39d695ac3744db457e12278fd ] + +Fix build warnings when DEBUG_FS is not enabled by using an empty +do-while loop instead of a value: + +In file included from ../drivers/crypto/nx/nx.c:27: +../drivers/crypto/nx/nx.c: In function 'nx_register_algs': +../drivers/crypto/nx/nx.h:173:33: warning: statement with no effect [-Wunused-value] + 173 | #define NX_DEBUGFS_INIT(drv) (0) +../drivers/crypto/nx/nx.c:573:9: note: in expansion of macro 'NX_DEBUGFS_INIT' + 573 | NX_DEBUGFS_INIT(&nx_driver); +../drivers/crypto/nx/nx.c: In function 'nx_remove': +../drivers/crypto/nx/nx.h:174:33: warning: statement with no effect [-Wunused-value] + 174 | #define NX_DEBUGFS_FINI(drv) (0) +../drivers/crypto/nx/nx.c:793:17: note: in expansion of macro 'NX_DEBUGFS_FINI' + 793 | NX_DEBUGFS_FINI(&nx_driver); + +Also, there is no need to build nx_debugfs.o when DEBUG_FS is not +enabled, so change the Makefile to accommodate that. + +Fixes: ae0222b7289d ("powerpc/crypto: nx driver code supporting nx encryption") +Fixes: aef7b31c8833 ("powerpc/crypto: Build files for the nx device driver") +Signed-off-by: Randy Dunlap +Cc: Breno Leitão +Cc: Nayna Jain +Cc: Paulo Flabiano Smorigo +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: linux-crypto@vger.kernel.org +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Christophe Leroy +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/nx/Makefile | 2 +- + drivers/crypto/nx/nx.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/nx/Makefile b/drivers/crypto/nx/Makefile +index d00181a26dd65..483cef62acee8 100644 +--- a/drivers/crypto/nx/Makefile ++++ b/drivers/crypto/nx/Makefile +@@ -1,7 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o + nx-crypto-objs := nx.o \ +- nx_debugfs.o \ + nx-aes-cbc.o \ + nx-aes-ecb.o \ + nx-aes-gcm.o \ +@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \ + nx-sha256.o \ + nx-sha512.o + ++nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o + obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o + obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o + nx-compress-objs := nx-842.o +diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h +index c6233173c612e..2697baebb6a35 100644 +--- a/drivers/crypto/nx/nx.h ++++ b/drivers/crypto/nx/nx.h +@@ -170,8 +170,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int, + void nx_debugfs_init(struct nx_crypto_driver *); + void nx_debugfs_fini(struct nx_crypto_driver *); + #else +-#define NX_DEBUGFS_INIT(drv) (0) +-#define NX_DEBUGFS_FINI(drv) (0) ++#define NX_DEBUGFS_INIT(drv) do {} while (0) ++#define NX_DEBUGFS_FINI(drv) do {} while (0) + #endif + + #define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL) +-- +2.39.2 + diff --git a/queue-6.1/crypto-qat-unmap-buffer-before-free-for-dh.patch b/queue-6.1/crypto-qat-unmap-buffer-before-free-for-dh.patch new file mode 100644 index 00000000000..8d3beb8482a --- /dev/null +++ b/queue-6.1/crypto-qat-unmap-buffer-before-free-for-dh.patch @@ -0,0 +1,53 @@ +From 3ee6cda143d2622ec2d29a7c065d883b95c17c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 22:06:06 +0100 +Subject: crypto: qat - unmap buffer before free for DH + +From: Hareshx Sankar Raj + +[ Upstream commit eb7713f5ca97697b92f225127440d1525119b8de ] + +The callback function for DH frees the memory allocated for the +destination buffer before unmapping it. +This sequence is wrong. + +Change the cleanup sequence to unmap the buffer before freeing it. + +Fixes: 029aa4624a7f ("crypto: qat - remove dma_free_coherent() for DH") +Signed-off-by: Hareshx Sankar Raj +Co-developed-by: Bolemx Sivanagaleela +Signed-off-by: Bolemx Sivanagaleela +Reviewed-by: Giovanni Cabiddu +Reviewed-by: Andy Shevchenko +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 935a7e012946e..8806242469a06 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -170,15 +170,14 @@ static void qat_dh_cb(struct icp_qat_fw_pke_resp *resp) + } + + areq->dst_len = req->ctx.dh->p_size; ++ dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size, ++ DMA_FROM_DEVICE); + if (req->dst_align) { + scatterwalk_map_and_copy(req->dst_align, areq->dst, 0, + areq->dst_len, 1); + kfree_sensitive(req->dst_align); + } + +- dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size, +- DMA_FROM_DEVICE); +- + dma_unmap_single(dev, req->phy_in, sizeof(struct qat_dh_input_params), + DMA_TO_DEVICE); + dma_unmap_single(dev, req->phy_out, +-- +2.39.2 + diff --git a/queue-6.1/crypto-qat-unmap-buffers-before-free-for-rsa.patch b/queue-6.1/crypto-qat-unmap-buffers-before-free-for-rsa.patch new file mode 100644 index 00000000000..71591b4a64e --- /dev/null +++ b/queue-6.1/crypto-qat-unmap-buffers-before-free-for-rsa.patch @@ -0,0 +1,62 @@ +From a173a0a92a2177a71d3362f21c8f3ef345effc05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 22:06:07 +0100 +Subject: crypto: qat - unmap buffers before free for RSA + +From: Hareshx Sankar Raj + +[ Upstream commit d776b25495f2c71b9dbf1f5e53b642215ba72f3c ] + +The callback function for RSA frees the memory allocated for the source +and destination buffers before unmapping them. +This sequence is wrong. + +Change the cleanup sequence to unmap the buffers before freeing them. + +Fixes: 3dfaf0071ed7 ("crypto: qat - remove dma_free_coherent() for RSA") +Signed-off-by: Hareshx Sankar Raj +Co-developed-by: Bolemx Sivanagaleela +Signed-off-by: Bolemx Sivanagaleela +Reviewed-by: Giovanni Cabiddu +Reviewed-by: Andy Shevchenko +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 8806242469a06..4128200a90329 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -520,12 +520,14 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp) + + err = (err == ICP_QAT_FW_COMN_STATUS_FLAG_OK) ? 0 : -EINVAL; + +- kfree_sensitive(req->src_align); +- + dma_unmap_single(dev, req->in.rsa.enc.m, req->ctx.rsa->key_sz, + DMA_TO_DEVICE); + ++ kfree_sensitive(req->src_align); ++ + areq->dst_len = req->ctx.rsa->key_sz; ++ dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz, ++ DMA_FROM_DEVICE); + if (req->dst_align) { + scatterwalk_map_and_copy(req->dst_align, areq->dst, 0, + areq->dst_len, 1); +@@ -533,9 +535,6 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp) + kfree_sensitive(req->dst_align); + } + +- dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz, +- DMA_FROM_DEVICE); +- + dma_unmap_single(dev, req->phy_in, sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + dma_unmap_single(dev, req->phy_out, +-- +2.39.2 + diff --git a/queue-6.1/crypto-qat-use-helper-to-set-reqsize.patch b/queue-6.1/crypto-qat-use-helper-to-set-reqsize.patch new file mode 100644 index 00000000000..a765218c598 --- /dev/null +++ b/queue-6.1/crypto-qat-use-helper-to-set-reqsize.patch @@ -0,0 +1,61 @@ +From 063378c119809e0a4265e5f485a1f8c34b8a6a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 17:30:58 +0800 +Subject: crypto: qat - Use helper to set reqsize + +From: Herbert Xu + +[ Upstream commit 80e62ad58db084920d8cf23323b713391e09f374 ] + +The value of reqsize must only be changed through the helper. + +Signed-off-by: Herbert Xu +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 94a26702aeae1..935a7e012946e 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -494,6 +494,8 @@ static int qat_dh_init_tfm(struct crypto_kpp *tfm) + if (!inst) + return -EINVAL; + ++ kpp_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64); ++ + ctx->p_size = 0; + ctx->g2 = false; + ctx->inst = inst; +@@ -1230,6 +1232,8 @@ static int qat_rsa_init_tfm(struct crypto_akcipher *tfm) + if (!inst) + return -EINVAL; + ++ akcipher_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64); ++ + ctx->key_sz = 0; + ctx->inst = inst; + return 0; +@@ -1252,7 +1256,6 @@ static struct akcipher_alg rsa = { + .max_size = qat_rsa_max_size, + .init = qat_rsa_init_tfm, + .exit = qat_rsa_exit_tfm, +- .reqsize = sizeof(struct qat_asym_request) + 64, + .base = { + .cra_name = "rsa", + .cra_driver_name = "qat-rsa", +@@ -1269,7 +1272,6 @@ static struct kpp_alg dh = { + .max_size = qat_dh_max_size, + .init = qat_dh_init_tfm, + .exit = qat_dh_exit_tfm, +- .reqsize = sizeof(struct qat_asym_request) + 64, + .base = { + .cra_name = "dh", + .cra_driver_name = "qat-dh", +-- +2.39.2 + diff --git a/queue-6.1/dax-fix-dax_mapping_release-use-after-free.patch b/queue-6.1/dax-fix-dax_mapping_release-use-after-free.patch new file mode 100644 index 00000000000..bc40414f3ec --- /dev/null +++ b/queue-6.1/dax-fix-dax_mapping_release-use-after-free.patch @@ -0,0 +1,79 @@ +From 61185accba86b3d0ca934207f6131723f9d31c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 23:13:54 -0700 +Subject: dax: Fix dax_mapping_release() use after free + +From: Dan Williams + +[ Upstream commit 6d24b170a9db0456f577b1ab01226a2254c016a8 ] + +A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region +provider (like modprobe -r dax_hmem) yields: + + kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000) + [..] + DEBUG_LOCKS_WARN_ON(1) + WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260 + [..] + RIP: 0010:__lock_acquire+0x9fc/0x2260 + [..] + Call Trace: + + [..] + lock_acquire+0xd4/0x2c0 + ? ida_free+0x62/0x130 + _raw_spin_lock_irqsave+0x47/0x70 + ? ida_free+0x62/0x130 + ida_free+0x62/0x130 + dax_mapping_release+0x1f/0x30 + device_release+0x36/0x90 + kobject_delayed_cleanup+0x46/0x150 + +Due to attempting ida_free() on an ida object that has already been +freed. Devices typically only hold a reference on their parent while +registered. If a child needs a parent object to complete its release it +needs to hold a reference that it drops from its release callback. +Arrange for a dax_mapping to pin its parent dev_dax instance until +dax_mapping_release(). + +Fixes: 0b07ce872a9e ("device-dax: introduce 'mapping' devices") +Signed-off-by: Dan Williams +Link: https://lore.kernel.org/r/168577283412.1672036.16111545266174261446.stgit@dwillia2-xfh.jf.intel.com +Reviewed-by: Dave Jiang +Reviewed-by: Fan Ni +Reviewed-by: Ira Weiny +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/dax/bus.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c +index c64e7076537cb..d7a838f651813 100644 +--- a/drivers/dax/bus.c ++++ b/drivers/dax/bus.c +@@ -621,10 +621,12 @@ EXPORT_SYMBOL_GPL(alloc_dax_region); + static void dax_mapping_release(struct device *dev) + { + struct dax_mapping *mapping = to_dax_mapping(dev); +- struct dev_dax *dev_dax = to_dev_dax(dev->parent); ++ struct device *parent = dev->parent; ++ struct dev_dax *dev_dax = to_dev_dax(parent); + + ida_free(&dev_dax->ida, mapping->id); + kfree(mapping); ++ put_device(parent); + } + + static void unregister_dax_mapping(void *data) +@@ -764,6 +766,7 @@ static int devm_register_dax_mapping(struct dev_dax *dev_dax, int range_id) + dev = &mapping->dev; + device_initialize(dev); + dev->parent = &dev_dax->dev; ++ get_device(dev->parent); + dev->type = &dax_mapping_type; + dev_set_name(dev, "mapping%d", mapping->id); + rc = device_add(dev); +-- +2.39.2 + diff --git a/queue-6.1/dax-introduce-alloc_dev_dax_id.patch b/queue-6.1/dax-introduce-alloc_dev_dax_id.patch new file mode 100644 index 00000000000..141ba23b495 --- /dev/null +++ b/queue-6.1/dax-introduce-alloc_dev_dax_id.patch @@ -0,0 +1,195 @@ +From 9672eb534c3fa9eaa7b23cf6627ef935bd6dc78e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 23:14:05 -0700 +Subject: dax: Introduce alloc_dev_dax_id() + +From: Dan Williams + +[ Upstream commit 70aab281e18c68a1284bc387de127c2fc0bed3f8 ] + +The reference counting of dax_region objects is needlessly complicated, +has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up +that mess introduce alloc_dev_dax_id() to minimize the holding of a +dax_region reference to only what dev_dax_release() needs, the +dax_region->ida. + +Part of the reason for the mess was the design to dereference a +dax_region in all cases in free_dev_dax_id() even if the id was +statically assigned by the upper level dax_region driver. Remove the +need to call "is_static(dax_region)" by tracking whether the id is +dynamic directly in the dev_dax instance itself. + +With that flag the dax_region pinning and release per dev_dax instance +can move to alloc_dev_dax_id() and free_dev_dax_id() respectively. + +A follow-on cleanup address the unnecessary references in the dax_region +setup and drivers. + +Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices") +Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1] +Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2] +Reported-by: Yongqiang Liu +Reported-by: Paul Cassella +Reported-by: Ira Weiny +Signed-off-by: Dan Williams +Link: https://lore.kernel.org/r/168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com +Reviewed-by: Ira Weiny +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/dax/bus.c | 56 ++++++++++++++++++++++++--------------- + drivers/dax/dax-private.h | 4 ++- + 2 files changed, 37 insertions(+), 23 deletions(-) + +diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c +index d7a838f651813..3a9348c7f7289 100644 +--- a/drivers/dax/bus.c ++++ b/drivers/dax/bus.c +@@ -432,18 +432,34 @@ static void unregister_dev_dax(void *dev) + put_device(dev); + } + ++static void dax_region_free(struct kref *kref) ++{ ++ struct dax_region *dax_region; ++ ++ dax_region = container_of(kref, struct dax_region, kref); ++ kfree(dax_region); ++} ++ ++void dax_region_put(struct dax_region *dax_region) ++{ ++ kref_put(&dax_region->kref, dax_region_free); ++} ++EXPORT_SYMBOL_GPL(dax_region_put); ++ + /* a return value >= 0 indicates this invocation invalidated the id */ + static int __free_dev_dax_id(struct dev_dax *dev_dax) + { +- struct dax_region *dax_region = dev_dax->region; + struct device *dev = &dev_dax->dev; ++ struct dax_region *dax_region; + int rc = dev_dax->id; + + device_lock_assert(dev); + +- if (is_static(dax_region) || dev_dax->id < 0) ++ if (!dev_dax->dyn_id || dev_dax->id < 0) + return -1; ++ dax_region = dev_dax->region; + ida_free(&dax_region->ida, dev_dax->id); ++ dax_region_put(dax_region); + dev_dax->id = -1; + return rc; + } +@@ -459,6 +475,20 @@ static int free_dev_dax_id(struct dev_dax *dev_dax) + return rc; + } + ++static int alloc_dev_dax_id(struct dev_dax *dev_dax) ++{ ++ struct dax_region *dax_region = dev_dax->region; ++ int id; ++ ++ id = ida_alloc(&dax_region->ida, GFP_KERNEL); ++ if (id < 0) ++ return id; ++ kref_get(&dax_region->kref); ++ dev_dax->dyn_id = true; ++ dev_dax->id = id; ++ return id; ++} ++ + static ssize_t delete_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t len) + { +@@ -546,20 +576,6 @@ static const struct attribute_group *dax_region_attribute_groups[] = { + NULL, + }; + +-static void dax_region_free(struct kref *kref) +-{ +- struct dax_region *dax_region; +- +- dax_region = container_of(kref, struct dax_region, kref); +- kfree(dax_region); +-} +- +-void dax_region_put(struct dax_region *dax_region) +-{ +- kref_put(&dax_region->kref, dax_region_free); +-} +-EXPORT_SYMBOL_GPL(dax_region_put); +- + static void dax_region_unregister(void *region) + { + struct dax_region *dax_region = region; +@@ -1284,12 +1300,10 @@ static const struct attribute_group *dax_attribute_groups[] = { + static void dev_dax_release(struct device *dev) + { + struct dev_dax *dev_dax = to_dev_dax(dev); +- struct dax_region *dax_region = dev_dax->region; + struct dax_device *dax_dev = dev_dax->dax_dev; + + put_dax(dax_dev); + free_dev_dax_id(dev_dax); +- dax_region_put(dax_region); + kfree(dev_dax->pgmap); + kfree(dev_dax); + } +@@ -1313,6 +1327,7 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data) + if (!dev_dax) + return ERR_PTR(-ENOMEM); + ++ dev_dax->region = dax_region; + if (is_static(dax_region)) { + if (dev_WARN_ONCE(parent, data->id < 0, + "dynamic id specified to static region\n")) { +@@ -1328,13 +1343,11 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data) + goto err_id; + } + +- rc = ida_alloc(&dax_region->ida, GFP_KERNEL); ++ rc = alloc_dev_dax_id(dev_dax); + if (rc < 0) + goto err_id; +- dev_dax->id = rc; + } + +- dev_dax->region = dax_region; + dev = &dev_dax->dev; + device_initialize(dev); + dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id); +@@ -1375,7 +1388,6 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data) + dev_dax->target_node = dax_region->target_node; + dev_dax->align = dax_region->align; + ida_init(&dev_dax->ida); +- kref_get(&dax_region->kref); + + inode = dax_inode(dax_dev); + dev->devt = inode->i_rdev; +diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h +index 1c974b7caae6e..afcada6fd2eda 100644 +--- a/drivers/dax/dax-private.h ++++ b/drivers/dax/dax-private.h +@@ -52,7 +52,8 @@ struct dax_mapping { + * @region - parent region + * @dax_dev - core dax functionality + * @target_node: effective numa node if dev_dax memory range is onlined +- * @id: ida allocated id ++ * @dyn_id: is this a dynamic or statically created instance ++ * @id: ida allocated id when the dax_region is not static + * @ida: mapping id allocator + * @dev - device core + * @pgmap - pgmap for memmap setup / lifetime (driver owned) +@@ -64,6 +65,7 @@ struct dev_dax { + struct dax_device *dax_dev; + unsigned int align; + int target_node; ++ bool dyn_id; + int id; + struct ida ida; + struct device dev; +-- +2.39.2 + diff --git a/queue-6.1/dax-kmem-pass-valid-argument-to-memory_group_registe.patch b/queue-6.1/dax-kmem-pass-valid-argument-to-memory_group_registe.patch new file mode 100644 index 00000000000..203a70f0722 --- /dev/null +++ b/queue-6.1/dax-kmem-pass-valid-argument-to-memory_group_registe.patch @@ -0,0 +1,76 @@ +From 040f7d54a28a43ef933bfe171623ef121ded9c96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 21:20:25 +0530 +Subject: dax/kmem: Pass valid argument to memory_group_register_static + +From: Tarun Sahu + +[ Upstream commit 46e66dab8565f742374e9cc4ff7d35f344d774e2 ] + +memory_group_register_static takes maximum number of pages as the argument +while dev_dax_kmem_probe passes total_len (in bytes) as the argument. + +IIUC, I don't see any crash/panic impact as such. As, +memory_group_register_static just set the max_pages limit which is used in +auto_movable_zone_for_pfn to determine the zone. + +which might cause these condition to behave differently, + +This will be true always so jump will happen to kernel_zone + ... + if (!auto_movable_can_online_movable(NUMA_NO_NODE, group, nr_pages)) + goto kernel_zone; + + ... + kernel_zone: + return default_kernel_zone_for_pfn(nid, pfn, nr_pages); + +Here, In below, zone_intersects compare range will be larger as nr_pages +will be higher (derived from total_len passed in dev_dax_kmem_probe). + + ... + static struct zone *default_kernel_zone_for_pfn(int nid, unsigned long start_pfn, + unsigned long nr_pages) + { + struct pglist_data *pgdat = NODE_DATA(nid); + int zid; + + for (zid = 0; zid < ZONE_NORMAL; zid++) { + struct zone *zone = &pgdat->node_zones[zid]; + + if (zone_intersects(zone, start_pfn, nr_pages)) + return zone; + } + + return &pgdat->node_zones[ZONE_NORMAL]; + } + +Incorrect zone will be returned here, which in later time might cause bigger +problem. + +Fixes: eedf634aac3b ("dax/kmem: use a single static memory group for a single probed unit") +Signed-off-by: Tarun Sahu +Link: https://lore.kernel.org/r/20230621155025.370672-1-tsahu@linux.ibm.com +Reviewed-by: Vishal Verma +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/dax/kmem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c +index 4aa758a2b3d1b..1a33616ceb06e 100644 +--- a/drivers/dax/kmem.c ++++ b/drivers/dax/kmem.c +@@ -99,7 +99,7 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax) + if (!data->res_name) + goto err_res_name; + +- rc = memory_group_register_static(numa_node, total_len); ++ rc = memory_group_register_static(numa_node, PFN_UP(total_len)); + if (rc < 0) + goto err_reg_mgid; + data->mgid = rc; +-- +2.39.2 + diff --git a/queue-6.1/driver-soc-xilinx-use-_safe-loop-iterator-to-avoid-a.patch b/queue-6.1/driver-soc-xilinx-use-_safe-loop-iterator-to-avoid-a.patch new file mode 100644 index 00000000000..7ff988a2b4b --- /dev/null +++ b/queue-6.1/driver-soc-xilinx-use-_safe-loop-iterator-to-avoid-a.patch @@ -0,0 +1,58 @@ +From ebf5fc2c46406589af0478d16556ed43f5489f3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 13:44:54 +0300 +Subject: driver: soc: xilinx: use _safe loop iterator to avoid a use after + free + +From: Dan Carpenter + +[ Upstream commit c58da0ba3e5c86e51e2c1557afaf6f71e00c4533 ] + +The hash_for_each_possible() loop dereferences "eve_data" to get the +next item on the list. However the loop frees eve_data so it leads to +a use after free. Use hash_for_each_possible_safe() instead. + +Fixes: c7fdb2404f66 ("drivers: soc: xilinx: add xilinx event management driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/761e0e4a-4caf-4a71-8f47-1c6ad908a848@kili.mountain +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + drivers/soc/xilinx/xlnx_event_manager.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c +index c76381899ef49..f9d9b82b562da 100644 +--- a/drivers/soc/xilinx/xlnx_event_manager.c ++++ b/drivers/soc/xilinx/xlnx_event_manager.c +@@ -192,11 +192,12 @@ static int xlnx_remove_cb_for_suspend(event_cb_func_t cb_fun) + struct registered_event_data *eve_data; + struct agent_cb *cb_pos; + struct agent_cb *cb_next; ++ struct hlist_node *tmp; + + is_need_to_unregister = false; + + /* Check for existing entry in hash table for given cb_type */ +- hash_for_each_possible(reg_driver_map, eve_data, hentry, PM_INIT_SUSPEND_CB) { ++ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, PM_INIT_SUSPEND_CB) { + if (eve_data->cb_type == PM_INIT_SUSPEND_CB) { + /* Delete the list of callback */ + list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) { +@@ -228,11 +229,12 @@ static int xlnx_remove_cb_for_notify_event(const u32 node_id, const u32 event, + u64 key = ((u64)node_id << 32U) | (u64)event; + struct agent_cb *cb_pos; + struct agent_cb *cb_next; ++ struct hlist_node *tmp; + + is_need_to_unregister = false; + + /* Check for existing entry in hash table for given key id */ +- hash_for_each_possible(reg_driver_map, eve_data, hentry, key) { ++ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, key) { + if (eve_data->key == key) { + /* Delete the list of callback */ + list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) { +-- +2.39.2 + diff --git a/queue-6.1/drivers-meson-secure-pwrc-always-enable-dma-domain.patch b/queue-6.1/drivers-meson-secure-pwrc-always-enable-dma-domain.patch new file mode 100644 index 00000000000..4ea8b54379d --- /dev/null +++ b/queue-6.1/drivers-meson-secure-pwrc-always-enable-dma-domain.patch @@ -0,0 +1,42 @@ +From 1b57a7a686a7ab56d170153b58c21e92afe2b629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 12:04:14 +0300 +Subject: drivers: meson: secure-pwrc: always enable DMA domain + +From: Alexey Romanov + +[ Upstream commit 0bb4644d583789c97e74d3e3047189f0c59c4742 ] + +Starting from commit e45f243409db ("firmware: meson_sm: +populate platform devices from sm device tree data") pwrc +is probed successfully and disables unused pwr domains. +By A1 SoC family design, any TEE requires DMA pwr domain +always enabled. + +Fixes: b3dde5013e13 ("soc: amlogic: Add support for Secure power domains controller") +Signed-off-by: Alexey Romanov +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230610090414.90529-1-avromanov@sberdevices.ru +[narmstrong: added fixes tag] +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/soc/amlogic/meson-secure-pwrc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/amlogic/meson-secure-pwrc.c b/drivers/soc/amlogic/meson-secure-pwrc.c +index e935187635267..25b4b71df9b89 100644 +--- a/drivers/soc/amlogic/meson-secure-pwrc.c ++++ b/drivers/soc/amlogic/meson-secure-pwrc.c +@@ -105,7 +105,7 @@ static struct meson_secure_pwrc_domain_desc a1_pwrc_domains[] = { + SEC_PD(ACODEC, 0), + SEC_PD(AUDIO, 0), + SEC_PD(OTP, 0), +- SEC_PD(DMA, 0), ++ SEC_PD(DMA, GENPD_FLAG_ALWAYS_ON | GENPD_FLAG_IRQ_SAFE), + SEC_PD(SD_EMMC, 0), + SEC_PD(RAMA, 0), + /* SRAMB is used as ATF runtime memory, and should be always on */ +-- +2.39.2 + diff --git a/queue-6.1/drivers-perf-hisi-don-t-migrate-perf-to-the-cpu-goin.patch b/queue-6.1/drivers-perf-hisi-don-t-migrate-perf-to-the-cpu-goin.patch new file mode 100644 index 00000000000..636261aa59a --- /dev/null +++ b/queue-6.1/drivers-perf-hisi-don-t-migrate-perf-to-the-cpu-goin.patch @@ -0,0 +1,65 @@ +From 5ec63bf0d030098ff0be68f5a89bee45dcd3646c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 19:43:26 +0800 +Subject: drivers/perf: hisi: Don't migrate perf to the CPU going to teardown + +From: Junhao He + +[ Upstream commit 7a6a9f1c5a0a875a421db798d4b2ee022dc1ee1a ] + +The driver needs to migrate the perf context if the current using CPU going +to teardown. By the time calling the cpuhp::teardown() callback the +cpu_online_mask() hasn't updated yet and still includes the CPU going to +teardown. In current driver's implementation we may migrate the context +to the teardown CPU and leads to the below calltrace: + +... +[ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008 +[ 368.113699][ T932] Call trace: +[ 368.116834][ T932] __switch_to+0x7c/0xbc +[ 368.120924][ T932] __schedule+0x338/0x6f0 +[ 368.125098][ T932] schedule+0x50/0xe0 +[ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24 +[ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc +[ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30 +[ 368.144573][ T932] mutex_lock+0x50/0x60 +[ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0 +[ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu] +[ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650 +[ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190 +[ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0 +[ 368.175099][ T932] kthread+0x108/0x13c +[ 368.179012][ T932] ret_from_fork+0x10/0x18 +... + +Use function cpumask_any_but() to find one correct active cpu to fixes +this issue. + +Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU") +Signed-off-by: Junhao He +Reviewed-by: Jonathan Cameron +Reviewed-by: Yicong Yang +Acked-by: Mark Rutland +Link: https://lore.kernel.org/r/20230608114326.27649-1-hejunhao3@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c +index 071e63d9a9ac6..b61f1f9aba214 100644 +--- a/drivers/perf/hisilicon/hisi_pcie_pmu.c ++++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c +@@ -672,7 +672,7 @@ static int hisi_pcie_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node) + + pcie_pmu->on_cpu = -1; + /* Choose a new CPU from all online cpus. */ +- target = cpumask_first(cpu_online_mask); ++ target = cpumask_any_but(cpu_online_mask, cpu); + if (target >= nr_cpu_ids) { + pci_err(pcie_pmu->pdev, "There is no CPU to set\n"); + return 0; +-- +2.39.2 + diff --git a/queue-6.1/drm-add-fixed-point-helper-to-get-rounded-integer-va.patch b/queue-6.1/drm-add-fixed-point-helper-to-get-rounded-integer-va.patch new file mode 100644 index 00000000000..fc12d0a97f8 --- /dev/null +++ b/queue-6.1/drm-add-fixed-point-helper-to-get-rounded-integer-va.patch @@ -0,0 +1,57 @@ +From 29b580e92454a2df5563472d92b3fd944fe35bf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 07:40:44 -0300 +Subject: drm: Add fixed-point helper to get rounded integer values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 8b25320887d7feac98875546ea0f521628b745bb ] + +Create a new fixed-point helper to allow us to return the rounded value +of our fixed point value. + +[v2]: + * Create the function drm_fixp2int_round() (Melissa Wen). +[v3]: + * Use drm_fixp2int() instead of shifting manually (Arthur Grillo). + +Signed-off-by: Maíra Canal +Reviewed-by: Arthur Grillo +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230512104044.65034-1-mcanal@igalia.com +Stable-dep-of: ab87f558dcfb ("drm/vkms: Fix RGB565 pixel conversion") +Signed-off-by: Sasha Levin +--- + include/drm/drm_fixed.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h +index 553210c02ee0f..03cb890690e83 100644 +--- a/include/drm/drm_fixed.h ++++ b/include/drm/drm_fixed.h +@@ -70,6 +70,7 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B) + } + + #define DRM_FIXED_POINT 32 ++#define DRM_FIXED_POINT_HALF 16 + #define DRM_FIXED_ONE (1ULL << DRM_FIXED_POINT) + #define DRM_FIXED_DECIMAL_MASK (DRM_FIXED_ONE - 1) + #define DRM_FIXED_DIGITS_MASK (~DRM_FIXED_DECIMAL_MASK) +@@ -86,6 +87,11 @@ static inline int drm_fixp2int(s64 a) + return ((s64)a) >> DRM_FIXED_POINT; + } + ++static inline int drm_fixp2int_round(s64 a) ++{ ++ return drm_fixp2int(a + (1 << (DRM_FIXED_POINT_HALF - 1))); ++} ++ + static inline int drm_fixp2int_ceil(s64 a) + { + if (a > 0) +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-add-logging-for-display-mall-refresh.patch b/queue-6.1/drm-amd-display-add-logging-for-display-mall-refresh.patch new file mode 100644 index 00000000000..df3d9d19233 --- /dev/null +++ b/queue-6.1/drm-amd-display-add-logging-for-display-mall-refresh.patch @@ -0,0 +1,40 @@ +From ba962212f2877a1f0ef8121bfa90a1b4e645aa02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2020 11:49:16 -0400 +Subject: drm/amd/display: Add logging for display MALL refresh setting + +From: Wesley Chalmers + +[ Upstream commit cd8f067a46d34dee3188da184912ae3d64d98444 ] + +[WHY] +Add log entry for when display refresh from MALL +settings are sent to SMU. + +Fixes: 1664641ea946 ("drm/amd/display: Add logger for SMU msg") +Signed-off-by: Wesley Chalmers +Acked-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c +index 1fbf1c105dc12..bdbf183066981 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c +@@ -312,6 +312,9 @@ void dcn30_smu_set_display_refresh_from_mall(struct clk_mgr_internal *clk_mgr, b + /* bits 8:7 for cache timer scale, bits 6:1 for cache timer delay, bit 0 = 1 for enable, = 0 for disable */ + uint32_t param = (cache_timer_scale << 7) | (cache_timer_delay << 1) | (enable ? 1 : 0); + ++ smu_print("SMU Set display refresh from mall: enable = %d, cache_timer_delay = %d, cache_timer_scale = %d\n", ++ enable, cache_timer_delay, cache_timer_scale); ++ + dcn30_smu_send_msg_with_param(clk_mgr, + DALSMC_MSG_SetDisplayRefreshFromMall, param, NULL); + } +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-explicitly-specify-update-type-per-p.patch b/queue-6.1/drm-amd-display-explicitly-specify-update-type-per-p.patch new file mode 100644 index 00000000000..c064b3e9b2d --- /dev/null +++ b/queue-6.1/drm-amd-display-explicitly-specify-update-type-per-p.patch @@ -0,0 +1,49 @@ +From 18cee716d9bb47d88ea8c123f5b820027e409ad1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2019 13:21:48 -0400 +Subject: drm/amd/display: Explicitly specify update type per plane info change + +From: Nicholas Kazlauskas + +[ Upstream commit 710cc1e7cd461446a9325c9bd1e9a54daa462952 ] + +[Why] +The bit for flip addr is being set causing the determination for +FAST vs MEDIUM to always return MEDIUM when plane info is provided +as a surface update. This causes extreme stuttering for the typical +atomic update path on Linux. + +[How] +Don't use update_flags->raw for determining FAST vs MEDIUM. It's too +fragile to changes like this. + +Explicitly specify the update type per update flag instead. It's not +as clever as checking the bits itself but at least it's correct. + +Fixes: aa5fdb1ab5b6 ("drm/amd/display: Explicitly specify update type per plane info change") +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 087a4838488b2..b405f2e86927d 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2360,9 +2360,6 @@ static enum surface_update_type det_surface_update(const struct dc *dc, + enum surface_update_type overall_type = UPDATE_TYPE_FAST; + union surface_update_flags *update_flags = &u->surface->update_flags; + +- if (u->flip_addr) +- update_flags->bits.addr_update = 1; +- + if (!is_surface_in_context(context, u->surface) || u->surface->force_full_update) { + update_flags->raw = 0xFFFFFFFF; + return UPDATE_TYPE_FULL; +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-fix-a-test-calculateprefetchschedule.patch b/queue-6.1/drm-amd-display-fix-a-test-calculateprefetchschedule.patch new file mode 100644 index 00000000000..22a3e00ad6e --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-a-test-calculateprefetchschedule.patch @@ -0,0 +1,38 @@ +From b4813a7ec8601eb60a8adc86ab38d0c23aa89d37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 23:35:08 +0200 +Subject: drm/amd/display: Fix a test CalculatePrefetchSchedule() + +From: Christophe JAILLET + +[ Upstream commit 960e27a5741cd3001996ff6ddfb3eb0ed3a4909d ] + +It is likely Height was expected here, instead of Width. + +Test the correct variable. + +Fixes: 17529ea2acfa ("drm/amd/display: Optimizations for DML math") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +index b7c2844d0cbee..f294f2f8c75bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +@@ -810,7 +810,7 @@ static bool CalculatePrefetchSchedule( + *swath_width_chroma_ub = dml_ceil(SwathWidthY / 2 - 1, myPipe->BlockWidth256BytesC) + myPipe->BlockWidth256BytesC; + } else { + *swath_width_luma_ub = dml_ceil(SwathWidthY - 1, myPipe->BlockHeight256BytesY) + myPipe->BlockHeight256BytesY; +- if (myPipe->BlockWidth256BytesC > 0) ++ if (myPipe->BlockHeight256BytesC > 0) + *swath_width_chroma_ub = dml_ceil(SwathWidthY / 2 - 1, myPipe->BlockHeight256BytesC) + myPipe->BlockHeight256BytesC; + } + +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-fix-a-test-dml32_rq_dlg_get_rq_reg.patch b/queue-6.1/drm-amd-display-fix-a-test-dml32_rq_dlg_get_rq_reg.patch new file mode 100644 index 00000000000..f47fa1e9894 --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-a-test-dml32_rq_dlg_get_rq_reg.patch @@ -0,0 +1,39 @@ +From f85e35354ffec99836842f0b77adf7c41fdc69db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 23:41:11 +0200 +Subject: drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg() + +From: Christophe JAILLET + +[ Upstream commit bafc31166aa7df5fa26ae0ad8196d1717e6cdea9 ] + +It is likely p1_min_meta_chunk_bytes was expected here, instead of +min_meta_chunk_bytes. + +Test the correct variable. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 395ae8761980f..9ba6cb67655f4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -116,7 +116,7 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + else + rq_regs->rq_regs_l.min_meta_chunk_size = dml_log2(min_meta_chunk_bytes) - 6 + 1; + +- if (min_meta_chunk_bytes == 0) ++ if (p1_min_meta_chunk_bytes == 0) + rq_regs->rq_regs_c.min_meta_chunk_size = 0; + else + rq_regs->rq_regs_c.min_meta_chunk_size = dml_log2(p1_min_meta_chunk_bytes) - 6 + 1; +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch b/queue-6.1/drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch new file mode 100644 index 00000000000..4a318357c40 --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch @@ -0,0 +1,47 @@ +From fa028dae5ca7451aebc774efb62cd9836e6fa0ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 14:39:46 -0400 +Subject: drm/amd/display: Fix artifacting on eDP panels when engaging freesync + video mode + +From: Aurabindo Pillai + +[ Upstream commit b18f05a0666aecd5cb19c26a8305bcfa4e9d6502 ] + +[Why] +When freesync video mode is enabled, switching resolution from native +mode to one of the freesync video compatible modes can trigger continous +artifacts on some eDP panels when running under KDE. The articating can be seen in the +attached bug report. + +[How] +Fix this by restricting updates that require full commit by using the same checks +for stream and scaling changes in the the enable pass of dm_update_crtc_state() +along with the check for compatible timings for freesync vide mode. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2162 +Fixes: da5e14909776 ("drm/amd/display: Fix hang when skipping modeset") +Signed-off-by: Aurabindo Pillai +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 91c308cf27eb2..b854eec2787e2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8873,6 +8873,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + + /* Now check if we should set freesync video mode */ + if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream && ++ dc_is_stream_unchanged(new_stream, dm_old_crtc_state->stream) && ++ dc_is_stream_scaling_unchanged(new_stream, dm_old_crtc_state->stream) && + is_timing_unchanged_for_freesync(new_crtc_state, + old_crtc_state)) { + new_crtc_state->mode_changed = false; +-- +2.39.2 + diff --git a/queue-6.1/drm-amdgpu-fix-memcpy-in-sienna_cichlid_append_power.patch b/queue-6.1/drm-amdgpu-fix-memcpy-in-sienna_cichlid_append_power.patch new file mode 100644 index 00000000000..6df39e0c88a --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-memcpy-in-sienna_cichlid_append_power.patch @@ -0,0 +1,99 @@ +From b4c2b196327c7af90c3cdaa1e975ccead4a7b5a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 14:06:43 +0530 +Subject: drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table + function. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit d50dc746ff72b9c48812dac3344fa87fbde940a3 ] + +Fixes the following gcc with W=1: + +In file included from ./include/linux/string.h:253, + from ./include/linux/bitmap.h:11, + from ./include/linux/cpumask.h:12, + from ./arch/x86/include/asm/cpumask.h:5, + from ./arch/x86/include/asm/msr.h:11, + from ./arch/x86/include/asm/processor.h:22, + from ./arch/x86/include/asm/cpufeature.h:5, + from ./arch/x86/include/asm/thread_info.h:53, + from ./include/linux/thread_info.h:60, + from ./arch/x86/include/asm/preempt.h:7, + from ./include/linux/preempt.h:78, + from ./include/linux/spinlock.h:56, + from ./include/linux/mmzone.h:8, + from ./include/linux/gfp.h:7, + from ./include/linux/firmware.h:7, + from drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:26: +In function ‘fortify_memcpy_chk’, + inlined from ‘sienna_cichlid_append_powerplay_table’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:444:2, + inlined from ‘sienna_cichlid_setup_pptable’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:506:8, + inlined from ‘sienna_cichlid_setup_pptable’ at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu11/sienna_cichlid_ppt.c:494:12: +./include/linux/fortify-string.h:413:4: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] + 413 | __read_overflow2_field(q_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +the compiler complains about the size calculation in the memcpy() - +"sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header)" is much +larger than what fits into table_member. + +Hence, reuse 'smu_memcpy_trailing' for nv1x + +Fixes: 7077b19a38240 ("drm/amd/pm: use macro to get pptable members") +Suggested-by: Evan Quan +Cc: Evan Quan +Cc: Chengming Gui +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +index 85d53597eb07a..f7ed3e655e397 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +@@ -431,7 +431,13 @@ static int sienna_cichlid_append_powerplay_table(struct smu_context *smu) + { + struct atom_smc_dpm_info_v4_9 *smc_dpm_table; + int index, ret; +- I2cControllerConfig_t *table_member; ++ PPTable_beige_goby_t *ppt_beige_goby; ++ PPTable_t *ppt; ++ ++ if (smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 13)) ++ ppt_beige_goby = smu->smu_table.driver_pptable; ++ else ++ ppt = smu->smu_table.driver_pptable; + + index = get_index_into_master_table(atom_master_list_of_data_tables_v2_1, + smc_dpm_info); +@@ -440,9 +446,13 @@ static int sienna_cichlid_append_powerplay_table(struct smu_context *smu) + (uint8_t **)&smc_dpm_table); + if (ret) + return ret; +- GET_PPTABLE_MEMBER(I2cControllers, &table_member); +- memcpy(table_member, smc_dpm_table->I2cControllers, +- sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header)); ++ ++ if (smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 13)) ++ smu_memcpy_trailing(ppt_beige_goby, I2cControllers, BoardReserved, ++ smc_dpm_table, I2cControllers); ++ else ++ smu_memcpy_trailing(ppt, I2cControllers, BoardReserved, ++ smc_dpm_table, I2cControllers); + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/drm-amdgpu-fix-usage-of-umc-fill-record-in-ras.patch b/queue-6.1/drm-amdgpu-fix-usage-of-umc-fill-record-in-ras.patch new file mode 100644 index 00000000000..bfba2ce52a3 --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-usage-of-umc-fill-record-in-ras.patch @@ -0,0 +1,50 @@ +From 9ef3f3ac9e0ed206b1c197a4900a29763dadc6c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 06:19:15 -0400 +Subject: drm/amdgpu: Fix usage of UMC fill record in RAS + +From: Luben Tuikov + +[ Upstream commit 71344a718a9fda8c551cdc4381d354f9a9907f6f ] + +The fixed commit listed in the Fixes tag below, introduced a bug in +amdgpu_ras.c::amdgpu_reserve_page_direct(), in that when introducing the new +amdgpu_umc_fill_error_record() and internally in that new function the physical +address (argument "uint64_t retired_page"--wrong name) is right-shifted by +AMDGPU_GPU_PAGE_SHIFT. Thus, in amdgpu_reserve_page_direct() when we pass +"address" to that new function, we should NOT right-shift it, since this +results, erroneously, in the page address to be 0 for first +2^(2*AMDGPU_GPU_PAGE_SHIFT) memory addresses. + +This commit fixes this bug. + +Cc: Tao Zhou +Cc: Hawking Zhang +Cc: Alex Deucher +Fixes: 400013b268cb ("drm/amdgpu: add umc_fill_error_record to make code more simple") +Signed-off-by: Luben Tuikov +Link: https://lore.kernel.org/r/20230610113536.10621-1-luben.tuikov@amd.com +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index a4b47e1bd111d..09fc464f5f128 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -170,8 +170,7 @@ static int amdgpu_reserve_page_direct(struct amdgpu_device *adev, uint64_t addre + + memset(&err_rec, 0x0, sizeof(struct eeprom_table_record)); + err_data.err_addr = &err_rec; +- amdgpu_umc_fill_error_record(&err_data, address, +- (address >> AMDGPU_GPU_PAGE_SHIFT), 0, 0); ++ amdgpu_umc_fill_error_record(&err_data, address, address, 0, 0); + + if (amdgpu_bad_page_threshold != 0) { + amdgpu_ras_add_bad_pages(adev, err_data.err_addr, +-- +2.39.2 + diff --git a/queue-6.1/drm-amdkfd-fix-potential-deallocation-of-previously-.patch b/queue-6.1/drm-amdkfd-fix-potential-deallocation-of-previously-.patch new file mode 100644 index 00000000000..b62dd5135dd --- /dev/null +++ b/queue-6.1/drm-amdkfd-fix-potential-deallocation-of-previously-.patch @@ -0,0 +1,58 @@ +From e610a6913c38019c45876e90b2a376b89e582851 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 04:23:14 -0700 +Subject: drm/amdkfd: Fix potential deallocation of previously deallocated + memory. + +From: Daniil Dulov + +[ Upstream commit cabbdea1f1861098991768d7bbf5a49ed1608213 ] + +Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate(). +The function then returns non-zero value, which causes the second deallocation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: d1f8f0d17d40 ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd") +Signed-off-by: Daniil Dulov +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +index 0778e587a2d68..eaf084acb706f 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +@@ -115,18 +115,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd, + &(mqd_mem_obj->gtt_mem), + &(mqd_mem_obj->gpu_addr), + (void *)&(mqd_mem_obj->cpu_ptr), true); ++ ++ if (retval) { ++ kfree(mqd_mem_obj); ++ return NULL; ++ } + } else { + retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd), + &mqd_mem_obj); +- } +- +- if (retval) { +- kfree(mqd_mem_obj); +- return NULL; ++ if (retval) ++ return NULL; + } + + return mqd_mem_obj; +- + } + + static void init_mqd(struct mqd_manager *mm, void **mqd, +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-anx7625-convert-to-i2c-s-.probe_new.patch b/queue-6.1/drm-bridge-anx7625-convert-to-i2c-s-.probe_new.patch new file mode 100644 index 00000000000..9e66fdf03c4 --- /dev/null +++ b/queue-6.1/drm-bridge-anx7625-convert-to-i2c-s-.probe_new.patch @@ -0,0 +1,51 @@ +From 46af8df7b1c49fa913aad7a342fd52f08103df91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 23:35:51 +0100 +Subject: drm/bridge: anx7625: Convert to i2c's .probe_new() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 71450f8c824f5571d4af9e6e021b733085c8e690 ] + +The probe function doesn't make use of the i2c_device_id * parameter so it +can be trivially converted. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20221118224540.619276-18-uwe@kleine-koenig.org +Signed-off-by: Robert Foss +Stable-dep-of: 1464e48d69ab ("drm/bridge: anx7625: Prevent endless probe loop") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index b0ff1ecb80a50..86a52c5f4fbc4 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2562,8 +2562,7 @@ static void anx7625_runtime_disable(void *data) + pm_runtime_disable(data); + } + +-static int anx7625_i2c_probe(struct i2c_client *client, +- const struct i2c_device_id *id) ++static int anx7625_i2c_probe(struct i2c_client *client) + { + struct anx7625_data *platform; + struct anx7625_platform_data *pdata; +@@ -2756,7 +2755,7 @@ static struct i2c_driver anx7625_driver = { + .of_match_table = anx_match_table, + .pm = &anx7625_pm_ops, + }, +- .probe = anx7625_i2c_probe, ++ .probe_new = anx7625_i2c_probe, + .remove = anx7625_i2c_remove, + + .id_table = anx7625_id, +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-anx7625-prevent-endless-probe-loop.patch b/queue-6.1/drm-bridge-anx7625-prevent-endless-probe-loop.patch new file mode 100644 index 00000000000..a47e891a17f --- /dev/null +++ b/queue-6.1/drm-bridge-anx7625-prevent-endless-probe-loop.patch @@ -0,0 +1,264 @@ +From b2c9fd982bf95c0ec277c0d7acaf738f1b12aa26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 15:39:02 -0400 +Subject: drm/bridge: anx7625: Prevent endless probe loop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 1464e48d69ab7a50a377c9d39f5e5eb3cee2722e ] + +During probe, the driver registers i2c dummy devices and populates the +aux bus, which registers a device for the panel. After doing that, the +driver can still defer probe if needed. This ordering of operations is +troublesome however, because the deferred probe work will retry probing +all pending devices every time a new device is registered. Therefore, if +modules need to be loaded in order to satisfy the dependencies for this +driver to complete probe, the kernel will stall, since it'll keep trying +to probe the anx7625 driver, but never succeed, given that modules would +only be loaded after the deferred probe work completes. + +Two changes are required to avoid this issue: +* Move of_find_mipi_dsi_host_by_node(), which can defer probe, to before + anx7625_register_i2c_dummy_clients() and + devm_of_dp_aux_populate_ep_devices(), which register devices. +* Make use of the done_probing callback when populating the aux bus, + so that the bridge registration is only done after the panel is + probed. This is required because the panel might need to defer probe, + but the aux bus population needs the i2c dummy devices working, so + this call couldn't just be moved to an earlier point in probe. + One caveat is that if the panel is described outside the aux bus, the + probe loop issue can still happen, but we don't have a way to avoid + it in that case since there's no callback available. + +With this patch applied, it's possible to boot on +mt8192-asurada-spherion with + +CONFIG_DRM_ANALOGIX_ANX7625=y +CONFIG_MTK_MMSYS=m +CONFIG_BACKLIGHT_PWM=y + +and also with + +CONFIG_DRM_ANALOGIX_ANX7625=y +CONFIG_MTK_MMSYS=y +CONFIG_BACKLIGHT_PWM=m + +Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel") +Fixes: 269332997a16 ("drm/bridge: anx7625: Return -EPROBE_DEFER if the dsi host was not found") +Reported-by: "kernelci.org bot" +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230518193902.891121-1-nfraprado@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 128 +++++++++++++++------- + 1 file changed, 88 insertions(+), 40 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 86a52c5f4fbc4..213263ad6a064 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1689,6 +1689,14 @@ static int anx7625_parse_dt(struct device *dev, + if (of_property_read_bool(np, "analogix,audio-enable")) + pdata->audio_en = 1; + ++ return 0; ++} ++ ++static int anx7625_parse_dt_panel(struct device *dev, ++ struct anx7625_platform_data *pdata) ++{ ++ struct device_node *np = dev->of_node; ++ + pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0); + if (IS_ERR(pdata->panel_bridge)) { + if (PTR_ERR(pdata->panel_bridge) == -ENODEV) { +@@ -2034,7 +2042,7 @@ static int anx7625_register_audio(struct device *dev, struct anx7625_data *ctx) + return 0; + } + +-static int anx7625_attach_dsi(struct anx7625_data *ctx) ++static int anx7625_setup_dsi_device(struct anx7625_data *ctx) + { + struct mipi_dsi_device *dsi; + struct device *dev = &ctx->client->dev; +@@ -2044,9 +2052,6 @@ static int anx7625_attach_dsi(struct anx7625_data *ctx) + .channel = 0, + .node = NULL, + }; +- int ret; +- +- DRM_DEV_DEBUG_DRIVER(dev, "attach dsi\n"); + + host = of_find_mipi_dsi_host_by_node(ctx->pdata.mipi_host_node); + if (!host) { +@@ -2067,14 +2072,24 @@ static int anx7625_attach_dsi(struct anx7625_data *ctx) + MIPI_DSI_MODE_VIDEO_HSE | + MIPI_DSI_HS_PKT_END_ALIGNED; + +- ret = devm_mipi_dsi_attach(dev, dsi); ++ ctx->dsi = dsi; ++ ++ return 0; ++} ++ ++static int anx7625_attach_dsi(struct anx7625_data *ctx) ++{ ++ struct device *dev = &ctx->client->dev; ++ int ret; ++ ++ DRM_DEV_DEBUG_DRIVER(dev, "attach dsi\n"); ++ ++ ret = devm_mipi_dsi_attach(dev, ctx->dsi); + if (ret) { + DRM_DEV_ERROR(dev, "fail to attach dsi to host.\n"); + return ret; + } + +- ctx->dsi = dsi; +- + DRM_DEV_DEBUG_DRIVER(dev, "attach dsi succeeded.\n"); + + return 0; +@@ -2562,6 +2577,40 @@ static void anx7625_runtime_disable(void *data) + pm_runtime_disable(data); + } + ++static int anx7625_link_bridge(struct drm_dp_aux *aux) ++{ ++ struct anx7625_data *platform = container_of(aux, struct anx7625_data, aux); ++ struct device *dev = aux->dev; ++ int ret; ++ ++ ret = anx7625_parse_dt_panel(dev, &platform->pdata); ++ if (ret) { ++ DRM_DEV_ERROR(dev, "fail to parse DT for panel : %d\n", ret); ++ return ret; ++ } ++ ++ platform->bridge.funcs = &anx7625_bridge_funcs; ++ platform->bridge.of_node = dev->of_node; ++ if (!anx7625_of_panel_on_aux_bus(dev)) ++ platform->bridge.ops |= DRM_BRIDGE_OP_EDID; ++ if (!platform->pdata.panel_bridge) ++ platform->bridge.ops |= DRM_BRIDGE_OP_HPD | ++ DRM_BRIDGE_OP_DETECT; ++ platform->bridge.type = platform->pdata.panel_bridge ? ++ DRM_MODE_CONNECTOR_eDP : ++ DRM_MODE_CONNECTOR_DisplayPort; ++ ++ drm_bridge_add(&platform->bridge); ++ ++ if (!platform->pdata.is_dpi) { ++ ret = anx7625_attach_dsi(platform); ++ if (ret) ++ drm_bridge_remove(&platform->bridge); ++ } ++ ++ return ret; ++} ++ + static int anx7625_i2c_probe(struct i2c_client *client) + { + struct anx7625_data *platform; +@@ -2636,6 +2685,24 @@ static int anx7625_i2c_probe(struct i2c_client *client) + platform->aux.wait_hpd_asserted = anx7625_wait_hpd_asserted; + drm_dp_aux_init(&platform->aux); + ++ ret = anx7625_parse_dt(dev, pdata); ++ if (ret) { ++ if (ret != -EPROBE_DEFER) ++ DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret); ++ goto free_wq; ++ } ++ ++ if (!platform->pdata.is_dpi) { ++ ret = anx7625_setup_dsi_device(platform); ++ if (ret < 0) ++ goto free_wq; ++ } ++ ++ /* ++ * Registering the i2c devices will retrigger deferred probe, so it ++ * needs to be done after calls that might return EPROBE_DEFER, ++ * otherwise we can get an infinite loop. ++ */ + if (anx7625_register_i2c_dummy_clients(platform, client) != 0) { + ret = -ENOMEM; + DRM_DEV_ERROR(dev, "fail to reserve I2C bus.\n"); +@@ -2650,13 +2717,21 @@ static int anx7625_i2c_probe(struct i2c_client *client) + if (ret) + goto free_wq; + +- devm_of_dp_aux_populate_ep_devices(&platform->aux); +- +- ret = anx7625_parse_dt(dev, pdata); ++ /* ++ * Populating the aux bus will retrigger deferred probe, so it needs to ++ * be done after calls that might return EPROBE_DEFER, otherwise we can ++ * get an infinite loop. ++ */ ++ ret = devm_of_dp_aux_populate_bus(&platform->aux, anx7625_link_bridge); + if (ret) { +- if (ret != -EPROBE_DEFER) +- DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret); +- goto free_wq; ++ if (ret != -ENODEV) { ++ DRM_DEV_ERROR(dev, "failed to populate aux bus : %d\n", ret); ++ goto free_wq; ++ } ++ ++ ret = anx7625_link_bridge(&platform->aux); ++ if (ret) ++ goto free_wq; + } + + if (!platform->pdata.low_power_mode) { +@@ -2669,27 +2744,6 @@ static int anx7625_i2c_probe(struct i2c_client *client) + if (platform->pdata.intp_irq) + queue_work(platform->workqueue, &platform->work); + +- platform->bridge.funcs = &anx7625_bridge_funcs; +- platform->bridge.of_node = client->dev.of_node; +- if (!anx7625_of_panel_on_aux_bus(&client->dev)) +- platform->bridge.ops |= DRM_BRIDGE_OP_EDID; +- if (!platform->pdata.panel_bridge) +- platform->bridge.ops |= DRM_BRIDGE_OP_HPD | +- DRM_BRIDGE_OP_DETECT; +- platform->bridge.type = platform->pdata.panel_bridge ? +- DRM_MODE_CONNECTOR_eDP : +- DRM_MODE_CONNECTOR_DisplayPort; +- +- drm_bridge_add(&platform->bridge); +- +- if (!platform->pdata.is_dpi) { +- ret = anx7625_attach_dsi(platform); +- if (ret) { +- DRM_DEV_ERROR(dev, "Fail to attach to dsi : %d\n", ret); +- goto unregister_bridge; +- } +- } +- + if (platform->pdata.audio_en) + anx7625_register_audio(dev, platform); + +@@ -2697,12 +2751,6 @@ static int anx7625_i2c_probe(struct i2c_client *client) + + return 0; + +-unregister_bridge: +- drm_bridge_remove(&platform->bridge); +- +- if (!platform->pdata.low_power_mode) +- pm_runtime_put_sync_suspend(&client->dev); +- + free_wq: + if (platform->workqueue) + destroy_workqueue(platform->workqueue); +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-introduce-pre_enable_prev_first-to-alter-.patch b/queue-6.1/drm-bridge-introduce-pre_enable_prev_first-to-alter-.patch new file mode 100644 index 00000000000..16c3f565417 --- /dev/null +++ b/queue-6.1/drm-bridge-introduce-pre_enable_prev_first-to-alter-.patch @@ -0,0 +1,270 @@ +From 3bcd91df87394559cf72a6c21eb473055aab1228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 17:33:26 +0000 +Subject: drm/bridge: Introduce pre_enable_prev_first to alter bridge init + order + +From: Dave Stevenson + +[ Upstream commit 4fb912e5e19075874379cfcf074d90bd51ebf8ea ] + +DSI sink devices typically want the DSI host powered up and configured +before they are powered up. pre_enable is the place this would normally +happen, but they are called in reverse order from panel/connector towards +the encoder, which is the "wrong" order. + +Add a new flag pre_enable_prev_first that any bridge can set +to swap the order of pre_enable (and post_disable) for that and the +immediately previous bridge. +Should the immediately previous bridge also set the +pre_enable_prev_first flag, the previous bridge to that will be called +before either of those which requested pre_enable_prev_first. + +eg: +- Panel +- Bridge 1 +- Bridge 2 pre_enable_prev_first +- Bridge 3 +- Bridge 4 pre_enable_prev_first +- Bridge 5 pre_enable_prev_first +- Bridge 6 +- Encoder +Would result in pre_enable's being called as Panel, Bridge 1, Bridge 3, +Bridge 2, Bridge 6, Bridge 5, Bridge 4, Encoder. + +Signed-off-by: Dave Stevenson +Tested-by: Frieder Schrempf +Reviewed-by: Frieder Schrempf +Link: https://lore.kernel.org/r/20221205173328.1395350-5-dave.stevenson@raspberrypi.com +Signed-off-by: Maxime Ripard +Stable-dep-of: dd9e329af723 ("drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_bridge.c | 145 +++++++++++++++++++++++++++++------ + include/drm/drm_bridge.h | 8 ++ + 2 files changed, 129 insertions(+), 24 deletions(-) + +diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c +index 1545c50fd1c8f..7044e339a82cd 100644 +--- a/drivers/gpu/drm/drm_bridge.c ++++ b/drivers/gpu/drm/drm_bridge.c +@@ -691,6 +691,25 @@ void drm_atomic_bridge_chain_disable(struct drm_bridge *bridge, + } + EXPORT_SYMBOL(drm_atomic_bridge_chain_disable); + ++static void drm_atomic_bridge_call_post_disable(struct drm_bridge *bridge, ++ struct drm_atomic_state *old_state) ++{ ++ if (old_state && bridge->funcs->atomic_post_disable) { ++ struct drm_bridge_state *old_bridge_state; ++ ++ old_bridge_state = ++ drm_atomic_get_old_bridge_state(old_state, ++ bridge); ++ if (WARN_ON(!old_bridge_state)) ++ return; ++ ++ bridge->funcs->atomic_post_disable(bridge, ++ old_bridge_state); ++ } else if (bridge->funcs->post_disable) { ++ bridge->funcs->post_disable(bridge); ++ } ++} ++ + /** + * drm_atomic_bridge_chain_post_disable - cleans up after disabling all bridges + * in the encoder chain +@@ -702,36 +721,86 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_disable); + * starting from the first bridge to the last. These are called after completing + * &drm_encoder_helper_funcs.atomic_disable + * ++ * If a bridge sets @pre_enable_prev_first, then the @post_disable for that ++ * bridge will be called before the previous one to reverse the @pre_enable ++ * calling direction. ++ * + * Note: the bridge passed should be the one closest to the encoder + */ + void drm_atomic_bridge_chain_post_disable(struct drm_bridge *bridge, + struct drm_atomic_state *old_state) + { + struct drm_encoder *encoder; ++ struct drm_bridge *next, *limit; + + if (!bridge) + return; + + encoder = bridge->encoder; ++ + list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) { +- if (bridge->funcs->atomic_post_disable) { +- struct drm_bridge_state *old_bridge_state; ++ limit = NULL; ++ ++ if (!list_is_last(&bridge->chain_node, &encoder->bridge_chain)) { ++ next = list_next_entry(bridge, chain_node); ++ ++ if (next->pre_enable_prev_first) { ++ /* next bridge had requested that prev ++ * was enabled first, so disabled last ++ */ ++ limit = next; ++ ++ /* Find the next bridge that has NOT requested ++ * prev to be enabled first / disabled last ++ */ ++ list_for_each_entry_from(next, &encoder->bridge_chain, ++ chain_node) { ++ if (next->pre_enable_prev_first) { ++ next = list_prev_entry(next, chain_node); ++ limit = next; ++ break; ++ } ++ } ++ ++ /* Call these bridges in reverse order */ ++ list_for_each_entry_from_reverse(next, &encoder->bridge_chain, ++ chain_node) { ++ if (next == bridge) ++ break; ++ ++ drm_atomic_bridge_call_post_disable(next, ++ old_state); ++ } ++ } ++ } + +- old_bridge_state = +- drm_atomic_get_old_bridge_state(old_state, +- bridge); +- if (WARN_ON(!old_bridge_state)) +- return; ++ drm_atomic_bridge_call_post_disable(bridge, old_state); + +- bridge->funcs->atomic_post_disable(bridge, +- old_bridge_state); +- } else if (bridge->funcs->post_disable) { +- bridge->funcs->post_disable(bridge); +- } ++ if (limit) ++ /* Jump all bridges that we have already post_disabled */ ++ bridge = limit; + } + } + EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable); + ++static void drm_atomic_bridge_call_pre_enable(struct drm_bridge *bridge, ++ struct drm_atomic_state *old_state) ++{ ++ if (old_state && bridge->funcs->atomic_pre_enable) { ++ struct drm_bridge_state *old_bridge_state; ++ ++ old_bridge_state = ++ drm_atomic_get_old_bridge_state(old_state, ++ bridge); ++ if (WARN_ON(!old_bridge_state)) ++ return; ++ ++ bridge->funcs->atomic_pre_enable(bridge, old_bridge_state); ++ } else if (bridge->funcs->pre_enable) { ++ bridge->funcs->pre_enable(bridge); ++ } ++} ++ + /** + * drm_atomic_bridge_chain_pre_enable - prepares for enabling all bridges in + * the encoder chain +@@ -743,32 +812,60 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable); + * starting from the last bridge to the first. These are called before calling + * &drm_encoder_helper_funcs.atomic_enable + * ++ * If a bridge sets @pre_enable_prev_first, then the pre_enable for the ++ * prev bridge will be called before pre_enable of this bridge. ++ * + * Note: the bridge passed should be the one closest to the encoder + */ + void drm_atomic_bridge_chain_pre_enable(struct drm_bridge *bridge, + struct drm_atomic_state *old_state) + { + struct drm_encoder *encoder; +- struct drm_bridge *iter; ++ struct drm_bridge *iter, *next, *limit; + + if (!bridge) + return; + + encoder = bridge->encoder; ++ + list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { +- if (iter->funcs->atomic_pre_enable) { +- struct drm_bridge_state *old_bridge_state; ++ if (iter->pre_enable_prev_first) { ++ next = iter; ++ limit = bridge; ++ list_for_each_entry_from_reverse(next, ++ &encoder->bridge_chain, ++ chain_node) { ++ if (next == bridge) ++ break; ++ ++ if (!next->pre_enable_prev_first) { ++ /* Found first bridge that does NOT ++ * request prev to be enabled first ++ */ ++ limit = list_prev_entry(next, chain_node); ++ break; ++ } ++ } ++ ++ list_for_each_entry_from(next, &encoder->bridge_chain, chain_node) { ++ /* Call requested prev bridge pre_enable ++ * in order. ++ */ ++ if (next == iter) ++ /* At the first bridge to request prev ++ * bridges called first. ++ */ ++ break; ++ ++ drm_atomic_bridge_call_pre_enable(next, old_state); ++ } ++ } + +- old_bridge_state = +- drm_atomic_get_old_bridge_state(old_state, +- iter); +- if (WARN_ON(!old_bridge_state)) +- return; ++ drm_atomic_bridge_call_pre_enable(iter, old_state); + +- iter->funcs->atomic_pre_enable(iter, old_bridge_state); +- } else if (iter->funcs->pre_enable) { +- iter->funcs->pre_enable(iter); +- } ++ if (iter->pre_enable_prev_first) ++ /* Jump all bridges that we have already pre_enabled */ ++ iter = limit; + + if (iter == bridge) + break; +diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h +index 288c6feda5de2..6b656ea23b964 100644 +--- a/include/drm/drm_bridge.h ++++ b/include/drm/drm_bridge.h +@@ -768,6 +768,14 @@ struct drm_bridge { + * modes. + */ + bool interlace_allowed; ++ /** ++ * @pre_enable_prev_first: The bridge requires that the prev ++ * bridge @pre_enable function is called before its @pre_enable, ++ * and conversely for post_disable. This is most frequently a ++ * requirement for DSI devices which need the host to be initialised ++ * before the peripheral. ++ */ ++ bool pre_enable_prev_first; + /** + * @ddc: Associated I2C adapter for DDC access, if any. + */ +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-it6505-move-a-variable-assignment-behind-.patch b/queue-6.1/drm-bridge-it6505-move-a-variable-assignment-behind-.patch new file mode 100644 index 00000000000..5023431afde --- /dev/null +++ b/queue-6.1/drm-bridge-it6505-move-a-variable-assignment-behind-.patch @@ -0,0 +1,56 @@ +From 859eefce490f2294d24316d887a9fec28e071fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 17:30:46 +0200 +Subject: drm/bridge: it6505: Move a variable assignment behind a null pointer + check in receive_timing_debugfs_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Elfring + +[ Upstream commit 0be05a75de2916421e88e0d64b001984f54df0bd ] + +The address of a data structure member was determined before +a corresponding null pointer check in the implementation of +the function “receive_timing_debugfs_show”. + +Thus avoid the risk for undefined behaviour by moving the assignment +for the variable “vid” behind the null pointer check. + +This issue was detected by using the Coccinelle software. + +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Signed-off-by: Markus Elfring +Link: https://patchwork.freedesktop.org/patch/msgid/fa69384f-1485-142b-c4ee-3df54ac68a89@web.de +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 99123eec45511..292c4f6da04af 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -3085,7 +3085,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, + size_t len, loff_t *ppos) + { + struct it6505 *it6505 = file->private_data; +- struct drm_display_mode *vid = &it6505->video_info; ++ struct drm_display_mode *vid; + u8 read_buf[READ_BUFFER_SIZE]; + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE; + ssize_t ret, count; +@@ -3094,6 +3094,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, + return -ENODEV; + + it6505_calc_video_info(it6505); ++ vid = &it6505->video_info; + str += scnprintf(str, end - str, "---video timing---\n"); + str += scnprintf(str, end - str, "PCLK:%d.%03dMHz\n", + vid->clock / 1000, vid->clock % 1000); +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358767-switch-to-devm-mipi-dsi-helpers.patch b/queue-6.1/drm-bridge-tc358767-switch-to-devm-mipi-dsi-helpers.patch new file mode 100644 index 00000000000..a98ddc189cb --- /dev/null +++ b/queue-6.1/drm-bridge-tc358767-switch-to-devm-mipi-dsi-helpers.patch @@ -0,0 +1,47 @@ +From 04d017623d15b2b11a46f7656f072982ad5e00b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 14:21:06 +0200 +Subject: drm/bridge: tc358767: Switch to devm MIPI-DSI helpers + +From: Alexander Stein + +[ Upstream commit f47d6140b7a4c858d82d263e7577ff6fb5279a9c ] + +DSI device registering and attaching needs to be undone upon +deregistration. This fixes module unload/load. + +Fixes: bbfd3190b656 ("drm/bridge: tc358767: Add DSI-to-DPI mode support") +Signed-off-by: Alexander Stein +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230517122107.1766673-1-alexander.stein@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index b9b681086fc49..7ef78283e3d3e 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1890,7 +1890,7 @@ static int tc_mipi_dsi_host_attach(struct tc_data *tc) + if (dsi_lanes < 0) + return dsi_lanes; + +- dsi = mipi_dsi_device_register_full(host, &info); ++ dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) + return dev_err_probe(dev, PTR_ERR(dsi), + "failed to create dsi device\n"); +@@ -1901,7 +1901,7 @@ static int tc_mipi_dsi_host_attach(struct tc_data *tc) + dsi->format = MIPI_DSI_FMT_RGB888; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE; + +- ret = mipi_dsi_attach(dsi); ++ ret = devm_mipi_dsi_attach(dev, dsi); + if (ret < 0) { + dev_err(dev, "failed to attach dsi to host: %d\n", ret); + return ret; +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch b/queue-6.1/drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch new file mode 100644 index 00000000000..37827b40e93 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch @@ -0,0 +1,98 @@ +From b80f853beeffb045161b5a08059a9c08ef838f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 11:59:41 +0200 +Subject: drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation + +From: Francesco Dolcini + +[ Upstream commit cec5ccef85bd0128cf895612de54a9d21d2015d0 ] + +Add atomic_get_input_bus_fmts() implementation, tc358768 has a parallel +RGB input interface with the actual bus format depending on the amount +of parallel input data lines. + +Without this change when the tc358768 is used with less than 24bit the +color mapping is completely wrong. + +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230330095941.428122-7-francesco@dolcini.it +Stable-dep-of: ee18698e212b ("drm/bridge: tc358768: fix TCLK_TRAILCNT computation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 44 +++++++++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 765bdebbd06f9..8f7efb14ebdc7 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -919,6 +920,44 @@ static void tc358768_bridge_enable(struct drm_bridge *bridge) + } + } + ++#define MAX_INPUT_SEL_FORMATS 1 ++ ++static u32 * ++tc358768_atomic_get_input_bus_fmts(struct drm_bridge *bridge, ++ struct drm_bridge_state *bridge_state, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state, ++ u32 output_fmt, ++ unsigned int *num_input_fmts) ++{ ++ struct tc358768_priv *priv = bridge_to_tc358768(bridge); ++ u32 *input_fmts; ++ ++ *num_input_fmts = 0; ++ ++ input_fmts = kcalloc(MAX_INPUT_SEL_FORMATS, sizeof(*input_fmts), ++ GFP_KERNEL); ++ if (!input_fmts) ++ return NULL; ++ ++ switch (priv->pd_lines) { ++ case 16: ++ input_fmts[0] = MEDIA_BUS_FMT_RGB565_1X16; ++ break; ++ case 18: ++ input_fmts[0] = MEDIA_BUS_FMT_RGB666_1X18; ++ break; ++ default: ++ case 24: ++ input_fmts[0] = MEDIA_BUS_FMT_RGB888_1X24; ++ break; ++ }; ++ ++ *num_input_fmts = MAX_INPUT_SEL_FORMATS; ++ ++ return input_fmts; ++} ++ + static const struct drm_bridge_funcs tc358768_bridge_funcs = { + .attach = tc358768_bridge_attach, + .mode_valid = tc358768_bridge_mode_valid, +@@ -926,6 +965,11 @@ static const struct drm_bridge_funcs tc358768_bridge_funcs = { + .enable = tc358768_bridge_enable, + .disable = tc358768_bridge_disable, + .post_disable = tc358768_bridge_post_disable, ++ ++ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, ++ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, ++ .atomic_reset = drm_atomic_helper_bridge_reset, ++ .atomic_get_input_bus_fmts = tc358768_atomic_get_input_bus_fmts, + }; + + static const struct drm_bridge_timings default_tc358768_timings = { +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-always-enable-hs-video-mode.patch b/queue-6.1/drm-bridge-tc358768-always-enable-hs-video-mode.patch new file mode 100644 index 00000000000..d7e2ffd0ee5 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-always-enable-hs-video-mode.patch @@ -0,0 +1,49 @@ +From 5681e90c2ab7e6f88cbc265a7c5b1d24c3298275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:26 +0200 +Subject: drm/bridge: tc358768: always enable HS video mode + +From: Francesco Dolcini + +[ Upstream commit 75a8aeac2573ab258c53676eba9b3796ea691988 ] + +Always enable HS video mode setting the TXMD bit, without this change no +video output is present with DSI sinks that are setting +MIPI_DSI_MODE_LPM flag (tested with LT8912B DSI-HDMI bridge). + +Previously the driver was enabling HS mode only when the DSI sink was +not explicitly setting the MIPI_DSI_MODE_LPM, however this is not +correct. + +The MIPI_DSI_MODE_LPM is supposed to indicate that the sink is willing +to receive data in low power mode, however clearing the +TC358768_DSI_CONTROL_TXMD bit will make the TC358768 send video in +LP mode that is not the intended behavior. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 4c4b77ce8aba3..23a7a1206e900 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -867,8 +867,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + val = TC358768_DSI_CONFW_MODE_SET | TC358768_DSI_CONFW_ADDR_DSI_CONTROL; + val |= (dsi_dev->lanes - 1) << 1; + +- if (!(dsi_dev->mode_flags & MIPI_DSI_MODE_LPM)) +- val |= TC358768_DSI_CONTROL_TXMD; ++ val |= TC358768_DSI_CONTROL_TXMD; + + if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS)) + val |= TC358768_DSI_CONTROL_HSCKMD; +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-pll-parameters-computation.patch b/queue-6.1/drm-bridge-tc358768-fix-pll-parameters-computation.patch new file mode 100644 index 00000000000..54122687bf7 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-pll-parameters-computation.patch @@ -0,0 +1,49 @@ +From 418682db9fe8e2d1424d39dfabf5eb107ae9b196 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:27 +0200 +Subject: drm/bridge: tc358768: fix PLL parameters computation + +From: Francesco Dolcini + +[ Upstream commit 6a4020b4c63911977aaf8047f904a300d15de739 ] + +According to Toshiba documentation the PLL input clock after the divider +should be not less than 4MHz, fix the PLL parameters computation +accordingly. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 23a7a1206e900..f961259dc85bd 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -335,13 +335,17 @@ static int tc358768_calc_pll(struct tc358768_priv *priv, + u32 fbd; + + for (fbd = 0; fbd < 512; ++fbd) { +- u32 pll, diff; ++ u32 pll, diff, pll_in; + + pll = (u32)div_u64((u64)refclk * (fbd + 1), divisor); + + if (pll >= max_pll || pll < min_pll) + continue; + ++ pll_in = (u32)div_u64((u64)refclk, prd + 1); ++ if (pll_in < 4000000) ++ continue; ++ + diff = max(pll, target_pll) - min(pll, target_pll); + + if (diff < best_diff) { +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-pll-target-frequency.patch b/queue-6.1/drm-bridge-tc358768-fix-pll-target-frequency.patch new file mode 100644 index 00000000000..4f9062cd69a --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-pll-target-frequency.patch @@ -0,0 +1,74 @@ +From b2b6ef1e81db4a8e724f5a6204df4414e0b0bff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:28 +0200 +Subject: drm/bridge: tc358768: fix PLL target frequency + +From: Francesco Dolcini + +[ Upstream commit ffd2e4bbea626d565b9817312b0fcfb382fecb88 ] + +Correctly compute the PLL target frequency, the current formula works +correctly only when the input bus width is 24bit, actually to properly +compute the PLL target frequency what is relevant is the bits-per-pixel +on the DSI link. + +No regression expected since the DSI format is currently hard-coded as +MIPI_DSI_FMT_RGB888. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index f961259dc85bd..9bc726b79dd57 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -147,6 +147,7 @@ struct tc358768_priv { + + u32 pd_lines; /* number of Parallel Port Input Data Lines */ + u32 dsi_lanes; /* number of DSI Lanes */ ++ u32 dsi_bpp; /* number of Bits Per Pixel over DSI */ + + /* Parameters for PLL programming */ + u32 fbd; /* PLL feedback divider */ +@@ -285,12 +286,12 @@ static void tc358768_hw_disable(struct tc358768_priv *priv) + + static u32 tc358768_pll_to_pclk(struct tc358768_priv *priv, u32 pll_clk) + { +- return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->pd_lines); ++ return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->dsi_bpp); + } + + static u32 tc358768_pclk_to_pll(struct tc358768_priv *priv, u32 pclk) + { +- return (u32)div_u64((u64)pclk * priv->pd_lines, priv->dsi_lanes); ++ return (u32)div_u64((u64)pclk * priv->dsi_bpp, priv->dsi_lanes); + } + + static int tc358768_calc_pll(struct tc358768_priv *priv, +@@ -427,6 +428,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host, + priv->output.panel = panel; + + priv->dsi_lanes = dev->lanes; ++ priv->dsi_bpp = mipi_dsi_pixel_format_to_bpp(dev->format); + + /* get input ep (port0/endpoint0) */ + ret = -EINVAL; +@@ -438,7 +440,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host, + } + + if (ret) +- priv->pd_lines = mipi_dsi_pixel_format_to_bpp(dev->format); ++ priv->pd_lines = priv->dsi_bpp; + + drm_bridge_add(&priv->bridge); + +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch b/queue-6.1/drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch new file mode 100644 index 00000000000..ff72db5453d --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch @@ -0,0 +1,92 @@ +From b131639e980166d4350283faf9f0d0002a86cc8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:30 +0200 +Subject: drm/bridge: tc358768: fix TCLK_TRAILCNT computation + +From: Francesco Dolcini + +[ Upstream commit ee18698e212b1659dd0850d7e2ae0f22e16ed3d3 ] + +Correct computation of TCLK_TRAILCNT register. + +The driver does not implement non-continuous clock mode, so the actual +value doesn't make a practical difference yet. However this change also +ensures that the value does not write to reserved registers bits in case +of under/overflow. + +This register must be set to a value that ensures that + +TCLK-TRAIL > 60ns + and +TEOT <= (105 ns + 12 x UI) + +with the actual value of TCLK-TRAIL being + +(TCLK_TRAILCNT + (1 to 2)) xHSByteClkCycle + + (2 + (1 to 2)) * HSBYTECLKCycle - (PHY output delay) + +with PHY output delay being about + +(2 to 3) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 8f7efb14ebdc7..822de6e356a2c 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -640,6 +641,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + struct mipi_dsi_device *dsi_dev = priv->output.dev; + unsigned long mode_flags = dsi_dev->mode_flags; + u32 val, val2, lptxcnt, hact, data_type; ++ s32 raw_val; + const struct drm_display_mode *mode; + u32 dsibclk_nsk, dsiclk_nsk, ui_nsk, phy_delay_nsk; + u32 dsiclk, dsibclk, video_start; +@@ -751,9 +753,9 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_HEADERCNT, val); + +- /* TCLK_TRAIL > 60ns + 3*UI */ +- val = 60 + tc358768_to_ns(3 * ui_nsk); +- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 5; ++ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */ ++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5; ++ val = clamp(raw_val, 0, 127); + dev_dbg(priv->dev, "TCLK_TRAILCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_TRAILCNT, val); + +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch b/queue-6.1/drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch new file mode 100644 index 00000000000..fab39ff185a --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch @@ -0,0 +1,54 @@ +From 4e14d5d8b36947c55aa7a4a6902527205374bb20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:29 +0200 +Subject: drm/bridge: tc358768: fix TCLK_ZEROCNT computation + +From: Francesco Dolcini + +[ Upstream commit f9cf811374f42fca31ac34aaf59ee2ae72b89879 ] + +Correct computation of TCLK_ZEROCNT register. + +This register must be set to a value that ensure that +(TCLK-PREPARECNT + TCLK-ZERO) > 300ns + +with the actual value of (TCLK-PREPARECNT + TCLK-ZERO) being + +(1 to 2) + (TCLK_ZEROCNT + 1)) x HSByteClkCycle + (PHY output delay) + +with PHY output delay being about + +(2 to 3) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 9bc726b79dd57..765bdebbd06f9 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -743,10 +743,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + + /* 38ns < TCLK_PREPARE < 95ns */ + val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1; +- /* TCLK_PREPARE > 300ns */ +- val2 = tc358768_ns_to_cnt(300 + tc358768_to_ns(3 * ui_nsk), +- dsibclk_nsk); +- val |= (val2 - tc358768_to_ns(phy_delay_nsk - dsibclk_nsk)) << 8; ++ /* TCLK_PREPARE + TCLK_ZERO > 300ns */ ++ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk), ++ dsibclk_nsk) - 2; ++ val |= val2 << 8; + dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_HEADERCNT, val); + +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-ths_trailcnt-computation.patch b/queue-6.1/drm-bridge-tc358768-fix-ths_trailcnt-computation.patch new file mode 100644 index 00000000000..d45d2695055 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-ths_trailcnt-computation.patch @@ -0,0 +1,60 @@ +From 0544ccbfdeee7ad579accb54c55c3b76dfc54bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:33 +0200 +Subject: drm/bridge: tc358768: fix THS_TRAILCNT computation + +From: Francesco Dolcini + +[ Upstream commit bac7842cd179572e8e0fc2d7b5254e40c6e9e057 ] + +Correct computation of THS_TRAILCNT register. + +This register must be set to a value that ensure that +THS_TRAIL > 60 ns + 4 x UI + and +THS_TRAIL > 8 x UI + and +THS_TRAIL < TEOT + with +TEOT = 105 ns + (12 x UI) + +with the actual value of THS_TRAIL being + +(1 + THS_TRAILCNT) x ByteClk cycle + ((1 to 2) + 2) xHSBYTECLK cycle + + - (PHY output delay) + +with PHY output delay being about + +(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-9-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index ab408f3407ba4..2d0ac9987b58e 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -781,9 +781,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + dev_dbg(priv->dev, "TCLK_POSTCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_POSTCNT, val); + +- /* 60ns + 4*UI < THS_PREPARE < 105ns + 12*UI */ +- val = tc358768_ns_to_cnt(60 + tc358768_to_ns(15 * ui_nsk), +- dsibclk_nsk) - 5; ++ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */ ++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk), ++ dsibclk_nsk) - 4; ++ val = clamp(raw_val, 0, 15); + dev_dbg(priv->dev, "THS_TRAILCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_THS_TRAILCNT, val); + +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-ths_zerocnt-computation.patch b/queue-6.1/drm-bridge-tc358768-fix-ths_zerocnt-computation.patch new file mode 100644 index 00000000000..83350ac9a70 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-ths_zerocnt-computation.patch @@ -0,0 +1,54 @@ +From f671c7e20aefe5b6c152314ffb4bd51d041fc6e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:31 +0200 +Subject: drm/bridge: tc358768: fix THS_ZEROCNT computation + +From: Francesco Dolcini + +[ Upstream commit 77a089328da791118af9692543a5eedc79eb5fd4 ] + +Correct computation of THS_ZEROCNT register. + +This register must be set to a value that ensure that +THS_PREPARE + THS_ZERO > 145ns + 10*UI + +with the actual value of (THS_PREPARE + THS_ZERO) being + +((1 to 2) + 1 + (TCLK_ZEROCNT + 1) + (3 to 4)) x ByteClk cycle + + + HSByteClk x (2 + (1 to 2)) + (PHY delay) + +with PHY delay being about + +(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-7-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 822de6e356a2c..014585b9582b9 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -762,9 +762,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */ + val = 50 + tc358768_to_ns(4 * ui_nsk); + val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1; +- /* THS_ZERO > 145ns + 10*UI */ +- val2 = tc358768_ns_to_cnt(145 - tc358768_to_ns(ui_nsk), dsibclk_nsk); +- val |= (val2 - tc358768_to_ns(phy_delay_nsk)) << 8; ++ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */ ++ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10; ++ val2 = clamp(raw_val, 0, 127); ++ val |= val2 << 8; + dev_dbg(priv->dev, "THS_HEADERCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_THS_HEADERCNT, val); + +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-tc358768-fix-txtagocnt-computation.patch b/queue-6.1/drm-bridge-tc358768-fix-txtagocnt-computation.patch new file mode 100644 index 00000000000..71f2aadeec4 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358768-fix-txtagocnt-computation.patch @@ -0,0 +1,44 @@ +From ba26621c6887da79fb9725f4c09b4dc3ef8a6870 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:32 +0200 +Subject: drm/bridge: tc358768: fix TXTAGOCNT computation + +From: Francesco Dolcini + +[ Upstream commit 3666aad8185af8d0ce164fd3c4974235417d6d0b ] + +Correct computation of TXTAGOCNT register. + +This register must be set to a value that ensure that the +TTA-GO period = (4 x TLPX) + +with the actual value of TTA-GO being + +4 x (TXTAGOCNT + 1) x (HSByteClk cycle) + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-8-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 014585b9582b9..ab408f3407ba4 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -797,7 +797,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + + /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */ + val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4); +- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1; ++ val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1; + val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk), + dsibclk_nsk) - 2; + val = val << 16 | val2; +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-ti-sn65dsi83-fix-enable-disable-flow-to-m.patch b/queue-6.1/drm-bridge-ti-sn65dsi83-fix-enable-disable-flow-to-m.patch new file mode 100644 index 00000000000..192ab235463 --- /dev/null +++ b/queue-6.1/drm-bridge-ti-sn65dsi83-fix-enable-disable-flow-to-m.patch @@ -0,0 +1,97 @@ +From bf5a38865d0656e3a531ed13c16f96c504a5b769 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 18:33:07 +0200 +Subject: drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec + +From: Frieder Schrempf + +[ Upstream commit dd9e329af7236e34c566d3705ea32a63069b9b13 ] + +The datasheet describes the following initialization flow including +minimum delay times between each step: + +1. DSI data lanes need to be in LP-11 and the clock lane in HS mode +2. toggle EN signal +3. initialize registers +4. enable PLL +5. soft reset +6. enable DSI stream +7. check error status register + +To meet this requirement we need to make sure the host bridge's +pre_enable() is called first by using the pre_enable_prev_first +flag. + +Furthermore we need to split enable() into pre_enable() which covers +steps 2-5 from above and enable() which covers step 7 and is called +after the host bridge's enable(). + +Signed-off-by: Frieder Schrempf +Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") +Tested-by: Alexander Stein #TQMa8MxML/MBa8Mx +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230503163313.2640898-3-frieder@fris.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi83.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +index 0635b824e3682..55efd3eb66723 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +@@ -321,8 +321,8 @@ static u8 sn65dsi83_get_dsi_div(struct sn65dsi83 *ctx) + return dsi_div - 1; + } + +-static void sn65dsi83_atomic_enable(struct drm_bridge *bridge, +- struct drm_bridge_state *old_bridge_state) ++static void sn65dsi83_atomic_pre_enable(struct drm_bridge *bridge, ++ struct drm_bridge_state *old_bridge_state) + { + struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge); + struct drm_atomic_state *state = old_bridge_state->base.state; +@@ -485,11 +485,22 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge, + /* Trigger reset after CSR register update. */ + regmap_write(ctx->regmap, REG_RC_RESET, REG_RC_RESET_SOFT_RESET); + ++ /* Wait for 10ms after soft reset as specified in datasheet */ ++ usleep_range(10000, 12000); ++} ++ ++static void sn65dsi83_atomic_enable(struct drm_bridge *bridge, ++ struct drm_bridge_state *old_bridge_state) ++{ ++ struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge); ++ unsigned int pval; ++ + /* Clear all errors that got asserted during initialization. */ + regmap_read(ctx->regmap, REG_IRQ_STAT, &pval); + regmap_write(ctx->regmap, REG_IRQ_STAT, pval); + +- usleep_range(10000, 12000); ++ /* Wait for 1ms and check for errors in status register */ ++ usleep_range(1000, 1100); + regmap_read(ctx->regmap, REG_IRQ_STAT, &pval); + if (pval) + dev_err(ctx->dev, "Unexpected link status 0x%02x\n", pval); +@@ -556,6 +567,7 @@ static const struct drm_bridge_funcs sn65dsi83_funcs = { + .attach = sn65dsi83_attach, + .detach = sn65dsi83_detach, + .atomic_enable = sn65dsi83_atomic_enable, ++ .atomic_pre_enable = sn65dsi83_atomic_pre_enable, + .atomic_disable = sn65dsi83_atomic_disable, + .mode_valid = sn65dsi83_mode_valid, + +@@ -696,6 +708,7 @@ static int sn65dsi83_probe(struct i2c_client *client, + + ctx->bridge.funcs = &sn65dsi83_funcs; + ctx->bridge.of_node = dev->of_node; ++ ctx->bridge.pre_enable_prev_first = true; + drm_bridge_add(&ctx->bridge); + + ret = sn65dsi83_host_attach(ctx); +-- +2.39.2 + diff --git a/queue-6.1/drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch b/queue-6.1/drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch new file mode 100644 index 00000000000..1d3e8c05383 --- /dev/null +++ b/queue-6.1/drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch @@ -0,0 +1,36 @@ +From 431c9c6759048c5e34b3f7ae671c956791886057 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 08:53:16 +0200 +Subject: drm/bridge: ti-sn65dsi83: Fix enable error path + +From: Alexander Stein + +[ Upstream commit 8a91b29f1f50ce7742cdbe5cf11d17f128511f3f ] + +If PLL locking failed, the regulator needs to be disabled again. + +Fixes: 5664e3c907e2 ("drm/bridge: ti-sn65dsi83: Add vcc supply regulator support") +Signed-off-by: Alexander Stein +Reviewed-by: Laurent Pinchart +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230504065316.2640739-1-alexander.stein@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +index 047c14ddbbf11..0635b824e3682 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +@@ -478,6 +478,7 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge, + dev_err(ctx->dev, "failed to lock PLL, ret=%i\n", ret); + /* On failure, disable PLL again and exit. */ + regmap_write(ctx->regmap, REG_RC_PLL_EN, 0x00); ++ regulator_disable(ctx->vcc); + return; + } + +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch b/queue-6.1/drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch new file mode 100644 index 00000000000..a4fd78fdd34 --- /dev/null +++ b/queue-6.1/drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch @@ -0,0 +1,50 @@ +From af405c4ed856355211038cc3b1504bdd682a7454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Apr 2023 04:13:29 +0300 +Subject: drm/msm/a5xx: really check for A510 in a5xx_gpu_init + +From: Dmitry Baryshkov + +[ Upstream commit 736a9327365644b460e4498b1ce172ca411efcbc ] + +The commit 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno +510") added special handling for a510 (this SKU doesn't seem to support +preemption, so the driver should clamp nr_rings to 1). However the +gpu->revn is not yet set (it is set later, in adreno_gpu_init()) and +thus the condition is always false. Check config->rev instead. + +Fixes: 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno 510") +Reported-by: Adam Skladowski +Signed-off-by: Dmitry Baryshkov +Tested-by: Adam Skladowski +Patchwork: https://patchwork.freedesktop.org/patch/531511/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index 24feae285ccd6..0829eaf2cd4e8 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -1740,6 +1740,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + { + struct msm_drm_private *priv = dev->dev_private; + struct platform_device *pdev = priv->gpu_pdev; ++ struct adreno_platform_config *config = pdev->dev.platform_data; + struct a5xx_gpu *a5xx_gpu = NULL; + struct adreno_gpu *adreno_gpu; + struct msm_gpu *gpu; +@@ -1766,7 +1767,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + + nr_rings = 4; + +- if (adreno_is_a510(adreno_gpu)) ++ if (adreno_cmp_rev(ADRENO_REV(5, 1, 0, ANY_ID), config->rev)) + nr_rings = 1; + + ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings); +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch b/queue-6.1/drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch new file mode 100644 index 00000000000..f61b6703a47 --- /dev/null +++ b/queue-6.1/drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch @@ -0,0 +1,100 @@ +From ead65d25fcf2727796511e838883d817d9654c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 22:03:08 +0530 +Subject: drm/msm/disp/dpu: get timing engine status from intf status register + +From: Vinod Polimera + +[ Upstream commit e3969eadc8ee78a5bdca65b8ed0a421a359e4090 ] + +Recommended way of reading the interface timing gen status is via +status register. Timing gen status register will give a reliable status +of the interface especially during ON/OFF transitions. This support was +added from DPU version 5.0.0. + +Signed-off-by: Vinod Polimera +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/524724/ +Link: https://lore.kernel.org/r/1677774797-31063-6-git-send-email-quic_vpolimer@quicinc.com +Signed-off-by: Dmitry Baryshkov +Stable-dep-of: a7129231edf3 ("drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 3 ++- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 12 +++++++----- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 8 +++++++- + 3 files changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 32a3c42ec45b1..715c7a254632b 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -79,7 +79,8 @@ + + #define INTF_SDM845_MASK (0) + +-#define INTF_SC7180_MASK BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) ++#define INTF_SC7180_MASK \ ++ (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED)) + + #define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +index 38aa38ab15685..77c46ce5a22f9 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +@@ -203,17 +203,19 @@ enum { + + /** + * INTF sub-blocks +- * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which +- * pixel data arrives to this INTF +- * @DPU_INTF_TE INTF block has TE configuration support +- * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate +- than video timing ++ * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which ++ * pixel data arrives to this INTF ++ * @DPU_INTF_TE INTF block has TE configuration support ++ * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate ++ * than video timing ++ * @DPU_INTF_STATUS_SUPPORTED INTF block has INTF_STATUS register + * @DPU_INTF_MAX + */ + enum { + DPU_INTF_INPUT_CTRL = 0x1, + DPU_INTF_TE, + DPU_DATA_HCTL_EN, ++ DPU_INTF_STATUS_SUPPORTED, + DPU_INTF_MAX + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +index b2a94b9a3e987..b9dddf576c029 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +@@ -57,6 +57,7 @@ + #define INTF_PROG_FETCH_START 0x170 + #define INTF_PROG_ROT_START 0x174 + #define INTF_MUX 0x25C ++#define INTF_STATUS 0x26C + + #define INTF_CFG_ACTIVE_H_EN BIT(29) + #define INTF_CFG_ACTIVE_V_EN BIT(30) +@@ -292,8 +293,13 @@ static void dpu_hw_intf_get_status( + struct intf_status *s) + { + struct dpu_hw_blk_reg_map *c = &intf->hw; ++ unsigned long cap = intf->cap->features; ++ ++ if (cap & BIT(DPU_INTF_STATUS_SUPPORTED)) ++ s->is_en = DPU_REG_READ(c, INTF_STATUS) & BIT(0); ++ else ++ s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN); + +- s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN); + s->is_prog_fetch_en = !!(DPU_REG_READ(c, INTF_CONFIG) & BIT(31)); + if (s->is_en) { + s->frame_count = DPU_REG_READ(c, INTF_FRAME_COUNT); +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dp-free-resources-after-unregistering-them.patch b/queue-6.1/drm-msm-dp-free-resources-after-unregistering-them.patch new file mode 100644 index 00000000000..83c1584e4ec --- /dev/null +++ b/queue-6.1/drm-msm-dp-free-resources-after-unregistering-them.patch @@ -0,0 +1,46 @@ +From 5df25001fa6d18147428dcc3b23f6c2d1f44273b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 15:02:59 -0700 +Subject: drm/msm/dp: Free resources after unregistering them + +From: Bjorn Andersson + +[ Upstream commit fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8 ] + +The DP component's unbind operation walks through the submodules to +unregister and clean things up. But if the unbind happens because the DP +controller itself is being removed, all the memory for those submodules +has just been freed. + +Change the order of these operations to avoid the many use-after-free +that otherwise happens in this code path. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Signed-off-by: Bjorn Andersson +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/542166/ +Link: https://lore.kernel.org/r/20230612220259.1884381-1-quic_bjorande@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 57b82e5d0ab12..d16c12351adb6 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1342,9 +1342,9 @@ static int dp_display_remove(struct platform_device *pdev) + { + struct dp_display_private *dp = dev_get_dp_display_private(&pdev->dev); + ++ component_del(&pdev->dev, &dp_display_comp_ops); + dp_display_deinit_sub_modules(dp); + +- component_del(&pdev->dev, &dp_display_comp_ops); + platform_set_drvdata(pdev, NULL); + + return 0; +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dpu-correct-merge_3d-length.patch b/queue-6.1/drm-msm-dpu-correct-merge_3d-length.patch new file mode 100644 index 00000000000..a753343f816 --- /dev/null +++ b/queue-6.1/drm-msm-dpu-correct-merge_3d-length.patch @@ -0,0 +1,39 @@ +From 83502f86a85ce439b0d2d6b2b399da40f222ab89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 03:09:41 +0300 +Subject: drm/msm/dpu: correct MERGE_3D length + +From: Dmitry Baryshkov + +[ Upstream commit 9a6c13b847d61b0c3796820ca6e976789df59cd8 ] + +Each MERGE_3D block has just two registers. Correct the block length +accordingly. + +Fixes: 4369c93cf36b ("drm/msm/dpu: initial support for merge3D hardware block") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/542177/ +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20230613001004.3426676-3-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 80e59d3f9dd3e..b2f330e99b0cd 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -1203,7 +1203,7 @@ static struct dpu_pingpong_cfg qcm2290_pp[] = { + #define MERGE_3D_BLK(_name, _id, _base) \ + {\ + .name = _name, .id = _id, \ +- .base = _base, .len = 0x100, \ ++ .base = _base, .len = 0x8, \ + .features = MERGE_3D_SM8150_MASK, \ + .sblk = NULL \ + } +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch b/queue-6.1/drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch new file mode 100644 index 00000000000..dd5c9feb8e1 --- /dev/null +++ b/queue-6.1/drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch @@ -0,0 +1,54 @@ +From 0c4b0924a6ac451789e6b799fe24a39e17679730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 21:25:33 +0300 +Subject: drm/msm/dpu: do not enable color-management if DSPPs are not + available + +From: Dmitry Baryshkov + +[ Upstream commit 3bcfc7b90465efd337d39b91b43972162f0d1908 ] + +We can not support color management without DSPP blocks being provided +in the HW catalog. Do not enable color management for CRTCs if num_dspps +is 0. + +Fixes: 4259ff7ae509 ("drm/msm/dpu: add support for pcc color block in dpu driver") +Reported-by: Yongqin Liu +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Reviewed-by: Marijn Suijten +Reviewed-by: Sumit Semwal +Tested-by: Yongqin Liu +Patchwork: https://patchwork.freedesktop.org/patch/542141/ +Link: https://lore.kernel.org/r/20230612182534.3345805-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index c9d1c412628e9..6c0ffe8e4adbd 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -1579,6 +1579,8 @@ static const struct drm_crtc_helper_funcs dpu_crtc_helper_funcs = { + struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane, + struct drm_plane *cursor) + { ++ struct msm_drm_private *priv = dev->dev_private; ++ struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms); + struct drm_crtc *crtc = NULL; + struct dpu_crtc *dpu_crtc = NULL; + int i; +@@ -1610,7 +1612,8 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane, + + drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs); + +- drm_crtc_enable_color_mgmt(crtc, 0, true, 0); ++ if (dpu_kms->catalog->dspp_count) ++ drm_crtc_enable_color_mgmt(crtc, 0, true, 0); + + /* save user friendly CRTC name for later */ + snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id); +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dpu-fix-slice_last_group_size-calculation.patch b/queue-6.1/drm-msm-dpu-fix-slice_last_group_size-calculation.patch new file mode 100644 index 00000000000..a289e00a1ed --- /dev/null +++ b/queue-6.1/drm-msm-dpu-fix-slice_last_group_size-calculation.patch @@ -0,0 +1,44 @@ +From c1d21963a72e92a598816dc179736082d58d281d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 10:45:20 -0700 +Subject: drm/msm/dpu: Fix slice_last_group_size calculation + +From: Jessica Zhang + +[ Upstream commit c223059e6f8340f7eac2319470984cbfc39c433b ] + +Correct the math for slice_last_group_size so that it matches the +calculations downstream. + +Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Marijn Suijten +Signed-off-by: Jessica Zhang +Patchwork: https://patchwork.freedesktop.org/patch/539269/ +Link: https://lore.kernel.org/r/20230329-rfc-msm-dsc-helper-v14-7-bafc7be95691@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c +index 3662df698dae5..c8f14555834a8 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c +@@ -52,9 +52,10 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc, + if (is_cmd_mode) + initial_lines += 1; + +- slice_last_group_size = 3 - (dsc->slice_width % 3); ++ slice_last_group_size = (dsc->slice_width + 2) % 3; ++ + data = (initial_lines << 20); +- data |= ((slice_last_group_size - 1) << 18); ++ data |= (slice_last_group_size << 18); + /* bpp is 6.4 format, 4 LSBs bits are for fractional part */ + data |= (dsc->bits_per_pixel << 8); + data |= (dsc->block_pred_enable << 7); +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch b/queue-6.1/drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch new file mode 100644 index 00000000000..2e16bf2d477 --- /dev/null +++ b/queue-6.1/drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch @@ -0,0 +1,48 @@ +From 0565f24c9c04fdea4d867d1cd1e8185438f84e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 20:49:59 +0200 +Subject: drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK + +From: Konrad Dybcio + +[ Upstream commit a7129231edf329a00e92dbd2d741f6da728a4a06 ] + +DPU5 and newer targets enable this unconditionally. Move it from the +SC7280 mask to the SC7180 one. + +Fixes: 7e6ee55320f0 ("drm/msm/disp/dpu1: enable DATA_HCTL_EN for sc7280 target") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Marijn Suijten +Signed-off-by: Konrad Dybcio +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/538159/ +Link: https://lore.kernel.org/r/20230508-topic-hctl_en-v2-1-e7bea9f1f5dd@linaro.org +[DB: removed BIT(DPU_INTF_DATA_COMPRESS), which is not yet merged] +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 715c7a254632b..80e59d3f9dd3e 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -80,9 +80,12 @@ + #define INTF_SDM845_MASK (0) + + #define INTF_SC7180_MASK \ +- (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED)) ++ (BIT(DPU_INTF_INPUT_CTRL) | \ ++ BIT(DPU_INTF_TE) | \ ++ BIT(DPU_INTF_STATUS_SUPPORTED) | \ ++ BIT(DPU_DATA_HCTL_EN)) + +-#define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN) ++#define INTF_SC7280_MASK (INTF_SC7180_MASK) + + #define IRQ_SDM845_MASK (BIT(MDP_SSPP_TOP0_INTR) | \ + BIT(MDP_SSPP_TOP0_INTR2) | \ +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dpu-set-dsc-flush-bit-correctly-at-mdp-ctl-f.patch b/queue-6.1/drm-msm-dpu-set-dsc-flush-bit-correctly-at-mdp-ctl-f.patch new file mode 100644 index 00000000000..29d0cb132c8 --- /dev/null +++ b/queue-6.1/drm-msm-dpu-set-dsc-flush-bit-correctly-at-mdp-ctl-f.patch @@ -0,0 +1,49 @@ +From a1e78d83ff1ba1a8cf89e288240283f319308f02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 10:40:49 -0700 +Subject: drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register + +From: Kuogee Hsieh + +[ Upstream commit 12cef323c903bd8b13d1f6ff24a9695c2cdc360b ] + +The CTL_FLUSH register should be programmed with the 22th bit +(DSC_IDX) to flush the DSC hardware blocks, not the literal value of +22 (which corresponds to flushing VIG1, VIG2 and RGB1 instead). + +Changes in V12: +-- split this patch out of "separate DSC flush update out of interface" + +Changes in V13: +-- rewording the commit text + +Changes in V14: +-- drop 'DSC" from "The DSC CTL_FLUSH register" at commit text + +Fixes: 77f6da90487c ("drm/msm/disp/dpu1: Add DSC support in hw_ctl") +Signed-off-by: Kuogee Hsieh +Reviewed-by: Marijn Suijten +Patchwork: https://patchwork.freedesktop.org/patch/539496/ +Link: https://lore.kernel.org/r/1685036458-22683-2-git-send-email-quic_khsieh@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +index a35ecb6676c88..696c32d30d10c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +@@ -550,7 +550,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx, + DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE, + BIT(cfg->merge_3d - MERGE_3D_0)); + if (cfg->dsc) { +- DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, DSC_IDX); ++ DPU_REG_WRITE(&ctx->hw, CTL_FLUSH, BIT(DSC_IDX)); + DPU_REG_WRITE(c, CTL_DSC_ACTIVE, cfg->dsc); + } + } +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch b/queue-6.1/drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch new file mode 100644 index 00000000000..cb4174bdf7a --- /dev/null +++ b/queue-6.1/drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch @@ -0,0 +1,45 @@ +From 0fe6567477f62c749403d7bc6c8e7dda15f574f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 04:12:57 +0300 +Subject: drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate + +From: Dmitry Baryshkov + +[ Upstream commit 1e0a97f84d73ea1182740f62069690c7f3271abb ] + +If the dispcc uses CLK_OPS_PARENT_ENABLE (e.g. on QCM2290), CCF can try +enabling VCO before the rate has been programmed. This can cause clock +lockups and/or other boot issues. Program the VCO to the minimal PLL +rate if the read rate is 0 Hz. + +Cc: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Reported-by: Vladimir Zapolskiy +Reported-by: Konrad Dybcio +Reviewed-by: Konrad Dybcio +Fixes: f079f6d999cb ("drm/msm/dsi: Add PHY/PLL for 8x96") +Patchwork: https://patchwork.freedesktop.org/patch/534813/ +Link: https://lore.kernel.org/r/20230501011257.3460103-1-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +index 0f8f4ca464291..f0780c40b379a 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +@@ -539,6 +539,9 @@ static int dsi_pll_14nm_vco_prepare(struct clk_hw *hw) + if (unlikely(pll_14nm->phy->pll_on)) + return 0; + ++ if (dsi_pll_14nm_vco_recalc_rate(hw, VCO_REF_CLK_RATE) == 0) ++ dsi_pll_14nm_vco_set_rate(hw, pll_14nm->phy->cfg->min_pll_rate, VCO_REF_CLK_RATE); ++ + dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VREF_CFG1, 0x10); + dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 1); + +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dsi-flip-greater-than-check-for-slice_count-.patch b/queue-6.1/drm-msm-dsi-flip-greater-than-check-for-slice_count-.patch new file mode 100644 index 00000000000..c022566e33c --- /dev/null +++ b/queue-6.1/drm-msm-dsi-flip-greater-than-check-for-slice_count-.patch @@ -0,0 +1,51 @@ +From 8789d89aede8e7c68c449beba649be79f9769fe9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 00:19:38 +0100 +Subject: drm/msm/dsi: Flip greater-than check for slice_count and + slice_per_intf + +From: Marijn Suijten + +[ Upstream commit 82e72fd22a8f9eff4e75c08be68319008ea90a29 ] + +According to downstream /and the comment copied from it/ this comparison +should be the other way around. In other words, when the panel driver +requests to use more slices per packet than what could be sent over this +interface, it is bumped down to only use a single slice per packet (and +strangely not the number of slices that could fit on the interface). + +Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/515686/ +Link: https://lore.kernel.org/r/20221221231943.1961117-4-marijn.suijten@somainline.org +Signed-off-by: Dmitry Baryshkov +Stable-dep-of: 155fa3a91d64 ("drm/msm/dsi: Remove incorrect references to slice_count") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index 5ab5e872c3cf1..ef988e4c21045 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -853,11 +853,12 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + */ + slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width); + +- /* If slice_per_pkt is greater than slice_per_intf ++ /* ++ * If slice_count is greater than slice_per_intf + * then default to 1. This can happen during partial + * update. + */ +- if (slice_per_intf > dsc->slice_count) ++ if (dsc->slice_count > slice_per_intf) + dsc->slice_count = 1; + + total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dsi-remove-incorrect-references-to-slice_cou.patch b/queue-6.1/drm-msm-dsi-remove-incorrect-references-to-slice_cou.patch new file mode 100644 index 00000000000..cff12d3febb --- /dev/null +++ b/queue-6.1/drm-msm-dsi-remove-incorrect-references-to-slice_cou.patch @@ -0,0 +1,83 @@ +From 7bb09875453c3f6cb8ba027d6e22fa45fd4be102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 15:57:17 -0700 +Subject: drm/msm/dsi: Remove incorrect references to slice_count + +From: Jessica Zhang + +[ Upstream commit 155fa3a91d64221eb0885fd221cc8085dbef908f ] + +Currently, slice_count is being used to calculate word count and +pkt_per_line. Instead, these values should be calculated using slice per +packet, which is not the same as slice_count. + +Slice count represents the number of slices per interface, and its value +will not always match that of slice per packet. For example, it is possible +to have cases where there are multiple slices per interface but the panel +specifies only one slice per packet. + +Thus, use the default value of one slice per packet and remove slice_count +from the aforementioned calculations. + +Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration") +Fixes: bc6b6ff8135c ("drm/msm/dsi: Use DSC slice(s) packet size to compute word count") +Reviewed-by: Marijn Suijten +Signed-off-by: Jessica Zhang +Patchwork: https://patchwork.freedesktop.org/patch/541965/ +Link: https://lore.kernel.org/r/20230405-add-dsc-support-v6-5-95eab864d1b6@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index ef988e4c21045..b433ccfe4d7da 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -853,18 +853,17 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + */ + slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width); + +- /* +- * If slice_count is greater than slice_per_intf +- * then default to 1. This can happen during partial +- * update. +- */ +- if (dsc->slice_count > slice_per_intf) +- dsc->slice_count = 1; +- + total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; + + eol_byte_num = total_bytes_per_intf % 3; +- pkt_per_line = slice_per_intf / dsc->slice_count; ++ ++ /* ++ * Typically, pkt_per_line = slice_per_intf * slice_per_pkt. ++ * ++ * Since the current driver only supports slice_per_pkt = 1, ++ * pkt_per_line will be equal to slice per intf for now. ++ */ ++ pkt_per_line = slice_per_intf; + + if (is_cmd_mode) /* packet data type */ + reg = DSI_COMMAND_COMPRESSION_MODE_CTRL_STREAM0_DATATYPE(MIPI_DSI_DCS_LONG_WRITE); +@@ -988,7 +987,14 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) + if (!msm_host->dsc) + wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1; + else +- wc = msm_host->dsc->slice_chunk_size * msm_host->dsc->slice_count + 1; ++ /* ++ * When DSC is enabled, WC = slice_chunk_size * slice_per_pkt + 1. ++ * Currently, the driver only supports default value of slice_per_pkt = 1 ++ * ++ * TODO: Expand mipi_dsi_device struct to hold slice_per_pkt info ++ * and adjust DSC math to account for slice_per_pkt. ++ */ ++ wc = msm_host->dsc->slice_chunk_size + 1; + + dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL, + DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) | +-- +2.39.2 + diff --git a/queue-6.1/drm-msm-dsi-use-dsc-slice-s-packet-size-to-compute-w.patch b/queue-6.1/drm-msm-dsi-use-dsc-slice-s-packet-size-to-compute-w.patch new file mode 100644 index 00000000000..a7ae20e079e --- /dev/null +++ b/queue-6.1/drm-msm-dsi-use-dsc-slice-s-packet-size-to-compute-w.patch @@ -0,0 +1,53 @@ +From 89313b0ea2508e25ab66f171639b86a8ecfeddb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 00:19:37 +0100 +Subject: drm/msm/dsi: Use DSC slice(s) packet size to compute word count + +From: Marijn Suijten + +[ Upstream commit bc6b6ff8135c4b96787eda88f3baf653939a75ce ] + +According to downstream the value to use for WORD_COUNT is +bytes_per_pkt, which denotes the number of bytes in a packet based on +how many slices have been configured by the panel driver times the +width of a slice times the number of bytes per pixel. + +The DSC panels seen thus far use one byte per pixel, only one slice +per packet, and a slice width of half the panel width leading to the +desired bytes_per_pkt+1 value to be equal to hdisplay/2+1. This however +isn't the case anymore for panels that configure two slices per packet, +where the value should now be hdisplay+1. + +Note that the aforementioned panel (on a Sony Xperia XZ3, sdm845) with +slice_count=1 has also been tested to successfully accept slice_count=2, +which would have shown corrupted output previously. + +Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/515694/ +Link: https://lore.kernel.org/r/20221221231943.1961117-3-marijn.suijten@somainline.org +Signed-off-by: Dmitry Baryshkov +Stable-dep-of: 155fa3a91d64 ("drm/msm/dsi: Remove incorrect references to slice_count") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index f167a45f1fbdd..5ab5e872c3cf1 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -987,7 +987,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) + if (!msm_host->dsc) + wc = hdisplay * dsi_get_bpp(msm_host->format) / 8 + 1; + else +- wc = mode->hdisplay / 2 + 1; ++ wc = msm_host->dsc->slice_chunk_size * msm_host->dsc->slice_count + 1; + + dsi_write(msm_host, REG_DSI_CMD_MDP_STREAM0_CTRL, + DSI_CMD_MDP_STREAM0_CTRL_WORD_COUNT(wc) | +-- +2.39.2 + diff --git a/queue-6.1/drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch b/queue-6.1/drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch new file mode 100644 index 00000000000..276e45648ea --- /dev/null +++ b/queue-6.1/drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch @@ -0,0 +1,60 @@ +From bda9e0ed299858d24c3a2ca3c52da29710b7360f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 20:26:38 +0300 +Subject: drm/panel: sharp-ls043t1le01: adjust mode settings + +From: Dmitry Baryshkov + +[ Upstream commit dee23b2c9e3ff46d59c5d45e1436eceb878e7c9a ] + +Using current settings causes panel flickering on APQ8074 dragonboard. +Adjust panel settings to follow the vendor-provided mode. This also +enables MIPI_DSI_MODE_VIDEO_SYNC_PULSE, which is also specified by the +vendor dtsi for the mentioned dragonboard. + +Fixes: ee0172383190 ("drm/panel: Add Sharp LS043T1LE01 MIPI DSI panel") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230507172639.2320934-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +index d1ec80a3e3c72..ef148504cf24a 100644 +--- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c ++++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +@@ -192,15 +192,15 @@ static int sharp_nt_panel_enable(struct drm_panel *panel) + } + + static const struct drm_display_mode default_mode = { +- .clock = 41118, ++ .clock = (540 + 48 + 32 + 80) * (960 + 3 + 10 + 15) * 60 / 1000, + .hdisplay = 540, + .hsync_start = 540 + 48, +- .hsync_end = 540 + 48 + 80, +- .htotal = 540 + 48 + 80 + 32, ++ .hsync_end = 540 + 48 + 32, ++ .htotal = 540 + 48 + 32 + 80, + .vdisplay = 960, + .vsync_start = 960 + 3, +- .vsync_end = 960 + 3 + 15, +- .vtotal = 960 + 3 + 15 + 1, ++ .vsync_end = 960 + 3 + 10, ++ .vtotal = 960 + 3 + 10 + 15, + }; + + static int sharp_nt_panel_get_modes(struct drm_panel *panel, +@@ -280,6 +280,7 @@ static int sharp_nt_panel_probe(struct mipi_dsi_device *dsi) + dsi->lanes = 2; + dsi->format = MIPI_DSI_FMT_RGB888; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | ++ MIPI_DSI_MODE_VIDEO_SYNC_PULSE | + MIPI_DSI_MODE_VIDEO_HSE | + MIPI_DSI_CLOCK_NON_CONTINUOUS | + MIPI_DSI_MODE_NO_EOT_PACKET; +-- +2.39.2 + diff --git a/queue-6.1/drm-panel-simple-fix-active-size-for-ampire-am-48027.patch b/queue-6.1/drm-panel-simple-fix-active-size-for-ampire-am-48027.patch new file mode 100644 index 00000000000..da58b52d9bf --- /dev/null +++ b/queue-6.1/drm-panel-simple-fix-active-size-for-ampire-am-48027.patch @@ -0,0 +1,51 @@ +From 15921532bc692092c267c4fcec00c651802f8206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 10:50:39 +0200 +Subject: drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H + +From: Dario Binacchi + +[ Upstream commit f24b49550814fdee4a98b9552e35e243ccafd4a8 ] + +The previous setting was related to the overall dimension and not to the +active display area. +In the "PHYSICAL SPECIFICATIONS" section, the datasheet shows the +following parameters: + + ---------------------------------------------------------- +| Item | Specifications | unit | + ---------------------------------------------------------- +| Display area | 98.7 (W) x 57.5 (H) | mm | + ---------------------------------------------------------- +| Overall dimension | 105.5(W) x 67.2(H) x 4.96(D) | mm | + ---------------------------------------------------------- + +Fixes: 966fea78adf2 ("drm/panel: simple: Add support for Ampire AM-480272H3TMQW-T01H") +Signed-off-by: Dario Binacchi +Reviewed-by: Neil Armstrong +[narmstrong: fixed Fixes commit id length] +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230516085039.3797303-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 8a3b685c2fcc0..7ca00b0323362 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -759,8 +759,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = { + .num_modes = 1, + .bpc = 8, + .size = { +- .width = 105, +- .height = 67, ++ .width = 99, ++ .height = 58, + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X24, + }; +-- +2.39.2 + diff --git a/queue-6.1/drm-radeon-fix-possible-division-by-zero-errors.patch b/queue-6.1/drm-radeon-fix-possible-division-by-zero-errors.patch new file mode 100644 index 00000000000..7749e954264 --- /dev/null +++ b/queue-6.1/drm-radeon-fix-possible-division-by-zero-errors.patch @@ -0,0 +1,94 @@ +From 0295515b72d81abaaf390d624a987971add86d05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 08:33:27 -0700 +Subject: drm/radeon: fix possible division-by-zero errors + +From: Nikita Zhandarovich + +[ Upstream commit 1becc57cd1a905e2aa0e1eca60d2a37744525c4a ] + +Function rv740_get_decoded_reference_divider() may return 0 due to +unpredictable reference divider value calculated in +radeon_atom_get_clock_dividers(). This will lead to +division-by-zero error once that value is used as a divider +in calculating 'clk_s'. +While unlikely, this issue should nonetheless be prevented so add a +sanity check for such cases by testing 'decoded_ref' value against 0. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +v2: minor coding style fixes (Alex) +In practice this should actually happen as the vbios should be +properly populated. + +Fixes: 66229b200598 ("drm/radeon/kms: add dpm support for rv7xx (v4)") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cypress_dpm.c | 8 ++++++-- + drivers/gpu/drm/radeon/ni_dpm.c | 8 ++++++-- + drivers/gpu/drm/radeon/rv740_dpm.c | 8 ++++++-- + 3 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c +index fdddbbaecbb74..72a0768df00f7 100644 +--- a/drivers/gpu/drm/radeon/cypress_dpm.c ++++ b/drivers/gpu/drm/radeon/cypress_dpm.c +@@ -557,8 +557,12 @@ static int cypress_populate_mclk_value(struct radeon_device *rdev, + ASIC_INTERNAL_MEMORY_SS, vco_freq)) { + u32 reference_clock = rdev->clock.mpll.reference_freq; + u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); +- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); +- u32 clk_v = ss.percentage * ++ u32 clk_s, clk_v; ++ ++ if (!decoded_ref) ++ return -EINVAL; ++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); ++ clk_v = ss.percentage * + (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625); + + mpll_ss1 &= ~CLKV_MASK; +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index 672d2239293e0..3e1c1a392fb7b 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2241,8 +2241,12 @@ static int ni_populate_mclk_value(struct radeon_device *rdev, + ASIC_INTERNAL_MEMORY_SS, vco_freq)) { + u32 reference_clock = rdev->clock.mpll.reference_freq; + u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); +- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); +- u32 clk_v = ss.percentage * ++ u32 clk_s, clk_v; ++ ++ if (!decoded_ref) ++ return -EINVAL; ++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); ++ clk_v = ss.percentage * + (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625); + + mpll_ss1 &= ~CLKV_MASK; +diff --git a/drivers/gpu/drm/radeon/rv740_dpm.c b/drivers/gpu/drm/radeon/rv740_dpm.c +index d57a3e1df8d63..4464fd21a3029 100644 +--- a/drivers/gpu/drm/radeon/rv740_dpm.c ++++ b/drivers/gpu/drm/radeon/rv740_dpm.c +@@ -249,8 +249,12 @@ int rv740_populate_mclk_value(struct radeon_device *rdev, + ASIC_INTERNAL_MEMORY_SS, vco_freq)) { + u32 reference_clock = rdev->clock.mpll.reference_freq; + u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); +- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); +- u32 clk_v = 0x40000 * ss.percentage * ++ u32 clk_s, clk_v; ++ ++ if (!decoded_ref) ++ return -EINVAL; ++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); ++ clk_v = 0x40000 * ss.percentage * + (dividers.whole_fb_div + (dividers.frac_fb_div / 8)) / (clk_s * 10000); + + mpll_ss1 &= ~CLKV_MASK; +-- +2.39.2 + diff --git a/queue-6.1/drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch b/queue-6.1/drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch new file mode 100644 index 00000000000..f721255929e --- /dev/null +++ b/queue-6.1/drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch @@ -0,0 +1,116 @@ +From 08773b1d2c89ad7022fa51b5635bbbf7da5590d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Apr 2023 19:23:46 +0800 +Subject: drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` + +From: XuDong Liu + +[ Upstream commit 123ee07ba5b7123e0ce0e0f9d64938026c16a2ce ] + +Smatch reports: +drivers/gpu/drm/sun4i/sun4i_tcon.c:805 sun4i_tcon_init_clocks() warn: +'tcon->clk' from clk_prepare_enable() not released on lines: 792,801. + +In the function sun4i_tcon_init_clocks(), tcon->clk and tcon->sclk0 are +not disabled in the error handling, which affects the release of +these variable. Although sun4i_tcon_bind(), which calls +sun4i_tcon_init_clocks(), use sun4i_tcon_free_clocks to disable the +variables mentioned, but the error handling branch of +sun4i_tcon_init_clocks() ignores the required disable process. + +To fix this issue, use the devm_clk_get_enabled to automatically +balance enable and disabled calls. As original implementation use +sun4i_tcon_free_clocks() to disable clk explicitly, we delete the +related calls and error handling that are no longer needed. + +Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support") +Fixes: b14e945bda8a ("drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init") +Fixes: 8e9240472522 ("drm/sun4i: support TCONs without channel 1") +Fixes: 34d698f6e349 ("drm/sun4i: Add has_channel_0 TCON quirk") +Signed-off-by: XuDong Liu +Reviewed-by: Dongliang Mu +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230430112347.4689-1-m202071377@hust.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index 523a6d7879210..936796851ffd3 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -778,21 +778,19 @@ static irqreturn_t sun4i_tcon_handler(int irq, void *private) + static int sun4i_tcon_init_clocks(struct device *dev, + struct sun4i_tcon *tcon) + { +- tcon->clk = devm_clk_get(dev, "ahb"); ++ tcon->clk = devm_clk_get_enabled(dev, "ahb"); + if (IS_ERR(tcon->clk)) { + dev_err(dev, "Couldn't get the TCON bus clock\n"); + return PTR_ERR(tcon->clk); + } +- clk_prepare_enable(tcon->clk); + + if (tcon->quirks->has_channel_0) { +- tcon->sclk0 = devm_clk_get(dev, "tcon-ch0"); ++ tcon->sclk0 = devm_clk_get_enabled(dev, "tcon-ch0"); + if (IS_ERR(tcon->sclk0)) { + dev_err(dev, "Couldn't get the TCON channel 0 clock\n"); + return PTR_ERR(tcon->sclk0); + } + } +- clk_prepare_enable(tcon->sclk0); + + if (tcon->quirks->has_channel_1) { + tcon->sclk1 = devm_clk_get(dev, "tcon-ch1"); +@@ -805,12 +803,6 @@ static int sun4i_tcon_init_clocks(struct device *dev, + return 0; + } + +-static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon) +-{ +- clk_disable_unprepare(tcon->sclk0); +- clk_disable_unprepare(tcon->clk); +-} +- + static int sun4i_tcon_init_irq(struct device *dev, + struct sun4i_tcon *tcon) + { +@@ -1223,14 +1215,14 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master, + ret = sun4i_tcon_init_regmap(dev, tcon); + if (ret) { + dev_err(dev, "Couldn't init our TCON regmap\n"); +- goto err_free_clocks; ++ goto err_assert_reset; + } + + if (tcon->quirks->has_channel_0) { + ret = sun4i_dclk_create(dev, tcon); + if (ret) { + dev_err(dev, "Couldn't create our TCON dot clock\n"); +- goto err_free_clocks; ++ goto err_assert_reset; + } + } + +@@ -1293,8 +1285,6 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master, + err_free_dotclock: + if (tcon->quirks->has_channel_0) + sun4i_dclk_free(tcon); +-err_free_clocks: +- sun4i_tcon_free_clocks(tcon); + err_assert_reset: + reset_control_assert(tcon->lcd_rst); + return ret; +@@ -1308,7 +1298,6 @@ static void sun4i_tcon_unbind(struct device *dev, struct device *master, + list_del(&tcon->list); + if (tcon->quirks->has_channel_0) + sun4i_dclk_free(tcon); +- sun4i_tcon_free_clocks(tcon); + } + + static const struct component_ops sun4i_tcon_ops = { +-- +2.39.2 + diff --git a/queue-6.1/drm-vkms-fix-rgb565-pixel-conversion.patch b/queue-6.1/drm-vkms-fix-rgb565-pixel-conversion.patch new file mode 100644 index 00000000000..2d9c03b0e0a --- /dev/null +++ b/queue-6.1/drm-vkms-fix-rgb565-pixel-conversion.patch @@ -0,0 +1,66 @@ +From a51eadced127bf53b8b204b4952a6ffd2eef54ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 07:40:45 -0300 +Subject: drm/vkms: Fix RGB565 pixel conversion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit ab87f558dcfb2562c3497e89600dec798a446665 ] + +Currently, the pixel conversion isn't rounding the fixed-point values +before assigning it to the RGB coefficients, which is causing the IGT +pixel-format tests to fail. So, use the drm_fixp2int_round() fixed-point +helper to round the values when assigning it to the RGB coefficients. + +Tested with igt@kms_plane@pixel-format and igt@kms_plane@pixel-format-source-clamping. + +[v2]: + * Use drm_fixp2int_round() to fix the pixel conversion instead of + casting the values to s32 (Melissa Wen). + +Fixes: 89b03aeaef16 ("drm/vkms: fix 32bit compilation error by replacing macros") +Signed-off-by: Maíra Canal +Reviewed-by: Arthur Grillo +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230512104044.65034-2-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_formats.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c +index 8d948c73741ef..b11342026485f 100644 +--- a/drivers/gpu/drm/vkms/vkms_formats.c ++++ b/drivers/gpu/drm/vkms/vkms_formats.c +@@ -97,9 +97,9 @@ static void RGB565_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel) + s64 fp_b = drm_int2fixp(rgb_565 & 0x1f); + + out_pixel->a = (u16)0xffff; +- out_pixel->r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio)); +- out_pixel->g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio)); +- out_pixel->b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio)); ++ out_pixel->r = drm_fixp2int_round(drm_fixp_mul(fp_r, fp_rb_ratio)); ++ out_pixel->g = drm_fixp2int_round(drm_fixp_mul(fp_g, fp_g_ratio)); ++ out_pixel->b = drm_fixp2int_round(drm_fixp_mul(fp_b, fp_rb_ratio)); + } + + void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y) +@@ -216,9 +216,9 @@ static void argb_u16_to_RGB565(struct vkms_frame_info *frame_info, + s64 fp_g = drm_int2fixp(in_pixels[x].g); + s64 fp_b = drm_int2fixp(in_pixels[x].b); + +- u16 r = drm_fixp2int(drm_fixp_div(fp_r, fp_rb_ratio)); +- u16 g = drm_fixp2int(drm_fixp_div(fp_g, fp_g_ratio)); +- u16 b = drm_fixp2int(drm_fixp_div(fp_b, fp_rb_ratio)); ++ u16 r = drm_fixp2int_round(drm_fixp_div(fp_r, fp_rb_ratio)); ++ u16 g = drm_fixp2int_round(drm_fixp_div(fp_g, fp_g_ratio)); ++ u16 b = drm_fixp2int_round(drm_fixp_div(fp_b, fp_rb_ratio)); + + *dst_pixels = cpu_to_le16(r << 11 | g << 5 | b); + } +-- +2.39.2 + diff --git a/queue-6.1/drm-vkms-isolate-pixel-conversion-functionality.patch b/queue-6.1/drm-vkms-isolate-pixel-conversion-functionality.patch new file mode 100644 index 00000000000..aced85ad101 --- /dev/null +++ b/queue-6.1/drm-vkms-isolate-pixel-conversion-functionality.patch @@ -0,0 +1,268 @@ +From 599b2063169c4ba9655d4edb7c05c79233b78304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 10:05:21 -0300 +Subject: drm/vkms: isolate pixel conversion functionality +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 322d716a3e8a74fb75cd0f657647be4df253fd2f ] + +Currently, the pixel conversion functions repeat the same loop to +iterate the rows. Instead of repeating the same code for each pixel +format, create a function to wrap the loop and isolate the pixel +conversion functionality. + +Suggested-by: Arthur Grillo +Signed-off-by: Maíra Canal +Reviewed-by: Arthur Grillo +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230418130525.128733-2-mcanal@igalia.com +Stable-dep-of: ab87f558dcfb ("drm/vkms: Fix RGB565 pixel conversion") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_composer.c | 4 +- + drivers/gpu/drm/vkms/vkms_drv.h | 4 +- + drivers/gpu/drm/vkms/vkms_formats.c | 125 +++++++++++---------------- + drivers/gpu/drm/vkms/vkms_formats.h | 2 +- + drivers/gpu/drm/vkms/vkms_plane.c | 2 +- + 5 files changed, 56 insertions(+), 81 deletions(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c +index 8e53fa80742b2..80164e79af006 100644 +--- a/drivers/gpu/drm/vkms/vkms_composer.c ++++ b/drivers/gpu/drm/vkms/vkms_composer.c +@@ -99,7 +99,7 @@ static void blend(struct vkms_writeback_job *wb, + if (!check_y_limit(plane[i]->frame_info, y)) + continue; + +- plane[i]->plane_read(stage_buffer, plane[i]->frame_info, y); ++ vkms_compose_row(stage_buffer, plane[i], y); + pre_mul_alpha_blend(plane[i]->frame_info, stage_buffer, + output_buffer); + } +@@ -118,7 +118,7 @@ static int check_format_funcs(struct vkms_crtc_state *crtc_state, + u32 n_active_planes = crtc_state->num_active_planes; + + for (size_t i = 0; i < n_active_planes; i++) +- if (!planes[i]->plane_read) ++ if (!planes[i]->pixel_read) + return -1; + + if (active_wb && !active_wb->wb_write) +diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h +index 0a67b8073f7e5..de4efc0a3bd01 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.h ++++ b/drivers/gpu/drm/vkms/vkms_drv.h +@@ -56,8 +56,7 @@ struct vkms_writeback_job { + struct vkms_plane_state { + struct drm_shadow_plane_state base; + struct vkms_frame_info *frame_info; +- void (*plane_read)(struct line_buffer *buffer, +- const struct vkms_frame_info *frame_info, int y); ++ void (*pixel_read)(u8 *src_buffer, struct pixel_argb_u16 *out_pixel); + }; + + struct vkms_plane { +@@ -155,6 +154,7 @@ int vkms_verify_crc_source(struct drm_crtc *crtc, const char *source_name, + /* Composer Support */ + void vkms_composer_worker(struct work_struct *work); + void vkms_set_composer(struct vkms_output *out, bool enabled); ++void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y); + + /* Writeback */ + int vkms_enable_writeback_connector(struct vkms_device *vkmsdev); +diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c +index d4950688b3f17..8d948c73741ef 100644 +--- a/drivers/gpu/drm/vkms/vkms_formats.c ++++ b/drivers/gpu/drm/vkms/vkms_formats.c +@@ -42,100 +42,75 @@ static void *get_packed_src_addr(const struct vkms_frame_info *frame_info, int y + return packed_pixels_addr(frame_info, x_src, y_src); + } + +-static void ARGB8888_to_argb_u16(struct line_buffer *stage_buffer, +- const struct vkms_frame_info *frame_info, int y) ++static void ARGB8888_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel) + { +- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels; +- u8 *src_pixels = get_packed_src_addr(frame_info, y); +- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst), +- stage_buffer->n_pixels); +- +- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) { +- /* +- * The 257 is the "conversion ratio". This number is obtained by the +- * (2^16 - 1) / (2^8 - 1) division. Which, in this case, tries to get +- * the best color value in a pixel format with more possibilities. +- * A similar idea applies to others RGB color conversions. +- */ +- out_pixels[x].a = (u16)src_pixels[3] * 257; +- out_pixels[x].r = (u16)src_pixels[2] * 257; +- out_pixels[x].g = (u16)src_pixels[1] * 257; +- out_pixels[x].b = (u16)src_pixels[0] * 257; +- } ++ /* ++ * The 257 is the "conversion ratio". This number is obtained by the ++ * (2^16 - 1) / (2^8 - 1) division. Which, in this case, tries to get ++ * the best color value in a pixel format with more possibilities. ++ * A similar idea applies to others RGB color conversions. ++ */ ++ out_pixel->a = (u16)src_pixels[3] * 257; ++ out_pixel->r = (u16)src_pixels[2] * 257; ++ out_pixel->g = (u16)src_pixels[1] * 257; ++ out_pixel->b = (u16)src_pixels[0] * 257; + } + +-static void XRGB8888_to_argb_u16(struct line_buffer *stage_buffer, +- const struct vkms_frame_info *frame_info, int y) ++static void XRGB8888_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel) + { +- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels; +- u8 *src_pixels = get_packed_src_addr(frame_info, y); +- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst), +- stage_buffer->n_pixels); +- +- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) { +- out_pixels[x].a = (u16)0xffff; +- out_pixels[x].r = (u16)src_pixels[2] * 257; +- out_pixels[x].g = (u16)src_pixels[1] * 257; +- out_pixels[x].b = (u16)src_pixels[0] * 257; +- } ++ out_pixel->a = (u16)0xffff; ++ out_pixel->r = (u16)src_pixels[2] * 257; ++ out_pixel->g = (u16)src_pixels[1] * 257; ++ out_pixel->b = (u16)src_pixels[0] * 257; + } + +-static void ARGB16161616_to_argb_u16(struct line_buffer *stage_buffer, +- const struct vkms_frame_info *frame_info, +- int y) ++static void ARGB16161616_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel) + { +- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels; +- u16 *src_pixels = get_packed_src_addr(frame_info, y); +- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst), +- stage_buffer->n_pixels); ++ u16 *pixels = (u16 *)src_pixels; + +- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) { +- out_pixels[x].a = le16_to_cpu(src_pixels[3]); +- out_pixels[x].r = le16_to_cpu(src_pixels[2]); +- out_pixels[x].g = le16_to_cpu(src_pixels[1]); +- out_pixels[x].b = le16_to_cpu(src_pixels[0]); +- } ++ out_pixel->a = le16_to_cpu(pixels[3]); ++ out_pixel->r = le16_to_cpu(pixels[2]); ++ out_pixel->g = le16_to_cpu(pixels[1]); ++ out_pixel->b = le16_to_cpu(pixels[0]); + } + +-static void XRGB16161616_to_argb_u16(struct line_buffer *stage_buffer, +- const struct vkms_frame_info *frame_info, +- int y) ++static void XRGB16161616_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel) + { +- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels; +- u16 *src_pixels = get_packed_src_addr(frame_info, y); +- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst), +- stage_buffer->n_pixels); ++ u16 *pixels = (u16 *)src_pixels; + +- for (size_t x = 0; x < x_limit; x++, src_pixels += 4) { +- out_pixels[x].a = (u16)0xffff; +- out_pixels[x].r = le16_to_cpu(src_pixels[2]); +- out_pixels[x].g = le16_to_cpu(src_pixels[1]); +- out_pixels[x].b = le16_to_cpu(src_pixels[0]); +- } ++ out_pixel->a = (u16)0xffff; ++ out_pixel->r = le16_to_cpu(pixels[2]); ++ out_pixel->g = le16_to_cpu(pixels[1]); ++ out_pixel->b = le16_to_cpu(pixels[0]); + } + +-static void RGB565_to_argb_u16(struct line_buffer *stage_buffer, +- const struct vkms_frame_info *frame_info, int y) ++static void RGB565_to_argb_u16(u8 *src_pixels, struct pixel_argb_u16 *out_pixel) + { +- struct pixel_argb_u16 *out_pixels = stage_buffer->pixels; +- u16 *src_pixels = get_packed_src_addr(frame_info, y); +- int x_limit = min_t(size_t, drm_rect_width(&frame_info->dst), +- stage_buffer->n_pixels); ++ u16 *pixels = (u16 *)src_pixels; + + s64 fp_rb_ratio = drm_fixp_div(drm_int2fixp(65535), drm_int2fixp(31)); + s64 fp_g_ratio = drm_fixp_div(drm_int2fixp(65535), drm_int2fixp(63)); + +- for (size_t x = 0; x < x_limit; x++, src_pixels++) { +- u16 rgb_565 = le16_to_cpu(*src_pixels); +- s64 fp_r = drm_int2fixp((rgb_565 >> 11) & 0x1f); +- s64 fp_g = drm_int2fixp((rgb_565 >> 5) & 0x3f); +- s64 fp_b = drm_int2fixp(rgb_565 & 0x1f); ++ u16 rgb_565 = le16_to_cpu(*pixels); ++ s64 fp_r = drm_int2fixp((rgb_565 >> 11) & 0x1f); ++ s64 fp_g = drm_int2fixp((rgb_565 >> 5) & 0x3f); ++ s64 fp_b = drm_int2fixp(rgb_565 & 0x1f); + +- out_pixels[x].a = (u16)0xffff; +- out_pixels[x].r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio)); +- out_pixels[x].g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio)); +- out_pixels[x].b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio)); +- } ++ out_pixel->a = (u16)0xffff; ++ out_pixel->r = drm_fixp2int(drm_fixp_mul(fp_r, fp_rb_ratio)); ++ out_pixel->g = drm_fixp2int(drm_fixp_mul(fp_g, fp_g_ratio)); ++ out_pixel->b = drm_fixp2int(drm_fixp_mul(fp_b, fp_rb_ratio)); ++} ++ ++void vkms_compose_row(struct line_buffer *stage_buffer, struct vkms_plane_state *plane, int y) ++{ ++ struct pixel_argb_u16 *out_pixels = stage_buffer->pixels; ++ struct vkms_frame_info *frame_info = plane->frame_info; ++ u8 *src_pixels = get_packed_src_addr(frame_info, y); ++ int limit = min_t(size_t, drm_rect_width(&frame_info->dst), stage_buffer->n_pixels); ++ ++ for (size_t x = 0; x < limit; x++, src_pixels += frame_info->cpp) ++ plane->pixel_read(src_pixels, &out_pixels[x]); + } + + /* +@@ -249,7 +224,7 @@ static void argb_u16_to_RGB565(struct vkms_frame_info *frame_info, + } + } + +-void *get_frame_to_line_function(u32 format) ++void *get_pixel_conversion_function(u32 format) + { + switch (format) { + case DRM_FORMAT_ARGB8888: +diff --git a/drivers/gpu/drm/vkms/vkms_formats.h b/drivers/gpu/drm/vkms/vkms_formats.h +index 43b7c19790181..c5b113495d0c0 100644 +--- a/drivers/gpu/drm/vkms/vkms_formats.h ++++ b/drivers/gpu/drm/vkms/vkms_formats.h +@@ -5,7 +5,7 @@ + + #include "vkms_drv.h" + +-void *get_frame_to_line_function(u32 format); ++void *get_pixel_conversion_function(u32 format); + + void *get_line_to_frame_function(u32 format); + +diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c +index c3a845220e10c..80e964589cecb 100644 +--- a/drivers/gpu/drm/vkms/vkms_plane.c ++++ b/drivers/gpu/drm/vkms/vkms_plane.c +@@ -123,7 +123,7 @@ static void vkms_plane_atomic_update(struct drm_plane *plane, + frame_info->offset = fb->offsets[0]; + frame_info->pitch = fb->pitches[0]; + frame_info->cpp = fb->format->cpp[0]; +- vkms_plane_state->plane_read = get_frame_to_line_function(fmt); ++ vkms_plane_state->pixel_read = get_pixel_conversion_function(fmt); + } + + static int vkms_plane_atomic_check(struct drm_plane *plane, +-- +2.39.2 + diff --git a/queue-6.1/drm-vram-helper-fix-function-names-in-vram-helper-do.patch b/queue-6.1/drm-vram-helper-fix-function-names-in-vram-helper-do.patch new file mode 100644 index 00000000000..fe81e423ae8 --- /dev/null +++ b/queue-6.1/drm-vram-helper-fix-function-names-in-vram-helper-do.patch @@ -0,0 +1,56 @@ +From 7a48110d2b549f68b5f4a595080d4f1a5d4d2950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 08:09:16 +0800 +Subject: drm/vram-helper: fix function names in vram helper doc + +From: Luc Ma + +[ Upstream commit b8e392245105b50706f18418054821e71e637288 ] + +Refer to drmm_vram_helper_init() instead of the non-existent +drmm_vram_helper_alloc_mm(). + +Fixes: a5f23a72355d ("drm/vram-helper: Managed vram helpers") +Signed-off-by: Luc Ma +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/64583db2.630a0220.eb75d.8f51@mx.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_gem_vram_helper.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c +index 125160b534bef..928e08e0b5b86 100644 +--- a/drivers/gpu/drm/drm_gem_vram_helper.c ++++ b/drivers/gpu/drm/drm_gem_vram_helper.c +@@ -44,7 +44,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs; + * the frame's scanout buffer or the cursor image. If there's no more space + * left in VRAM, inactive GEM objects can be moved to system memory. + * +- * To initialize the VRAM helper library call drmm_vram_helper_alloc_mm(). ++ * To initialize the VRAM helper library call drmm_vram_helper_init(). + * The function allocates and initializes an instance of &struct drm_vram_mm + * in &struct drm_device.vram_mm . Use &DRM_GEM_VRAM_DRIVER to initialize + * &struct drm_driver and &DRM_VRAM_MM_FILE_OPERATIONS to initialize +@@ -72,7 +72,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs; + * // setup device, vram base and size + * // ... + * +- * ret = drmm_vram_helper_alloc_mm(dev, vram_base, vram_size); ++ * ret = drmm_vram_helper_init(dev, vram_base, vram_size); + * if (ret) + * return ret; + * return 0; +@@ -85,7 +85,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs; + * to userspace. + * + * You don't have to clean up the instance of VRAM MM. +- * drmm_vram_helper_alloc_mm() is a managed interface that installs a ++ * drmm_vram_helper_init() is a managed interface that installs a + * clean-up handler to run during the DRM device's release. + * + * For drawing or scanout operations, rsp. buffer objects have to be pinned +-- +2.39.2 + diff --git a/queue-6.1/efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch b/queue-6.1/efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch new file mode 100644 index 00000000000..4e65b80deb6 --- /dev/null +++ b/queue-6.1/efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch @@ -0,0 +1,63 @@ +From b6b6d6f3b18151f646cdd9fa60f852e623bc8256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 09:33:09 +0200 +Subject: efi/libstub: Disable PCI DMA before grabbing the EFI memory map + +From: Ard Biesheuvel + +[ Upstream commit 2e28a798c3092ea42b968fa16ac835969d124898 ] + +Currently, the EFI stub will disable PCI DMA as the very last thing it +does before calling ExitBootServices(), to avoid interfering with the +firmware's normal operation as much as possible. + +However, the stub will invoke DisconnectController() on all endpoints +downstream of the PCI bridges it disables, and this may affect the +layout of the EFI memory map, making it substantially more likely that +ExitBootServices() will fail the first time around, and that the EFI +memory map needs to be reloaded. + +This, in turn, increases the likelihood that the slack space we +allocated is insufficient (and we can no longer allocate memory via boot +services after having called ExitBootServices() once), causing the +second call to GetMemoryMap (and therefore the boot) to fail. This makes +the PCI DMA disable feature a bit more fragile than it already is, so +let's make it more robust, by allocating the space for the EFI memory +map after disabling PCI DMA. + +Fixes: 4444f8541dad16fe ("efi: Allow disabling PCI busmastering on bridges during boot") +Reported-by: Glenn Washburn +Acked-by: Matthew Garrett +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/efi-stub-helper.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c +index 0c493521b25b8..3d9b2469a0dfd 100644 +--- a/drivers/firmware/efi/libstub/efi-stub-helper.c ++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c +@@ -521,6 +521,9 @@ efi_status_t efi_exit_boot_services(void *handle, void *priv, + struct efi_boot_memmap *map; + efi_status_t status; + ++ if (efi_disable_pci_dma) ++ efi_pci_disable_bridge_busmaster(); ++ + status = efi_get_memory_map(&map, true); + if (status != EFI_SUCCESS) + return status; +@@ -531,9 +534,6 @@ efi_status_t efi_exit_boot_services(void *handle, void *priv, + return status; + } + +- if (efi_disable_pci_dma) +- efi_pci_disable_bridge_busmaster(); +- + status = efi_bs_call(exit_boot_services, handle, map->map_key); + + if (status == EFI_INVALID_PARAMETER) { +-- +2.39.2 + diff --git a/queue-6.1/erofs-avoid-tagged-pointers-to-mark-sync-decompressi.patch b/queue-6.1/erofs-avoid-tagged-pointers-to-mark-sync-decompressi.patch new file mode 100644 index 00000000000..c8206664569 --- /dev/null +++ b/queue-6.1/erofs-avoid-tagged-pointers-to-mark-sync-decompressi.patch @@ -0,0 +1,159 @@ +From 821793918d6550af630b3a9225b26accea0f6497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 17:30:36 +0800 +Subject: erofs: avoid tagged pointers to mark sync decompression + +From: Gao Xiang + +[ Upstream commit cdba55067f2f9fdc7870ffcb6aef912d3468cff8 ] + +We could just use a boolean in z_erofs_decompressqueue for sync +decompression to simplify the code. + +Reviewed-by: Yue Hu +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20230204093040.97967-2-hsiangkao@linux.alibaba.com +Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images") +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 42 ++++++++++++++++-------------------------- + fs/erofs/zdata.h | 2 +- + 2 files changed, 17 insertions(+), 27 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index ccf7c55d477fe..8e80871a8c1d7 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -1157,12 +1157,12 @@ static void z_erofs_decompressqueue_work(struct work_struct *work) + } + + static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, +- bool sync, int bios) ++ int bios) + { + struct erofs_sb_info *const sbi = EROFS_SB(io->sb); + + /* wake up the caller thread for sync decompression */ +- if (sync) { ++ if (io->sync) { + if (!atomic_add_return(bios, &io->pending_bios)) + complete(&io->u.done); + return; +@@ -1294,9 +1294,8 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl, + return page; + } + +-static struct z_erofs_decompressqueue * +-jobqueue_init(struct super_block *sb, +- struct z_erofs_decompressqueue *fgq, bool *fg) ++static struct z_erofs_decompressqueue *jobqueue_init(struct super_block *sb, ++ struct z_erofs_decompressqueue *fgq, bool *fg) + { + struct z_erofs_decompressqueue *q; + +@@ -1313,6 +1312,7 @@ jobqueue_init(struct super_block *sb, + init_completion(&fgq->u.done); + atomic_set(&fgq->pending_bios, 0); + q->eio = false; ++ q->sync = true; + } + q->sb = sb; + q->head = Z_EROFS_PCLUSTER_TAIL_CLOSED; +@@ -1326,20 +1326,6 @@ enum { + NR_JOBQUEUES, + }; + +-static void *jobqueueset_init(struct super_block *sb, +- struct z_erofs_decompressqueue *q[], +- struct z_erofs_decompressqueue *fgq, bool *fg) +-{ +- /* +- * if managed cache is enabled, bypass jobqueue is needed, +- * no need to read from device for all pclusters in this queue. +- */ +- q[JQ_BYPASS] = jobqueue_init(sb, fgq + JQ_BYPASS, NULL); +- q[JQ_SUBMIT] = jobqueue_init(sb, fgq + JQ_SUBMIT, fg); +- +- return tagptr_cast_ptr(tagptr_fold(tagptr1_t, q[JQ_SUBMIT], *fg)); +-} +- + static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl, + z_erofs_next_pcluster_t qtail[], + z_erofs_next_pcluster_t owned_head) +@@ -1361,8 +1347,7 @@ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl, + + static void z_erofs_decompressqueue_endio(struct bio *bio) + { +- tagptr1_t t = tagptr_init(tagptr1_t, bio->bi_private); +- struct z_erofs_decompressqueue *q = tagptr_unfold_ptr(t); ++ struct z_erofs_decompressqueue *q = bio->bi_private; + blk_status_t err = bio->bi_status; + struct bio_vec *bvec; + struct bvec_iter_all iter_all; +@@ -1381,7 +1366,7 @@ static void z_erofs_decompressqueue_endio(struct bio *bio) + } + if (err) + q->eio = true; +- z_erofs_decompress_kickoff(q, tagptr_unfold_tags(t), -1); ++ z_erofs_decompress_kickoff(q, -1); + bio_put(bio); + } + +@@ -1394,7 +1379,6 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, + struct address_space *mc = MNGD_MAPPING(EROFS_SB(sb)); + z_erofs_next_pcluster_t qtail[NR_JOBQUEUES]; + struct z_erofs_decompressqueue *q[NR_JOBQUEUES]; +- void *bi_private; + z_erofs_next_pcluster_t owned_head = f->owned_head; + /* bio is NULL initially, so no need to initialize last_{index,bdev} */ + pgoff_t last_index; +@@ -1404,7 +1388,13 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, + unsigned long pflags; + int memstall = 0; + +- bi_private = jobqueueset_init(sb, q, fgq, force_fg); ++ /* ++ * if managed cache is enabled, bypass jobqueue is needed, ++ * no need to read from device for all pclusters in this queue. ++ */ ++ q[JQ_BYPASS] = jobqueue_init(sb, fgq + JQ_BYPASS, NULL); ++ q[JQ_SUBMIT] = jobqueue_init(sb, fgq + JQ_SUBMIT, force_fg); ++ + qtail[JQ_BYPASS] = &q[JQ_BYPASS]->head; + qtail[JQ_SUBMIT] = &q[JQ_SUBMIT]->head; + +@@ -1473,7 +1463,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, + last_bdev = mdev.m_bdev; + bio->bi_iter.bi_sector = (sector_t)cur << + LOG_SECTORS_PER_BLOCK; +- bio->bi_private = bi_private; ++ bio->bi_private = q[JQ_SUBMIT]; + if (f->readahead) + bio->bi_opf |= REQ_RAHEAD; + ++nr_bios; +@@ -1506,7 +1496,7 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, + kvfree(q[JQ_SUBMIT]); + return; + } +- z_erofs_decompress_kickoff(q[JQ_SUBMIT], *force_fg, nr_bios); ++ z_erofs_decompress_kickoff(q[JQ_SUBMIT], nr_bios); + } + + static void z_erofs_runqueue(struct z_erofs_decompress_frontend *f, +diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h +index d98c952129852..b139de5473a97 100644 +--- a/fs/erofs/zdata.h ++++ b/fs/erofs/zdata.h +@@ -110,7 +110,7 @@ struct z_erofs_decompressqueue { + struct work_struct work; + } u; + +- bool eio; ++ bool eio, sync; + }; + + static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl) +-- +2.39.2 + diff --git a/queue-6.1/erofs-clean-up-cached-i-o-strategies.patch b/queue-6.1/erofs-clean-up-cached-i-o-strategies.patch new file mode 100644 index 00000000000..6049c4df3e6 --- /dev/null +++ b/queue-6.1/erofs-clean-up-cached-i-o-strategies.patch @@ -0,0 +1,163 @@ +From d0c27c28c096f5e74d0ad9104715d80278e0d413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 14:03:52 +0800 +Subject: erofs: clean up cached I/O strategies + +From: Gao Xiang + +[ Upstream commit 1282dea37b09087b8aec59f0774572c16b52276a ] + +After commit 4c7e42552b3a ("erofs: remove useless cache strategy of +DELAYEDALLOC"), only one cached I/O allocation strategy is supported: + + When cached I/O is preferred, page allocation is applied without + direct reclaim. If allocation fails, fall back to inplace I/O. + +Let's get rid of z_erofs_cache_alloctype. No logical changes. + +Reviewed-by: Yue Hu +Reviewed-by: Chao Yu +Signed-off-by: Yue Hu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20221206060352.152830-1-xiang@kernel.org +Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images") +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 77 +++++++++++++++++++----------------------------- + 1 file changed, 31 insertions(+), 46 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index cf4871834ebb2..ccf7c55d477fe 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -175,16 +175,6 @@ static void z_erofs_free_pcluster(struct z_erofs_pcluster *pcl) + DBG_BUGON(1); + } + +-/* how to allocate cached pages for a pcluster */ +-enum z_erofs_cache_alloctype { +- DONTALLOC, /* don't allocate any cached pages */ +- /* +- * try to use cached I/O if page allocation succeeds or fallback +- * to in-place I/O instead to avoid any direct reclaim. +- */ +- TRYALLOC, +-}; +- + /* + * tagged pointer with 1-bit tag for all compressed pages + * tag 0 - the page is just found with an extra page reference +@@ -292,12 +282,29 @@ struct z_erofs_decompress_frontend { + .inode = __i, .owned_head = Z_EROFS_PCLUSTER_TAIL, \ + .mode = Z_EROFS_PCLUSTER_FOLLOWED, .backmost = true } + ++static bool z_erofs_should_alloc_cache(struct z_erofs_decompress_frontend *fe) ++{ ++ unsigned int cachestrategy = EROFS_I_SB(fe->inode)->opt.cache_strategy; ++ ++ if (cachestrategy <= EROFS_ZIP_CACHE_DISABLED) ++ return false; ++ ++ if (fe->backmost) ++ return true; ++ ++ if (cachestrategy >= EROFS_ZIP_CACHE_READAROUND && ++ fe->map.m_la < fe->headoffset) ++ return true; ++ ++ return false; ++} ++ + static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe, +- enum z_erofs_cache_alloctype type, + struct page **pagepool) + { + struct address_space *mc = MNGD_MAPPING(EROFS_I_SB(fe->inode)); + struct z_erofs_pcluster *pcl = fe->pcl; ++ bool shouldalloc = z_erofs_should_alloc_cache(fe); + bool standalone = true; + /* + * optimistic allocation without direct reclaim since inplace I/O +@@ -326,18 +333,19 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe, + } else { + /* I/O is needed, no possible to decompress directly */ + standalone = false; +- switch (type) { +- case TRYALLOC: +- newpage = erofs_allocpage(pagepool, gfp); +- if (!newpage) +- continue; +- set_page_private(newpage, +- Z_EROFS_PREALLOCATED_PAGE); +- t = tag_compressed_page_justfound(newpage); +- break; +- default: /* DONTALLOC */ ++ if (!shouldalloc) + continue; +- } ++ ++ /* ++ * try to use cached I/O if page allocation ++ * succeeds or fallback to in-place I/O instead ++ * to avoid any direct reclaim. ++ */ ++ newpage = erofs_allocpage(pagepool, gfp); ++ if (!newpage) ++ continue; ++ set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE); ++ t = tag_compressed_page_justfound(newpage); + } + + if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL, +@@ -638,20 +646,6 @@ static bool z_erofs_collector_end(struct z_erofs_decompress_frontend *fe) + return true; + } + +-static bool should_alloc_managed_pages(struct z_erofs_decompress_frontend *fe, +- unsigned int cachestrategy, +- erofs_off_t la) +-{ +- if (cachestrategy <= EROFS_ZIP_CACHE_DISABLED) +- return false; +- +- if (fe->backmost) +- return true; +- +- return cachestrategy >= EROFS_ZIP_CACHE_READAROUND && +- la < fe->headoffset; +-} +- + static int z_erofs_read_fragment(struct inode *inode, erofs_off_t pos, + struct page *page, unsigned int pageofs, + unsigned int len) +@@ -688,12 +682,9 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe, + struct page *page, struct page **pagepool) + { + struct inode *const inode = fe->inode; +- struct erofs_sb_info *const sbi = EROFS_I_SB(inode); + struct erofs_map_blocks *const map = &fe->map; + const loff_t offset = page_offset(page); + bool tight = true, exclusive; +- +- enum z_erofs_cache_alloctype cache_strategy; + unsigned int cur, end, spiltted; + int err = 0; + +@@ -747,13 +738,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe, + fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE; + } else { + /* bind cache first when cached decompression is preferred */ +- if (should_alloc_managed_pages(fe, sbi->opt.cache_strategy, +- map->m_la)) +- cache_strategy = TRYALLOC; +- else +- cache_strategy = DONTALLOC; +- +- z_erofs_bind_cache(fe, cache_strategy, pagepool); ++ z_erofs_bind_cache(fe, pagepool); + } + hitted: + /* +-- +2.39.2 + diff --git a/queue-6.1/erofs-fix-compact-4b-support-for-16k-block-size.patch b/queue-6.1/erofs-fix-compact-4b-support-for-16k-block-size.patch new file mode 100644 index 00000000000..e9d847173e7 --- /dev/null +++ b/queue-6.1/erofs-fix-compact-4b-support-for-16k-block-size.patch @@ -0,0 +1,71 @@ +From 988d480ce3a8a66cdc55cdc16575b645908da47f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 19:23:41 +0800 +Subject: erofs: fix compact 4B support for 16k block size + +From: Gao Xiang + +[ Upstream commit 001b8ccd0650727e54ec16ef72bf1b8eeab7168e ] + +In compact 4B, two adjacent lclusters are packed together as a unit to +form on-disk indexes for effective random access, as below: + +(amortized = 4, vcnt = 2) + _____________________________________________ + |___@_____ encoded bits __________|_ blkaddr _| + 0 . amortized * vcnt = 8 + . . + . . amortized * vcnt - 4 = 4 + . . + .____________________________. + |_type (2 bits)_|_clusterofs_| + +Therefore, encoded bits for each pack are 32 bits (4 bytes). IOWs, +since each lcluster can get 16 bits for its type and clusterofs, the +maximum supported lclustersize for compact 4B format is 16k (14 bits). + +Fix this to enable compact 4B format for 16k lclusters (blocks), which +is tested on an arm64 server with 16k page size. + +Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20230601112341.56960-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zmap.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index 3961bb55dea11..0337b70b2dac4 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -271,7 +271,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, + u8 *in, type; + bool big_pcluster; + +- if (1 << amortizedshift == 4) ++ if (1 << amortizedshift == 4 && lclusterbits <= 14) + vcnt = 2; + else if (1 << amortizedshift == 2 && lclusterbits == 12) + vcnt = 16; +@@ -373,7 +373,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m, + { + struct inode *const inode = m->inode; + struct erofs_inode *const vi = EROFS_I(inode); +- const unsigned int lclusterbits = vi->z_logical_clusterbits; + const erofs_off_t ebase = sizeof(struct z_erofs_map_header) + + ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8); + const unsigned int totalidx = DIV_ROUND_UP(inode->i_size, EROFS_BLKSIZ); +@@ -381,9 +380,6 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m, + unsigned int amortizedshift; + erofs_off_t pos; + +- if (lclusterbits != 12) +- return -EOPNOTSUPP; +- + if (lcn >= totalidx) + return -EINVAL; + +-- +2.39.2 + diff --git a/queue-6.1/erofs-kill-hooked-chains-to-avoid-loops-on-deduplica.patch b/queue-6.1/erofs-kill-hooked-chains-to-avoid-loops-on-deduplica.patch new file mode 100644 index 00000000000..eb6bfdacc00 --- /dev/null +++ b/queue-6.1/erofs-kill-hooked-chains-to-avoid-loops-on-deduplica.patch @@ -0,0 +1,224 @@ +From 65be02cbe7b8d708be369a3fab927ce58a69387f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 04:14:56 +0800 +Subject: erofs: kill hooked chains to avoid loops on deduplicated compressed + images + +From: Gao Xiang + +[ Upstream commit 967c28b23f6c89bb8eef6a046ea88afe0d7c1029 ] + +After heavily stressing EROFS with several images which include a +hand-crafted image of repeated patterns for more than 46 days, I found +two chains could be linked with each other almost simultaneously and +form a loop so that the entire loop won't be submitted. As a +consequence, the corresponding file pages will remain locked forever. + +It can be _only_ observed on data-deduplicated compressed images. +For example, consider two chains with five pclusters in total: + Chain 1: 2->3->4->5 -- The tail pcluster is 5; + Chain 2: 5->1->2 -- The tail pcluster is 2. + +Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link +to Chain 2 at the same time with pcluster 2. + +Since hooked chains are all linked locklessly now, I have no idea how +to simply avoid the race. Instead, let's avoid hooked chains completely +until I could work out a proper way to fix this and end users finally +tell us that it's needed to add it back. + +Actually, this optimization can be found with multi-threaded workloads +(especially even more often on deduplicated compressed images), yet I'm +not sure about the overall system impacts of not having this compared +with implementation complexity. + +Fixes: 267f2492c8f7 ("erofs: introduce multi-reference pclusters (fully-referenced)") +Signed-off-by: Gao Xiang +Reviewed-by: Yue Hu +Link: https://lore.kernel.org/r/20230526201459.128169-4-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 72 ++++++++---------------------------------------- + 1 file changed, 11 insertions(+), 61 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index aaddb6781465e..92b2e4ddb7ce9 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -94,11 +94,8 @@ struct z_erofs_pcluster { + + /* let's avoid the valid 32-bit kernel addresses */ + +-/* the chained workgroup has't submitted io (still open) */ ++/* the end of a chain of pclusters */ + #define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE) +-/* the chained workgroup has already submitted io */ +-#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD) +- + #define Z_EROFS_PCLUSTER_NIL (NULL) + + struct z_erofs_decompressqueue { +@@ -375,20 +372,6 @@ int __init z_erofs_init_zip_subsystem(void) + + enum z_erofs_pclustermode { + Z_EROFS_PCLUSTER_INFLIGHT, +- /* +- * The current pclusters was the tail of an exist chain, in addition +- * that the previous processed chained pclusters are all decided to +- * be hooked up to it. +- * A new chain will be created for the remaining pclusters which are +- * not processed yet, so different from Z_EROFS_PCLUSTER_FOLLOWED, +- * the next pcluster cannot reuse the whole page safely for inplace I/O +- * in the following scenario: +- * ________________________________________________________________ +- * | tail (partial) page | head (partial) page | +- * | (belongs to the next pcl) | (belongs to the current pcl) | +- * |_______PCLUSTER_FOLLOWED______|________PCLUSTER_HOOKED__________| +- */ +- Z_EROFS_PCLUSTER_HOOKED, + /* + * a weak form of Z_EROFS_PCLUSTER_FOLLOWED, the difference is that it + * could be dispatched into bypass queue later due to uptodated managed +@@ -406,8 +389,8 @@ enum z_erofs_pclustermode { + * ________________________________________________________________ + * | tail (partial) page | head (partial) page | + * | (of the current cl) | (of the previous collection) | +- * | PCLUSTER_FOLLOWED or | | +- * |_____PCLUSTER_HOOKED__|___________PCLUSTER_FOLLOWED____________| ++ * | | | ++ * |__PCLUSTER_FOLLOWED___|___________PCLUSTER_FOLLOWED____________| + * + * [ (*) the above page can be used as inplace I/O. ] + */ +@@ -420,7 +403,7 @@ struct z_erofs_decompress_frontend { + struct z_erofs_bvec_iter biter; + + struct page *candidate_bvpage; +- struct z_erofs_pcluster *pcl, *tailpcl; ++ struct z_erofs_pcluster *pcl; + z_erofs_next_pcluster_t owned_head; + enum z_erofs_pclustermode mode; + +@@ -626,19 +609,7 @@ static void z_erofs_try_to_claim_pcluster(struct z_erofs_decompress_frontend *f) + return; + } + +- /* +- * type 2, link to the end of an existing open chain, be careful +- * that its submission is controlled by the original attached chain. +- */ +- if (*owned_head != &pcl->next && pcl != f->tailpcl && +- cmpxchg(&pcl->next, Z_EROFS_PCLUSTER_TAIL, +- *owned_head) == Z_EROFS_PCLUSTER_TAIL) { +- *owned_head = Z_EROFS_PCLUSTER_TAIL; +- f->mode = Z_EROFS_PCLUSTER_HOOKED; +- f->tailpcl = NULL; +- return; +- } +- /* type 3, it belongs to a chain, but it isn't the end of the chain */ ++ /* type 2, it belongs to an ongoing chain */ + f->mode = Z_EROFS_PCLUSTER_INFLIGHT; + } + +@@ -699,9 +670,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe) + goto err_out; + } + } +- /* used to check tail merging loop due to corrupted images */ +- if (fe->owned_head == Z_EROFS_PCLUSTER_TAIL) +- fe->tailpcl = pcl; + fe->owned_head = &pcl->next; + fe->pcl = pcl; + return 0; +@@ -722,7 +690,6 @@ static int z_erofs_collector_begin(struct z_erofs_decompress_frontend *fe) + + /* must be Z_EROFS_PCLUSTER_TAIL or pointed to previous pcluster */ + DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_NIL); +- DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED); + + if (!(map->m_flags & EROFS_MAP_META)) { + grp = erofs_find_workgroup(fe->inode->i_sb, +@@ -741,10 +708,6 @@ static int z_erofs_collector_begin(struct z_erofs_decompress_frontend *fe) + + if (ret == -EEXIST) { + mutex_lock(&fe->pcl->lock); +- /* used to check tail merging loop due to corrupted images */ +- if (fe->owned_head == Z_EROFS_PCLUSTER_TAIL) +- fe->tailpcl = fe->pcl; +- + z_erofs_try_to_claim_pcluster(fe); + } else if (ret) { + return ret; +@@ -901,8 +864,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe, + * those chains are handled asynchronously thus the page cannot be used + * for inplace I/O or bvpage (should be processed in a strict order.) + */ +- tight &= (fe->mode >= Z_EROFS_PCLUSTER_HOOKED && +- fe->mode != Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE); ++ tight &= (fe->mode > Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE); + + cur = end - min_t(unsigned int, offset + end - map->m_la, end); + if (!(map->m_flags & EROFS_MAP_MAPPED)) { +@@ -1283,10 +1245,7 @@ static void z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io, + }; + z_erofs_next_pcluster_t owned = io->head; + +- while (owned != Z_EROFS_PCLUSTER_TAIL_CLOSED) { +- /* impossible that 'owned' equals Z_EROFS_WORK_TPTR_TAIL */ +- DBG_BUGON(owned == Z_EROFS_PCLUSTER_TAIL); +- /* impossible that 'owned' equals Z_EROFS_PCLUSTER_NIL */ ++ while (owned != Z_EROFS_PCLUSTER_TAIL) { + DBG_BUGON(owned == Z_EROFS_PCLUSTER_NIL); + + be.pcl = container_of(owned, struct z_erofs_pcluster, next); +@@ -1303,7 +1262,7 @@ static void z_erofs_decompressqueue_work(struct work_struct *work) + container_of(work, struct z_erofs_decompressqueue, u.work); + struct page *pagepool = NULL; + +- DBG_BUGON(bgq->head == Z_EROFS_PCLUSTER_TAIL_CLOSED); ++ DBG_BUGON(bgq->head == Z_EROFS_PCLUSTER_TAIL); + z_erofs_decompress_queue(bgq, &pagepool); + + erofs_release_pages(&pagepool); +@@ -1465,7 +1424,7 @@ static struct z_erofs_decompressqueue *jobqueue_init(struct super_block *sb, + q->sync = true; + } + q->sb = sb; +- q->head = Z_EROFS_PCLUSTER_TAIL_CLOSED; ++ q->head = Z_EROFS_PCLUSTER_TAIL; + return q; + } + +@@ -1483,11 +1442,7 @@ static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl, + z_erofs_next_pcluster_t *const submit_qtail = qtail[JQ_SUBMIT]; + z_erofs_next_pcluster_t *const bypass_qtail = qtail[JQ_BYPASS]; + +- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED); +- if (owned_head == Z_EROFS_PCLUSTER_TAIL) +- owned_head = Z_EROFS_PCLUSTER_TAIL_CLOSED; +- +- WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL_CLOSED); ++ WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL); + + WRITE_ONCE(*submit_qtail, owned_head); + WRITE_ONCE(*bypass_qtail, &pcl->next); +@@ -1558,15 +1513,10 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f, + unsigned int i = 0; + bool bypass = true; + +- /* no possible 'owned_head' equals the following */ +- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_TAIL_CLOSED); + DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_NIL); +- + pcl = container_of(owned_head, struct z_erofs_pcluster, next); ++ owned_head = READ_ONCE(pcl->next); + +- /* close the main owned chain at first */ +- owned_head = cmpxchg(&pcl->next, Z_EROFS_PCLUSTER_TAIL, +- Z_EROFS_PCLUSTER_TAIL_CLOSED); + if (z_erofs_is_inline_pcluster(pcl)) { + move_to_bypass_jobqueue(pcl, qtail, owned_head); + continue; +-- +2.39.2 + diff --git a/queue-6.1/erofs-move-zdata.h-into-zdata.c.patch b/queue-6.1/erofs-move-zdata.h-into-zdata.c.patch new file mode 100644 index 00000000000..31a763ccde2 --- /dev/null +++ b/queue-6.1/erofs-move-zdata.h-into-zdata.c.patch @@ -0,0 +1,393 @@ +From f6c6ea0f4a19af78f6496d7e30cf800a0cb80019 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 17:30:38 +0800 +Subject: erofs: move zdata.h into zdata.c + +From: Gao Xiang + +[ Upstream commit a9a94d9373349e1a53f149d2015eb6f03a8517cf ] + +Definitions in zdata.h are only used in zdata.c and for internal +use only. No logic changes. + +Reviewed-by: Yue Hu +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20230204093040.97967-4-hsiangkao@linux.alibaba.com +Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images") +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 166 +++++++++++++++++++++++++++++++++++++++++++- + fs/erofs/zdata.h | 177 ----------------------------------------------- + 2 files changed, 165 insertions(+), 178 deletions(-) + delete mode 100644 fs/erofs/zdata.h + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 3b5f73224c22a..aaddb6781465e 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -4,13 +4,177 @@ + * https://www.huawei.com/ + * Copyright (C) 2022 Alibaba Cloud + */ +-#include "zdata.h" + #include "compress.h" + #include + #include + + #include + ++#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE) ++#define Z_EROFS_INLINE_BVECS 2 ++ ++/* ++ * let's leave a type here in case of introducing ++ * another tagged pointer later. ++ */ ++typedef void *z_erofs_next_pcluster_t; ++ ++struct z_erofs_bvec { ++ struct page *page; ++ int offset; ++ unsigned int end; ++}; ++ ++#define __Z_EROFS_BVSET(name, total) \ ++struct name { \ ++ /* point to the next page which contains the following bvecs */ \ ++ struct page *nextpage; \ ++ struct z_erofs_bvec bvec[total]; \ ++} ++__Z_EROFS_BVSET(z_erofs_bvset,); ++__Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS); ++ ++/* ++ * Structure fields follow one of the following exclusion rules. ++ * ++ * I: Modifiable by initialization/destruction paths and read-only ++ * for everyone else; ++ * ++ * L: Field should be protected by the pcluster lock; ++ * ++ * A: Field should be accessed / updated in atomic for parallelized code. ++ */ ++struct z_erofs_pcluster { ++ struct erofs_workgroup obj; ++ struct mutex lock; ++ ++ /* A: point to next chained pcluster or TAILs */ ++ z_erofs_next_pcluster_t next; ++ ++ /* L: the maximum decompression size of this round */ ++ unsigned int length; ++ ++ /* L: total number of bvecs */ ++ unsigned int vcnt; ++ ++ /* I: page offset of start position of decompression */ ++ unsigned short pageofs_out; ++ ++ /* I: page offset of inline compressed data */ ++ unsigned short pageofs_in; ++ ++ union { ++ /* L: inline a certain number of bvec for bootstrap */ ++ struct z_erofs_bvset_inline bvset; ++ ++ /* I: can be used to free the pcluster by RCU. */ ++ struct rcu_head rcu; ++ }; ++ ++ union { ++ /* I: physical cluster size in pages */ ++ unsigned short pclusterpages; ++ ++ /* I: tailpacking inline compressed size */ ++ unsigned short tailpacking_size; ++ }; ++ ++ /* I: compression algorithm format */ ++ unsigned char algorithmformat; ++ ++ /* L: whether partial decompression or not */ ++ bool partial; ++ ++ /* L: indicate several pageofs_outs or not */ ++ bool multibases; ++ ++ /* A: compressed bvecs (can be cached or inplaced pages) */ ++ struct z_erofs_bvec compressed_bvecs[]; ++}; ++ ++/* let's avoid the valid 32-bit kernel addresses */ ++ ++/* the chained workgroup has't submitted io (still open) */ ++#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE) ++/* the chained workgroup has already submitted io */ ++#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD) ++ ++#define Z_EROFS_PCLUSTER_NIL (NULL) ++ ++struct z_erofs_decompressqueue { ++ struct super_block *sb; ++ atomic_t pending_bios; ++ z_erofs_next_pcluster_t head; ++ ++ union { ++ struct completion done; ++ struct work_struct work; ++ } u; ++ bool eio, sync; ++}; ++ ++static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl) ++{ ++ return !pcl->obj.index; ++} ++ ++static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl) ++{ ++ if (z_erofs_is_inline_pcluster(pcl)) ++ return 1; ++ return pcl->pclusterpages; ++} ++ ++/* ++ * bit 30: I/O error occurred on this page ++ * bit 0 - 29: remaining parts to complete this page ++ */ ++#define Z_EROFS_PAGE_EIO (1 << 30) ++ ++static inline void z_erofs_onlinepage_init(struct page *page) ++{ ++ union { ++ atomic_t o; ++ unsigned long v; ++ } u = { .o = ATOMIC_INIT(1) }; ++ ++ set_page_private(page, u.v); ++ smp_wmb(); ++ SetPagePrivate(page); ++} ++ ++static inline void z_erofs_onlinepage_split(struct page *page) ++{ ++ atomic_inc((atomic_t *)&page->private); ++} ++ ++static inline void z_erofs_page_mark_eio(struct page *page) ++{ ++ int orig; ++ ++ do { ++ orig = atomic_read((atomic_t *)&page->private); ++ } while (atomic_cmpxchg((atomic_t *)&page->private, orig, ++ orig | Z_EROFS_PAGE_EIO) != orig); ++} ++ ++static inline void z_erofs_onlinepage_endio(struct page *page) ++{ ++ unsigned int v; ++ ++ DBG_BUGON(!PagePrivate(page)); ++ v = atomic_dec_return((atomic_t *)&page->private); ++ if (!(v & ~Z_EROFS_PAGE_EIO)) { ++ set_page_private(page, 0); ++ ClearPagePrivate(page); ++ if (!(v & Z_EROFS_PAGE_EIO)) ++ SetPageUptodate(page); ++ unlock_page(page); ++ } ++} ++ ++#define Z_EROFS_ONSTACK_PAGES 32 ++ + /* + * since pclustersize is variable for big pcluster feature, introduce slab + * pools implementation for different pcluster sizes. +diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h +deleted file mode 100644 +index f196a729c7e85..0000000000000 +--- a/fs/erofs/zdata.h ++++ /dev/null +@@ -1,177 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0-only */ +-/* +- * Copyright (C) 2018 HUAWEI, Inc. +- * https://www.huawei.com/ +- */ +-#ifndef __EROFS_FS_ZDATA_H +-#define __EROFS_FS_ZDATA_H +- +-#include "internal.h" +- +-#define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE) +-#define Z_EROFS_INLINE_BVECS 2 +- +-/* +- * let's leave a type here in case of introducing +- * another tagged pointer later. +- */ +-typedef void *z_erofs_next_pcluster_t; +- +-struct z_erofs_bvec { +- struct page *page; +- int offset; +- unsigned int end; +-}; +- +-#define __Z_EROFS_BVSET(name, total) \ +-struct name { \ +- /* point to the next page which contains the following bvecs */ \ +- struct page *nextpage; \ +- struct z_erofs_bvec bvec[total]; \ +-} +-__Z_EROFS_BVSET(z_erofs_bvset,); +-__Z_EROFS_BVSET(z_erofs_bvset_inline, Z_EROFS_INLINE_BVECS); +- +-/* +- * Structure fields follow one of the following exclusion rules. +- * +- * I: Modifiable by initialization/destruction paths and read-only +- * for everyone else; +- * +- * L: Field should be protected by the pcluster lock; +- * +- * A: Field should be accessed / updated in atomic for parallelized code. +- */ +-struct z_erofs_pcluster { +- struct erofs_workgroup obj; +- struct mutex lock; +- +- /* A: point to next chained pcluster or TAILs */ +- z_erofs_next_pcluster_t next; +- +- /* L: the maximum decompression size of this round */ +- unsigned int length; +- +- /* L: total number of bvecs */ +- unsigned int vcnt; +- +- /* I: page offset of start position of decompression */ +- unsigned short pageofs_out; +- +- /* I: page offset of inline compressed data */ +- unsigned short pageofs_in; +- +- union { +- /* L: inline a certain number of bvec for bootstrap */ +- struct z_erofs_bvset_inline bvset; +- +- /* I: can be used to free the pcluster by RCU. */ +- struct rcu_head rcu; +- }; +- +- union { +- /* I: physical cluster size in pages */ +- unsigned short pclusterpages; +- +- /* I: tailpacking inline compressed size */ +- unsigned short tailpacking_size; +- }; +- +- /* I: compression algorithm format */ +- unsigned char algorithmformat; +- +- /* L: whether partial decompression or not */ +- bool partial; +- +- /* L: indicate several pageofs_outs or not */ +- bool multibases; +- +- /* A: compressed bvecs (can be cached or inplaced pages) */ +- struct z_erofs_bvec compressed_bvecs[]; +-}; +- +-/* let's avoid the valid 32-bit kernel addresses */ +- +-/* the chained workgroup has't submitted io (still open) */ +-#define Z_EROFS_PCLUSTER_TAIL ((void *)0x5F0ECAFE) +-/* the chained workgroup has already submitted io */ +-#define Z_EROFS_PCLUSTER_TAIL_CLOSED ((void *)0x5F0EDEAD) +- +-#define Z_EROFS_PCLUSTER_NIL (NULL) +- +-struct z_erofs_decompressqueue { +- struct super_block *sb; +- atomic_t pending_bios; +- z_erofs_next_pcluster_t head; +- +- union { +- struct completion done; +- struct work_struct work; +- } u; +- +- bool eio, sync; +-}; +- +-static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl) +-{ +- return !pcl->obj.index; +-} +- +-static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl) +-{ +- if (z_erofs_is_inline_pcluster(pcl)) +- return 1; +- return pcl->pclusterpages; +-} +- +-/* +- * bit 30: I/O error occurred on this page +- * bit 0 - 29: remaining parts to complete this page +- */ +-#define Z_EROFS_PAGE_EIO (1 << 30) +- +-static inline void z_erofs_onlinepage_init(struct page *page) +-{ +- union { +- atomic_t o; +- unsigned long v; +- } u = { .o = ATOMIC_INIT(1) }; +- +- set_page_private(page, u.v); +- smp_wmb(); +- SetPagePrivate(page); +-} +- +-static inline void z_erofs_onlinepage_split(struct page *page) +-{ +- atomic_inc((atomic_t *)&page->private); +-} +- +-static inline void z_erofs_page_mark_eio(struct page *page) +-{ +- int orig; +- +- do { +- orig = atomic_read((atomic_t *)&page->private); +- } while (atomic_cmpxchg((atomic_t *)&page->private, orig, +- orig | Z_EROFS_PAGE_EIO) != orig); +-} +- +-static inline void z_erofs_onlinepage_endio(struct page *page) +-{ +- unsigned int v; +- +- DBG_BUGON(!PagePrivate(page)); +- v = atomic_dec_return((atomic_t *)&page->private); +- if (!(v & ~Z_EROFS_PAGE_EIO)) { +- set_page_private(page, 0); +- ClearPagePrivate(page); +- if (!(v & Z_EROFS_PAGE_EIO)) +- SetPageUptodate(page); +- unlock_page(page); +- } +-} +- +-#define Z_EROFS_ONSTACK_PAGES 32 +- +-#endif +-- +2.39.2 + diff --git a/queue-6.1/erofs-remove-tagged-pointer-helpers.patch b/queue-6.1/erofs-remove-tagged-pointer-helpers.patch new file mode 100644 index 00000000000..c4141d3c93c --- /dev/null +++ b/queue-6.1/erofs-remove-tagged-pointer-helpers.patch @@ -0,0 +1,226 @@ +From cbcbd9bd74e8bc4cbe620a506939f34dd8604609 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 17:30:37 +0800 +Subject: erofs: remove tagged pointer helpers + +From: Gao Xiang + +[ Upstream commit b1ed220c6262bff63cdcb53692e492be0b05206c ] + +Just open-code the remaining one to simplify the code. + +Reviewed-by: Yue Hu +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20230204093040.97967-3-hsiangkao@linux.alibaba.com +Stable-dep-of: 967c28b23f6c ("erofs: kill hooked chains to avoid loops on deduplicated compressed images") +Signed-off-by: Sasha Levin +--- + fs/erofs/tagptr.h | 107 ---------------------------------------------- + fs/erofs/zdata.c | 26 +++-------- + fs/erofs/zdata.h | 1 - + 3 files changed, 6 insertions(+), 128 deletions(-) + delete mode 100644 fs/erofs/tagptr.h + +diff --git a/fs/erofs/tagptr.h b/fs/erofs/tagptr.h +deleted file mode 100644 +index 64ceb7270b5c1..0000000000000 +--- a/fs/erofs/tagptr.h ++++ /dev/null +@@ -1,107 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0-only */ +-/* +- * A tagged pointer implementation +- */ +-#ifndef __EROFS_FS_TAGPTR_H +-#define __EROFS_FS_TAGPTR_H +- +-#include +-#include +- +-/* +- * the name of tagged pointer types are tagptr{1, 2, 3...}_t +- * avoid directly using the internal structs __tagptr{1, 2, 3...} +- */ +-#define __MAKE_TAGPTR(n) \ +-typedef struct __tagptr##n { \ +- uintptr_t v; \ +-} tagptr##n##_t; +- +-__MAKE_TAGPTR(1) +-__MAKE_TAGPTR(2) +-__MAKE_TAGPTR(3) +-__MAKE_TAGPTR(4) +- +-#undef __MAKE_TAGPTR +- +-extern void __compiletime_error("bad tagptr tags") +- __bad_tagptr_tags(void); +- +-extern void __compiletime_error("bad tagptr type") +- __bad_tagptr_type(void); +- +-/* fix the broken usage of "#define tagptr2_t tagptr3_t" by users */ +-#define __tagptr_mask_1(ptr, n) \ +- __builtin_types_compatible_p(typeof(ptr), struct __tagptr##n) ? \ +- (1UL << (n)) - 1 : +- +-#define __tagptr_mask(ptr) (\ +- __tagptr_mask_1(ptr, 1) ( \ +- __tagptr_mask_1(ptr, 2) ( \ +- __tagptr_mask_1(ptr, 3) ( \ +- __tagptr_mask_1(ptr, 4) ( \ +- __bad_tagptr_type(), 0))))) +- +-/* generate a tagged pointer from a raw value */ +-#define tagptr_init(type, val) \ +- ((typeof(type)){ .v = (uintptr_t)(val) }) +- +-/* +- * directly cast a tagged pointer to the native pointer type, which +- * could be used for backward compatibility of existing code. +- */ +-#define tagptr_cast_ptr(tptr) ((void *)(tptr).v) +- +-/* encode tagged pointers */ +-#define tagptr_fold(type, ptr, _tags) ({ \ +- const typeof(_tags) tags = (_tags); \ +- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(type))) \ +- __bad_tagptr_tags(); \ +-tagptr_init(type, (uintptr_t)(ptr) | tags); }) +- +-/* decode tagged pointers */ +-#define tagptr_unfold_ptr(tptr) \ +- ((void *)((tptr).v & ~__tagptr_mask(tptr))) +- +-#define tagptr_unfold_tags(tptr) \ +- ((tptr).v & __tagptr_mask(tptr)) +- +-/* operations for the tagger pointer */ +-#define tagptr_eq(_tptr1, _tptr2) ({ \ +- typeof(_tptr1) tptr1 = (_tptr1); \ +- typeof(_tptr2) tptr2 = (_tptr2); \ +- (void)(&tptr1 == &tptr2); \ +-(tptr1).v == (tptr2).v; }) +- +-/* lock-free CAS operation */ +-#define tagptr_cmpxchg(_ptptr, _o, _n) ({ \ +- typeof(_ptptr) ptptr = (_ptptr); \ +- typeof(_o) o = (_o); \ +- typeof(_n) n = (_n); \ +- (void)(&o == &n); \ +- (void)(&o == ptptr); \ +-tagptr_init(o, cmpxchg(&ptptr->v, o.v, n.v)); }) +- +-/* wrap WRITE_ONCE if atomic update is needed */ +-#define tagptr_replace_tags(_ptptr, tags) ({ \ +- typeof(_ptptr) ptptr = (_ptptr); \ +- *ptptr = tagptr_fold(*ptptr, tagptr_unfold_ptr(*ptptr), tags); \ +-*ptptr; }) +- +-#define tagptr_set_tags(_ptptr, _tags) ({ \ +- typeof(_ptptr) ptptr = (_ptptr); \ +- const typeof(_tags) tags = (_tags); \ +- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(*ptptr))) \ +- __bad_tagptr_tags(); \ +- ptptr->v |= tags; \ +-*ptptr; }) +- +-#define tagptr_clear_tags(_ptptr, _tags) ({ \ +- typeof(_ptptr) ptptr = (_ptptr); \ +- const typeof(_tags) tags = (_tags); \ +- if (__builtin_constant_p(tags) && (tags & ~__tagptr_mask(*ptptr))) \ +- __bad_tagptr_tags(); \ +- ptptr->v &= ~tags; \ +-*ptptr; }) +- +-#endif /* __EROFS_FS_TAGPTR_H */ +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 8e80871a8c1d7..3b5f73224c22a 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -175,15 +175,6 @@ static void z_erofs_free_pcluster(struct z_erofs_pcluster *pcl) + DBG_BUGON(1); + } + +-/* +- * tagged pointer with 1-bit tag for all compressed pages +- * tag 0 - the page is just found with an extra page reference +- */ +-typedef tagptr1_t compressed_page_t; +- +-#define tag_compressed_page_justfound(page) \ +- tagptr_fold(compressed_page_t, page, 1) +- + static struct workqueue_struct *z_erofs_workqueue __read_mostly; + + void z_erofs_exit_zip_subsystem(void) +@@ -319,7 +310,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe, + + for (i = 0; i < pcl->pclusterpages; ++i) { + struct page *page; +- compressed_page_t t; ++ void *t; /* mark pages just found for debugging */ + struct page *newpage = NULL; + + /* the compressed page was loaded before */ +@@ -329,7 +320,7 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe, + page = find_get_page(mc, pcl->obj.index + i); + + if (page) { +- t = tag_compressed_page_justfound(page); ++ t = (void *)((unsigned long)page | 1); + } else { + /* I/O is needed, no possible to decompress directly */ + standalone = false; +@@ -345,11 +336,10 @@ static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe, + if (!newpage) + continue; + set_page_private(newpage, Z_EROFS_PREALLOCATED_PAGE); +- t = tag_compressed_page_justfound(newpage); ++ t = (void *)((unsigned long)newpage | 1); + } + +- if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL, +- tagptr_cast_ptr(t))) ++ if (!cmpxchg_relaxed(&pcl->compressed_bvecs[i].page, NULL, t)) + continue; + + if (page) +@@ -1192,8 +1182,6 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl, + + struct address_space *mapping; + struct page *oldpage, *page; +- +- compressed_page_t t; + int justfound; + + repeat: +@@ -1203,10 +1191,8 @@ static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl, + if (!page) + goto out_allocpage; + +- /* process the target tagged pointer */ +- t = tagptr_init(compressed_page_t, page); +- justfound = tagptr_unfold_tags(t); +- page = tagptr_unfold_ptr(t); ++ justfound = (unsigned long)page & 1UL; ++ page = (struct page *)((unsigned long)page & ~1UL); + + /* + * preallocated cached pages, which is used to avoid direct reclaim +diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h +index b139de5473a97..f196a729c7e85 100644 +--- a/fs/erofs/zdata.h ++++ b/fs/erofs/zdata.h +@@ -7,7 +7,6 @@ + #define __EROFS_FS_ZDATA_H + + #include "internal.h" +-#include "tagptr.h" + + #define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE) + #define Z_EROFS_INLINE_BVECS 2 +-- +2.39.2 + diff --git a/queue-6.1/erofs-simplify-iloc.patch b/queue-6.1/erofs-simplify-iloc.patch new file mode 100644 index 00000000000..2ddbe5a3b06 --- /dev/null +++ b/queue-6.1/erofs-simplify-iloc.patch @@ -0,0 +1,225 @@ +From 15cff145ef696d82abccbc506d9db06b3c0f8504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 23:08:23 +0800 +Subject: erofs: simplify iloc() + +From: Gao Xiang + +[ Upstream commit b780d3fc6107464dcc43631a6208c43b6421f1e6 ] + +Actually we could pass in inodes directly to clean up all callers. +Also rename iloc() as erofs_iloc(). + +Link: https://lore.kernel.org/r/20230114150823.432069-1-xiang@kernel.org +Reviewed-by: Yue Hu +Reviewed-by: Jingbo Xu +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Stable-dep-of: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") +Signed-off-by: Sasha Levin +--- + fs/erofs/data.c | 9 +++------ + fs/erofs/inode.c | 2 +- + fs/erofs/internal.h | 16 +++++++++------- + fs/erofs/xattr.c | 20 +++++++------------- + fs/erofs/zmap.c | 13 +++++-------- + include/trace/events/erofs.h | 4 ++-- + 6 files changed, 27 insertions(+), 37 deletions(-) + +diff --git a/fs/erofs/data.c b/fs/erofs/data.c +index fe8ac0e163f7e..b32801d716f89 100644 +--- a/fs/erofs/data.c ++++ b/fs/erofs/data.c +@@ -95,11 +95,8 @@ static int erofs_map_blocks_flatmode(struct inode *inode, + map->m_pa = blknr_to_addr(vi->raw_blkaddr) + map->m_la; + map->m_plen = blknr_to_addr(lastblk) - offset; + } else if (tailendpacking) { +- /* 2 - inode inline B: inode, [xattrs], inline last blk... */ +- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb); +- +- map->m_pa = iloc(sbi, vi->nid) + vi->inode_isize + +- vi->xattr_isize + erofs_blkoff(map->m_la); ++ map->m_pa = erofs_iloc(inode) + vi->inode_isize + ++ vi->xattr_isize + erofs_blkoff(offset); + map->m_plen = inode->i_size - offset; + + /* inline data should be located in the same meta block */ +@@ -154,7 +151,7 @@ int erofs_map_blocks(struct inode *inode, + unit = EROFS_BLOCK_MAP_ENTRY_SIZE; /* block map */ + + chunknr = map->m_la >> vi->chunkbits; +- pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize + ++ pos = ALIGN(erofs_iloc(inode) + vi->inode_isize + + vi->xattr_isize, unit) + unit * chunknr; + + kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP); +diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c +index ad2a82f2eb4cd..5aadc73d57652 100644 +--- a/fs/erofs/inode.c ++++ b/fs/erofs/inode.c +@@ -14,7 +14,7 @@ static void *erofs_read_inode(struct erofs_buf *buf, + struct super_block *sb = inode->i_sb; + struct erofs_sb_info *sbi = EROFS_SB(sb); + struct erofs_inode *vi = EROFS_I(inode); +- const erofs_off_t inode_loc = iloc(sbi, vi->nid); ++ const erofs_off_t inode_loc = erofs_iloc(inode); + + erofs_blk_t blkaddr, nblks = 0; + void *kaddr; +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index 340bd56a57559..d8d09fc3ed655 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -273,11 +273,6 @@ struct erofs_buf { + #define erofs_blkoff(addr) ((addr) % EROFS_BLKSIZ) + #define blknr_to_addr(nr) ((erofs_off_t)(nr) * EROFS_BLKSIZ) + +-static inline erofs_off_t iloc(struct erofs_sb_info *sbi, erofs_nid_t nid) +-{ +- return blknr_to_addr(sbi->meta_blkaddr) + (nid << sbi->islotbits); +-} +- + #define EROFS_FEATURE_FUNCS(name, compat, feature) \ + static inline bool erofs_sb_has_##name(struct erofs_sb_info *sbi) \ + { \ +@@ -342,8 +337,15 @@ struct erofs_inode { + struct inode vfs_inode; + }; + +-#define EROFS_I(ptr) \ +- container_of(ptr, struct erofs_inode, vfs_inode) ++#define EROFS_I(ptr) container_of(ptr, struct erofs_inode, vfs_inode) ++ ++static inline erofs_off_t erofs_iloc(struct inode *inode) ++{ ++ struct erofs_sb_info *sbi = EROFS_I_SB(inode); ++ ++ return blknr_to_addr(sbi->meta_blkaddr) + ++ (EROFS_I(inode)->nid << sbi->islotbits); ++} + + static inline unsigned long erofs_inode_datablocks(struct inode *inode) + { +diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c +index 8106bcb5a38d1..a2776abf36986 100644 +--- a/fs/erofs/xattr.c ++++ b/fs/erofs/xattr.c +@@ -22,8 +22,7 @@ static int init_inode_xattrs(struct inode *inode) + struct xattr_iter it; + unsigned int i; + struct erofs_xattr_ibody_header *ih; +- struct super_block *sb; +- struct erofs_sb_info *sbi; ++ struct super_block *sb = inode->i_sb; + int ret = 0; + + /* the most case is that xattrs of this inode are initialized. */ +@@ -52,15 +51,14 @@ static int init_inode_xattrs(struct inode *inode) + * undefined right now (maybe use later with some new sb feature). + */ + if (vi->xattr_isize == sizeof(struct erofs_xattr_ibody_header)) { +- erofs_err(inode->i_sb, ++ erofs_err(sb, + "xattr_isize %d of nid %llu is not supported yet", + vi->xattr_isize, vi->nid); + ret = -EOPNOTSUPP; + goto out_unlock; + } else if (vi->xattr_isize < sizeof(struct erofs_xattr_ibody_header)) { + if (vi->xattr_isize) { +- erofs_err(inode->i_sb, +- "bogus xattr ibody @ nid %llu", vi->nid); ++ erofs_err(sb, "bogus xattr ibody @ nid %llu", vi->nid); + DBG_BUGON(1); + ret = -EFSCORRUPTED; + goto out_unlock; /* xattr ondisk layout error */ +@@ -69,11 +67,9 @@ static int init_inode_xattrs(struct inode *inode) + goto out_unlock; + } + +- sb = inode->i_sb; +- sbi = EROFS_SB(sb); + it.buf = __EROFS_BUF_INITIALIZER; +- it.blkaddr = erofs_blknr(iloc(sbi, vi->nid) + vi->inode_isize); +- it.ofs = erofs_blkoff(iloc(sbi, vi->nid) + vi->inode_isize); ++ it.blkaddr = erofs_blknr(erofs_iloc(inode) + vi->inode_isize); ++ it.ofs = erofs_blkoff(erofs_iloc(inode) + vi->inode_isize); + + /* read in shared xattr array (non-atomic, see kmalloc below) */ + it.kaddr = erofs_read_metabuf(&it.buf, sb, it.blkaddr, EROFS_KMAP); +@@ -159,7 +155,6 @@ static int inline_xattr_iter_begin(struct xattr_iter *it, + struct inode *inode) + { + struct erofs_inode *const vi = EROFS_I(inode); +- struct erofs_sb_info *const sbi = EROFS_SB(inode->i_sb); + unsigned int xattr_header_sz, inline_xattr_ofs; + + xattr_header_sz = inlinexattr_header_size(inode); +@@ -170,9 +165,8 @@ static int inline_xattr_iter_begin(struct xattr_iter *it, + + inline_xattr_ofs = vi->inode_isize + xattr_header_sz; + +- it->blkaddr = erofs_blknr(iloc(sbi, vi->nid) + inline_xattr_ofs); +- it->ofs = erofs_blkoff(iloc(sbi, vi->nid) + inline_xattr_ofs); +- ++ it->blkaddr = erofs_blknr(erofs_iloc(inode) + inline_xattr_ofs); ++ it->ofs = erofs_blkoff(erofs_iloc(inode) + inline_xattr_ofs); + it->kaddr = erofs_read_metabuf(&it->buf, inode->i_sb, it->blkaddr, + EROFS_KMAP_ATOMIC); + if (IS_ERR(it->kaddr)) +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index bb91cc6499725..3961bb55dea11 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -55,8 +55,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) + if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) + goto out_unlock; + +- pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize + +- vi->xattr_isize, 8); ++ pos = ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8); + kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP); + if (IS_ERR(kaddr)) { + err = PTR_ERR(kaddr); +@@ -169,10 +168,9 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, + { + struct inode *const inode = m->inode; + struct erofs_inode *const vi = EROFS_I(inode); +- const erofs_off_t ibase = iloc(EROFS_I_SB(inode), vi->nid); + const erofs_off_t pos = +- Z_EROFS_VLE_LEGACY_INDEX_ALIGN(ibase + vi->inode_isize + +- vi->xattr_isize) + ++ Z_EROFS_VLE_LEGACY_INDEX_ALIGN(erofs_iloc(inode) + ++ vi->inode_isize + vi->xattr_isize) + + lcn * sizeof(struct z_erofs_vle_decompressed_index); + struct z_erofs_vle_decompressed_index *di; + unsigned int advise, type; +@@ -376,9 +374,8 @@ static int compacted_load_cluster_from_disk(struct z_erofs_maprecorder *m, + struct inode *const inode = m->inode; + struct erofs_inode *const vi = EROFS_I(inode); + const unsigned int lclusterbits = vi->z_logical_clusterbits; +- const erofs_off_t ebase = ALIGN(iloc(EROFS_I_SB(inode), vi->nid) + +- vi->inode_isize + vi->xattr_isize, 8) + +- sizeof(struct z_erofs_map_header); ++ const erofs_off_t ebase = sizeof(struct z_erofs_map_header) + ++ ALIGN(erofs_iloc(inode) + vi->inode_isize + vi->xattr_isize, 8); + const unsigned int totalidx = DIV_ROUND_UP(inode->i_size, EROFS_BLKSIZ); + unsigned int compacted_4b_initial, compacted_2b; + unsigned int amortizedshift; +diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h +index 4f4c44ea3a655..e095d36db9391 100644 +--- a/include/trace/events/erofs.h ++++ b/include/trace/events/erofs.h +@@ -66,8 +66,8 @@ TRACE_EVENT(erofs_fill_inode, + TP_fast_assign( + __entry->dev = inode->i_sb->s_dev; + __entry->nid = EROFS_I(inode)->nid; +- __entry->blkaddr = erofs_blknr(iloc(EROFS_I_SB(inode), __entry->nid)); +- __entry->ofs = erofs_blkoff(iloc(EROFS_I_SB(inode), __entry->nid)); ++ __entry->blkaddr = erofs_blknr(erofs_iloc(inode)); ++ __entry->ofs = erofs_blkoff(erofs_iloc(inode)); + ), + + TP_printk("dev = (%d,%d), nid = %llu, blkaddr %u ofs %u", +-- +2.39.2 + diff --git a/queue-6.1/evm-complete-description-of-evm_inode_setattr.patch b/queue-6.1/evm-complete-description-of-evm_inode_setattr.patch new file mode 100644 index 00000000000..32909f2eecf --- /dev/null +++ b/queue-6.1/evm-complete-description-of-evm_inode_setattr.patch @@ -0,0 +1,39 @@ +From 5b0711f28750d10df7f5d422d639ad21e5dee74d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:40:36 +0100 +Subject: evm: Complete description of evm_inode_setattr() + +From: Roberto Sassu + +[ Upstream commit b1de86d4248b273cb12c4cd7d20c08d459519f7d ] + +Add the description for missing parameters of evm_inode_setattr() to +avoid the warning arising with W=n compile option. + +Fixes: 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm") # v3.2+ +Fixes: c1632a0f1120 ("fs: port ->setattr() to pass mnt_idmap") # v6.3+ +Signed-off-by: Roberto Sassu +Reviewed-by: Stefan Berger +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 23d484e05e6f2..f1a26d50c1d58 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -776,7 +776,9 @@ static int evm_attr_change(struct user_namespace *mnt_userns, + + /** + * evm_inode_setattr - prevent updating an invalid EVM extended attribute ++ * @idmap: idmap of the mount + * @dentry: pointer to the affected dentry ++ * @attr: iattr structure containing the new file attributes + * + * Permit update of file attributes when files have a valid EVM signature, + * except in the case of them having an immutable portable signature. +-- +2.39.2 + diff --git a/queue-6.1/evm-fix-build-warnings.patch b/queue-6.1/evm-fix-build-warnings.patch new file mode 100644 index 00000000000..b29cc87f5e3 --- /dev/null +++ b/queue-6.1/evm-fix-build-warnings.patch @@ -0,0 +1,59 @@ +From 9248a64eaa453bbb2a9c4aafacff28cdaf87c8bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:41:12 +0200 +Subject: evm: Fix build warnings + +From: Roberto Sassu + +[ Upstream commit 996e0a97ebd7b11cb785794e2a83c20c1add9d92 ] + +Fix build warnings (function parameters description) for +evm_read_protected_xattrs(), evm_set_key() and evm_verifyxattr(). + +Fixes: 7626676320f3 ("evm: provide a function to set the EVM key from the kernel") # v4.5+ +Fixes: 8314b6732ae4 ("ima: Define new template fields xattrnames, xattrlengths and xattrvalues") # v5.14+ +Fixes: 2960e6cb5f7c ("evm: additional parameter to pass integrity cache entry 'iint'") # v3.2+ +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_crypto.c | 2 +- + security/integrity/evm/evm_main.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index 708de9656bbd2..b9395f8ef5829 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -40,7 +40,7 @@ static const char evm_hmac[] = "hmac(sha1)"; + /** + * evm_set_key() - set EVM HMAC key from the kernel + * @key: pointer to a buffer with the key data +- * @size: length of the key data ++ * @keylen: length of the key data + * + * This function allows setting the EVM HMAC key from the kernel + * without using the "encrypted" key subsystem keys. It can be used +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index f1a26d50c1d58..a338f19447d03 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -318,7 +318,6 @@ int evm_protected_xattr_if_enabled(const char *req_xattr_name) + /** + * evm_read_protected_xattrs - read EVM protected xattr names, lengths, values + * @dentry: dentry of the read xattrs +- * @inode: inode of the read xattrs + * @buffer: buffer xattr names, lengths or values are copied to + * @buffer_size: size of buffer + * @type: n: names, l: lengths, v: values +@@ -390,6 +389,7 @@ int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer, + * @xattr_name: requested xattr + * @xattr_value: requested xattr value + * @xattr_value_len: requested xattr value length ++ * @iint: inode integrity metadata + * + * Calculate the HMAC for the given dentry and verify it against the stored + * security.evm xattr. For performance, use the xattr value and length +-- +2.39.2 + diff --git a/queue-6.1/fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch b/queue-6.1/fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch new file mode 100644 index 00000000000..b0b5bcc134a --- /dev/null +++ b/queue-6.1/fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch @@ -0,0 +1,44 @@ +From 85a8462a97218c583bf1638a94c105fc5e8746ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:42:28 +0200 +Subject: fbdev: omapfb: lcd_mipid: Fix an error handling path in + mipid_spi_probe() + +From: Christophe JAILLET + +[ Upstream commit 79a3908d1ea6c35157a6d907b1a9d8ec06015e7a ] + +If 'mipid_detect()' fails, we must free 'md' to avoid a memory leak. + +Fixes: 66d2f99d0bb5 ("omapfb: add support for MIPI-DCS compatible LCDs") +Signed-off-by: Christophe JAILLET +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap/lcd_mipid.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c +index 03cff39d392db..cc1079aad61f2 100644 +--- a/drivers/video/fbdev/omap/lcd_mipid.c ++++ b/drivers/video/fbdev/omap/lcd_mipid.c +@@ -563,11 +563,15 @@ static int mipid_spi_probe(struct spi_device *spi) + + r = mipid_detect(md); + if (r < 0) +- return r; ++ goto free_md; + + omapfb_register_panel(&md->panel); + + return 0; ++ ++free_md: ++ kfree(md); ++ return r; + } + + static void mipid_spi_remove(struct spi_device *spi) +-- +2.39.2 + diff --git a/queue-6.1/fs-pipe-reveal-missing-function-protoypes.patch b/queue-6.1/fs-pipe-reveal-missing-function-protoypes.patch new file mode 100644 index 00000000000..8a0315bdd94 --- /dev/null +++ b/queue-6.1/fs-pipe-reveal-missing-function-protoypes.patch @@ -0,0 +1,56 @@ +From 046bd8d228d42157403647e4182a6e9a7da0e38f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 21:56:12 +0200 +Subject: fs: pipe: reveal missing function protoypes + +From: Arnd Bergmann + +[ Upstream commit 247c8d2f9837a3e29e3b6b7a4aa9c36c37659dd4 ] + +A couple of functions from fs/pipe.c are used both internally +and for the watch queue code, but the declaration is only +visible when the latter is enabled: + +fs/pipe.c:1254:5: error: no previous prototype for 'pipe_resize_ring' +fs/pipe.c:758:15: error: no previous prototype for 'account_pipe_buffers' +fs/pipe.c:764:6: error: no previous prototype for 'too_many_pipe_buffers_soft' +fs/pipe.c:771:6: error: no previous prototype for 'too_many_pipe_buffers_hard' +fs/pipe.c:777:6: error: no previous prototype for 'pipe_is_unprivileged_user' + +Make the visible unconditionally to avoid these warnings. + +Fixes: c73be61cede5 ("pipe: Add general notification queue support") +Signed-off-by: Arnd Bergmann +Message-Id: <20230516195629.551602-1-arnd@kernel.org> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/linux/pipe_fs_i.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 6cb65df3e3ba5..28b3c6a673975 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -241,18 +241,14 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *); + + extern const struct pipe_buf_operations nosteal_pipe_buf_ops; + +-#ifdef CONFIG_WATCH_QUEUE + unsigned long account_pipe_buffers(struct user_struct *user, + unsigned long old, unsigned long new); + bool too_many_pipe_buffers_soft(unsigned long user_bufs); + bool too_many_pipe_buffers_hard(unsigned long user_bufs); + bool pipe_is_unprivileged_user(void); +-#endif + + /* for F_SETPIPE_SZ and F_GETPIPE_SZ */ +-#ifdef CONFIG_WATCH_QUEUE + int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots); +-#endif + long pipe_fcntl(struct file *, unsigned int, unsigned long arg); + struct pipe_inode_info *get_pipe_info(struct file *file, bool for_splice); + +-- +2.39.2 + diff --git a/queue-6.1/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch b/queue-6.1/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch new file mode 100644 index 00000000000..b07461ebbd5 --- /dev/null +++ b/queue-6.1/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch @@ -0,0 +1,190 @@ +From d750ec91f35481030ea3fb31111f3fdd5f02936c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 14:32:31 -0700 +Subject: gtp: Fix use-after-free in __gtp_encap_destroy(). + +From: Kuniyuki Iwashima + +[ Upstream commit ce3aee7114c575fab32a5e9e939d4bbb3dcca79f ] + +syzkaller reported use-after-free in __gtp_encap_destroy(). [0] + +It shows the same process freed sk and touched it illegally. + +Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() +and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, +but release_sock() is called after sock_put() releases the last refcnt. + +[0]: +BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] +BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] +BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] +BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline] +BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] +BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 +Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401 + +CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:351 [inline] + print_report+0xcc/0x620 mm/kasan/report.c:462 + kasan_report+0xb2/0xe0 mm/kasan/report.c:572 + check_region_inline mm/kasan/generic.c:181 [inline] + kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187 + instrument_atomic_read_write include/linux/instrumented.h:96 [inline] + atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] + queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] + do_raw_spin_lock include/linux/spinlock.h:186 [inline] + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] + _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:355 [inline] + release_sock+0x1f/0x1a0 net/core/sock.c:3526 + gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] + gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 + gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 + unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 + rtnl_delete_link net/core/rtnetlink.c:3216 [inline] + rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 + rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 + netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b7/0x200 net/socket.c:747 + ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 + ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 + __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7f1168b1fe5d +Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 +RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d +RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 +RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000 + + +Allocated by task 1483: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + __kasan_slab_alloc+0x59/0x70 mm/kasan/common.c:328 + kasan_slab_alloc include/linux/kasan.h:186 [inline] + slab_post_alloc_hook mm/slab.h:711 [inline] + slab_alloc_node mm/slub.c:3451 [inline] + slab_alloc mm/slub.c:3459 [inline] + __kmem_cache_alloc_lru mm/slub.c:3466 [inline] + kmem_cache_alloc+0x16d/0x340 mm/slub.c:3475 + sk_prot_alloc+0x5f/0x280 net/core/sock.c:2073 + sk_alloc+0x34/0x6c0 net/core/sock.c:2132 + inet6_create net/ipv6/af_inet6.c:192 [inline] + inet6_create+0x2c7/0xf20 net/ipv6/af_inet6.c:119 + __sock_create+0x2a1/0x530 net/socket.c:1535 + sock_create net/socket.c:1586 [inline] + __sys_socket_create net/socket.c:1623 [inline] + __sys_socket_create net/socket.c:1608 [inline] + __sys_socket+0x137/0x250 net/socket.c:1651 + __do_sys_socket net/socket.c:1664 [inline] + __se_sys_socket net/socket.c:1662 [inline] + __x64_sys_socket+0x72/0xb0 net/socket.c:1662 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Freed by task 2401: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + ____kasan_slab_free mm/kasan/common.c:200 [inline] + __kasan_slab_free+0x10c/0x1b0 mm/kasan/common.c:244 + kasan_slab_free include/linux/kasan.h:162 [inline] + slab_free_hook mm/slub.c:1781 [inline] + slab_free_freelist_hook mm/slub.c:1807 [inline] + slab_free mm/slub.c:3786 [inline] + kmem_cache_free+0xb4/0x490 mm/slub.c:3808 + sk_prot_free net/core/sock.c:2113 [inline] + __sk_destruct+0x500/0x720 net/core/sock.c:2207 + sk_destruct+0xc1/0xe0 net/core/sock.c:2222 + __sk_free+0xed/0x3d0 net/core/sock.c:2233 + sk_free+0x7c/0xa0 net/core/sock.c:2244 + sock_put include/net/sock.h:1981 [inline] + __gtp_encap_destroy+0x165/0x1b0 drivers/net/gtp.c:634 + gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] + gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 + gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 + unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 + rtnl_delete_link net/core/rtnetlink.c:3216 [inline] + rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 + rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 + netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b7/0x200 net/socket.c:747 + ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 + ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 + __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The buggy address belongs to the object at ffff88800dbef300 + which belongs to the cache UDPv6 of size 1344 +The buggy address is located 152 bytes inside of + freed 1344-byte region [ffff88800dbef300, ffff88800dbef840) + +The buggy address belongs to the physical page: +page:00000000d31bfed5 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800dbeed40 pfn:0xdbe8 +head:00000000d31bfed5 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +memcg:ffff888008ee0801 +flags: 0x100000000010200(slab|head|node=0|zone=1) +page_type: 0xffffffff() +raw: 0100000000010200 ffff88800c7a3000 dead000000000122 0000000000000000 +raw: ffff88800dbeed40 0000000080160015 00000001ffffffff ffff888008ee0801 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff88800dbef280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88800dbef300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff88800dbef380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff88800dbef400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff88800dbef480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +Fixes: e198987e7dd7 ("gtp: fix suspicious RCU usage") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Pablo Neira Ayuso +Link: https://lore.kernel.org/r/20230622213231.24651-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 15c7dc82107f4..acb20ad4e37eb 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -631,7 +631,9 @@ static void __gtp_encap_destroy(struct sock *sk) + gtp->sk1u = NULL; + udp_sk(sk)->encap_type = 0; + rcu_assign_sk_user_data(sk, NULL); ++ release_sock(sk); + sock_put(sk); ++ return; + } + release_sock(sk); + } +-- +2.39.2 + diff --git a/queue-6.1/hid-input-map-battery-system-charging.patch b/queue-6.1/hid-input-map-battery-system-charging.patch new file mode 100644 index 00000000000..23fdd64cd58 --- /dev/null +++ b/queue-6.1/hid-input-map-battery-system-charging.patch @@ -0,0 +1,254 @@ +From ef78edbbe21652c9e5e7af60a419c9ee18ef1c1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 18:59:37 +0100 +Subject: HID: input: map battery system charging +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit a608dc1c06397dc50ab773498433432fb5938f92 ] + +HID descriptors with Battery System (0x85) Charging (0x44) usage are +ignored and POWER_SUPPLY_STATUS_DISCHARGING is always reported to user +space, even when the device is charging. + +Map this usage and when it is reported set the right charging status. + +In addition, add KUnit tests to make sure that the charging status is +correctly set and reported. They can be run with the usual command: + + $ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/hid + +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Stable-dep-of: 49904a0ebf23 ("HID: uclogic: Modular KUnit tests should not depend on KUNIT=y") +Signed-off-by: Sasha Levin +--- + drivers/hid/.kunitconfig | 1 + + drivers/hid/Kconfig | 1 + + drivers/hid/hid-input-test.c | 80 ++++++++++++++++++++++++++++++++++++ + drivers/hid/hid-input.c | 36 +++++++++++++++- + include/linux/hid.h | 2 + + 5 files changed, 118 insertions(+), 2 deletions(-) + create mode 100644 drivers/hid/hid-input-test.c + +diff --git a/drivers/hid/.kunitconfig b/drivers/hid/.kunitconfig +index 04daeff5c970e..675a8209c7aeb 100644 +--- a/drivers/hid/.kunitconfig ++++ b/drivers/hid/.kunitconfig +@@ -1,5 +1,6 @@ + CONFIG_KUNIT=y + CONFIG_USB=y + CONFIG_USB_HID=y ++CONFIG_HID_BATTERY_STRENGTH=y + CONFIG_HID_UCLOGIC=y + CONFIG_HID_KUNIT_TEST=y +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 185a077d59cdd..644b4913d4d85 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -1263,6 +1263,7 @@ config HID_MCP2221 + config HID_KUNIT_TEST + tristate "KUnit tests for HID" if !KUNIT_ALL_TESTS + depends on KUNIT=y ++ depends on HID_BATTERY_STRENGTH + depends on HID_UCLOGIC + default KUNIT_ALL_TESTS + help +diff --git a/drivers/hid/hid-input-test.c b/drivers/hid/hid-input-test.c +new file mode 100644 +index 0000000000000..77c2d45ac62a7 +--- /dev/null ++++ b/drivers/hid/hid-input-test.c +@@ -0,0 +1,80 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++/* ++ * HID to Linux Input mapping ++ * ++ * Copyright (c) 2022 José Expósito ++ */ ++ ++#include ++ ++static void hid_test_input_set_battery_charge_status(struct kunit *test) ++{ ++ struct hid_device *dev; ++ bool handled; ++ ++ dev = kunit_kzalloc(test, sizeof(*dev), GFP_KERNEL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev); ++ ++ handled = hidinput_set_battery_charge_status(dev, HID_DG_HEIGHT, 0); ++ KUNIT_EXPECT_FALSE(test, handled); ++ KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_UNKNOWN); ++ ++ handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 0); ++ KUNIT_EXPECT_TRUE(test, handled); ++ KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_DISCHARGING); ++ ++ handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 1); ++ KUNIT_EXPECT_TRUE(test, handled); ++ KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_CHARGING); ++} ++ ++static void hid_test_input_get_battery_property(struct kunit *test) ++{ ++ struct power_supply *psy; ++ struct hid_device *dev; ++ union power_supply_propval val; ++ int ret; ++ ++ dev = kunit_kzalloc(test, sizeof(*dev), GFP_KERNEL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev); ++ dev->battery_avoid_query = true; ++ ++ psy = kunit_kzalloc(test, sizeof(*psy), GFP_KERNEL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, psy); ++ psy->drv_data = dev; ++ ++ dev->battery_status = HID_BATTERY_UNKNOWN; ++ dev->battery_charge_status = POWER_SUPPLY_STATUS_CHARGING; ++ ret = hidinput_get_battery_property(psy, POWER_SUPPLY_PROP_STATUS, &val); ++ KUNIT_EXPECT_EQ(test, ret, 0); ++ KUNIT_EXPECT_EQ(test, val.intval, POWER_SUPPLY_STATUS_UNKNOWN); ++ ++ dev->battery_status = HID_BATTERY_REPORTED; ++ dev->battery_charge_status = POWER_SUPPLY_STATUS_CHARGING; ++ ret = hidinput_get_battery_property(psy, POWER_SUPPLY_PROP_STATUS, &val); ++ KUNIT_EXPECT_EQ(test, ret, 0); ++ KUNIT_EXPECT_EQ(test, val.intval, POWER_SUPPLY_STATUS_CHARGING); ++ ++ dev->battery_status = HID_BATTERY_REPORTED; ++ dev->battery_charge_status = POWER_SUPPLY_STATUS_DISCHARGING; ++ ret = hidinput_get_battery_property(psy, POWER_SUPPLY_PROP_STATUS, &val); ++ KUNIT_EXPECT_EQ(test, ret, 0); ++ KUNIT_EXPECT_EQ(test, val.intval, POWER_SUPPLY_STATUS_DISCHARGING); ++} ++ ++static struct kunit_case hid_input_tests[] = { ++ KUNIT_CASE(hid_test_input_set_battery_charge_status), ++ KUNIT_CASE(hid_test_input_get_battery_property), ++ { } ++}; ++ ++static struct kunit_suite hid_input_test_suite = { ++ .name = "hid_input", ++ .test_cases = hid_input_tests, ++}; ++ ++kunit_test_suite(hid_input_test_suite); ++ ++MODULE_DESCRIPTION("HID input KUnit tests"); ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("José Expósito "); +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 3acaaca888acd..6e836b179bdf8 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -492,7 +492,7 @@ static int hidinput_get_battery_property(struct power_supply *psy, + if (dev->battery_status == HID_BATTERY_UNKNOWN) + val->intval = POWER_SUPPLY_STATUS_UNKNOWN; + else +- val->intval = POWER_SUPPLY_STATUS_DISCHARGING; ++ val->intval = dev->battery_charge_status; + break; + + case POWER_SUPPLY_PROP_SCOPE: +@@ -560,6 +560,7 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type, + dev->battery_max = max; + dev->battery_report_type = report_type; + dev->battery_report_id = field->report->id; ++ dev->battery_charge_status = POWER_SUPPLY_STATUS_DISCHARGING; + + /* + * Stylus is normally not connected to the device and thus we +@@ -626,6 +627,20 @@ static void hidinput_update_battery(struct hid_device *dev, int value) + power_supply_changed(dev->battery); + } + } ++ ++static bool hidinput_set_battery_charge_status(struct hid_device *dev, ++ unsigned int usage, int value) ++{ ++ switch (usage) { ++ case HID_BAT_CHARGING: ++ dev->battery_charge_status = value ? ++ POWER_SUPPLY_STATUS_CHARGING : ++ POWER_SUPPLY_STATUS_DISCHARGING; ++ return true; ++ } ++ ++ return false; ++} + #else /* !CONFIG_HID_BATTERY_STRENGTH */ + static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type, + struct hid_field *field, bool is_percentage) +@@ -640,6 +655,12 @@ static void hidinput_cleanup_battery(struct hid_device *dev) + static void hidinput_update_battery(struct hid_device *dev, int value) + { + } ++ ++static bool hidinput_set_battery_charge_status(struct hid_device *dev, ++ unsigned int usage, int value) ++{ ++ return false; ++} + #endif /* CONFIG_HID_BATTERY_STRENGTH */ + + static bool hidinput_field_in_collection(struct hid_device *device, struct hid_field *field, +@@ -1234,6 +1255,9 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + hidinput_setup_battery(device, HID_INPUT_REPORT, field, true); + usage->type = EV_PWR; + return; ++ case HID_BAT_CHARGING: ++ usage->type = EV_PWR; ++ return; + } + goto unknown; + +@@ -1476,7 +1500,11 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct + return; + + if (usage->type == EV_PWR) { +- hidinput_update_battery(hid, value); ++ bool handled = hidinput_set_battery_charge_status(hid, usage->hid, value); ++ ++ if (!handled) ++ hidinput_update_battery(hid, value); ++ + return; + } + +@@ -2332,3 +2360,7 @@ void hidinput_disconnect(struct hid_device *hid) + cancel_work_sync(&hid->led_work); + } + EXPORT_SYMBOL_GPL(hidinput_disconnect); ++ ++#ifdef CONFIG_HID_KUNIT_TEST ++#include "hid-input-test.c" ++#endif +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 0a1ccc68e798a..70245a7695286 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -312,6 +312,7 @@ struct hid_item { + #define HID_DG_LATENCYMODE 0x000d0060 + + #define HID_BAT_ABSOLUTESTATEOFCHARGE 0x00850065 ++#define HID_BAT_CHARGING 0x00850044 + + #define HID_VD_ASUS_CUSTOM_MEDIA_KEYS 0xff310076 + +@@ -611,6 +612,7 @@ struct hid_device { /* device report descriptor */ + __s32 battery_max; + __s32 battery_report_type; + __s32 battery_report_id; ++ __s32 battery_charge_status; + enum hid_battery_status battery_status; + bool battery_avoid_query; + ktime_t battery_ratelimit_time; +-- +2.39.2 + diff --git a/queue-6.1/hid-uclogic-modular-kunit-tests-should-not-depend-on.patch b/queue-6.1/hid-uclogic-modular-kunit-tests-should-not-depend-on.patch new file mode 100644 index 00000000000..1df6d050487 --- /dev/null +++ b/queue-6.1/hid-uclogic-modular-kunit-tests-should-not-depend-on.patch @@ -0,0 +1,44 @@ +From 868aafea6283b4c7dcae8e500297eefacb44e5ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 17:10:59 +0200 +Subject: HID: uclogic: Modular KUnit tests should not depend on KUNIT=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 49904a0ebf23b15aad288a10f5354e7cd8193121 ] + +While KUnit tests that cannot be built as a loadable module must depend +on "KUNIT=y", this is not true for modular tests, where it adds an +unnecessary limitation. + +Fix this by relaxing the dependency to "KUNIT". + +Fixes: 08809e482a1c44d9 ("HID: uclogic: KUnit best practices and naming conventions") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: David Gow +Reviewed-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 644b4913d4d85..9ad5e43d9961b 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -1262,7 +1262,7 @@ config HID_MCP2221 + + config HID_KUNIT_TEST + tristate "KUnit tests for HID" if !KUNIT_ALL_TESTS +- depends on KUNIT=y ++ depends on KUNIT + depends on HID_BATTERY_STRENGTH + depends on HID_UCLOGIC + default KUNIT_ALL_TESTS +-- +2.39.2 + diff --git a/queue-6.1/hwmon-f71882fg-prevent-possible-division-by-zero.patch b/queue-6.1/hwmon-f71882fg-prevent-possible-division-by-zero.patch new file mode 100644 index 00000000000..2f5640195a5 --- /dev/null +++ b/queue-6.1/hwmon-f71882fg-prevent-possible-division-by-zero.patch @@ -0,0 +1,51 @@ +From 5374ac061410d2e613a46d6fadc1ea8ab875afcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 07:35:37 -0700 +Subject: hwmon: (f71882fg) prevent possible division by zero + +From: Nikita Zhandarovich + +[ Upstream commit 0babf89c9cca7e074d6e59893e462e4886f481cc ] + +In the unlikely event that something goes wrong with the device and +its registers, the fan_from_reg() function may return 0. This value +will cause a division-by-zero error in the show_pwm() function. + +To prevent this, test the value of +fan_from_reg(data->fan_full_speed[nr]) against 0 before performing +the division. If the division-by-zero error is avoided, assign 0 to +the val variable. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: df9ec2dae094 ("hwmon: (f71882fg) Reorder symbols to get rid of a few forward declarations") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230510143537.145060-1-n.zhandarovich@fintech.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/f71882fg.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c +index 70121482a6173..27207ec6f7feb 100644 +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -1096,8 +1096,11 @@ static ssize_t show_pwm(struct device *dev, + val = data->pwm[nr]; + else { + /* RPM mode */ +- val = 255 * fan_from_reg(data->fan_target[nr]) +- / fan_from_reg(data->fan_full_speed[nr]); ++ if (fan_from_reg(data->fan_full_speed[nr])) ++ val = 255 * fan_from_reg(data->fan_target[nr]) ++ / fan_from_reg(data->fan_full_speed[nr]); ++ else ++ val = 0; + } + mutex_unlock(&data->update_lock); + return sprintf(buf, "%d\n", val); +-- +2.39.2 + diff --git a/queue-6.1/hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch b/queue-6.1/hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch new file mode 100644 index 00000000000..db8a9fdd9cd --- /dev/null +++ b/queue-6.1/hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch @@ -0,0 +1,48 @@ +From 58f3109fee2a1bf27ca1b400bd027c46b000ff4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 08:30:04 -0700 +Subject: hwmon: (gsc-hwmon) fix fan pwm temperature scaling + +From: Tim Harvey + +[ Upstream commit a6d80df47ee2c69db99e4f2f8871aa4db154620b ] + +The GSC fan pwm temperature register is in centidegrees celcius but the +Linux hwmon convention is to use milidegrees celcius. Fix the scaling. + +Fixes: 3bce5377ef66 ("hwmon: Add Gateworks System Controller support") +Signed-off-by: Tim Harvey +Link: https://lore.kernel.org/r/20230606153004.1448086-1-tharvey@gateworks.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/gsc-hwmon.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c +index b60ec95b5edbf..74bfc21c2767b 100644 +--- a/drivers/hwmon/gsc-hwmon.c ++++ b/drivers/hwmon/gsc-hwmon.c +@@ -82,8 +82,8 @@ static ssize_t pwm_auto_point_temp_store(struct device *dev, + if (kstrtol(buf, 10, &temp)) + return -EINVAL; + +- temp = clamp_val(temp, 0, 10000); +- temp = DIV_ROUND_CLOSEST(temp, 10); ++ temp = clamp_val(temp, 0, 100000); ++ temp = DIV_ROUND_CLOSEST(temp, 100); + + regs[0] = temp & 0xff; + regs[1] = (temp >> 8) & 0xff; +@@ -100,7 +100,7 @@ static ssize_t pwm_auto_point_pwm_show(struct device *dev, + { + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + +- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100); ++ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10))); + } + + static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0); +-- +2.39.2 + diff --git a/queue-6.1/hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch b/queue-6.1/hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch new file mode 100644 index 00000000000..172c8bce6d7 --- /dev/null +++ b/queue-6.1/hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch @@ -0,0 +1,128 @@ +From fd4f9e6b5fee1e7ece2d11fcab84689c53ebce66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 14:34:47 -0700 +Subject: hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on + ADM1272 + +From: Guenter Roeck + +[ Upstream commit b153a0bb4199566abd337119207f82b59a8cd1ca ] + +The PMON_CONFIG register on ADM1272 is a 16 bit register. Writing a 8 bit +value into it clears the upper 8 bits of the register, resulting in +unexpected side effects. Fix by writing the 16 bit register value. + +Also, it has been reported that temperature readings are sometimes widely +inaccurate, to the point where readings may result in device shutdown due +to errant overtemperature faults. Improve by enabling temperature sampling. + +While at it, move the common code for ADM1272 and ADM1278 into a separate +function, and clarify in the error message that an attempt was made to +enable both VOUT and temperature monitoring. + +Last but not least, return the error code reported by the underlying I2C +controller and not -ENODEV if updating the PMON_CONFIG register fails. +After all, this does not indicate that the chip is not present, but an +error in the communication with the chip. + +Fixes: 4ff0ce227a1e ("hwmon: (pmbus/adm1275) Add support for ADM1272") +Fixes: 9da9c2dc57b2 ("hwmon: (adm1275) enable adm1272 temperature reporting") +Signed-off-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230602213447.3557346-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/adm1275.c | 52 +++++++++++++++++------------------ + 1 file changed, 26 insertions(+), 26 deletions(-) + +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index 3b07bfb43e937..b8543c06d022a 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -37,10 +37,13 @@ enum chips { adm1075, adm1272, adm1275, adm1276, adm1278, adm1293, adm1294 }; + + #define ADM1272_IRANGE BIT(0) + ++#define ADM1278_TSFILT BIT(15) + #define ADM1278_TEMP1_EN BIT(3) + #define ADM1278_VIN_EN BIT(2) + #define ADM1278_VOUT_EN BIT(1) + ++#define ADM1278_PMON_DEFCONFIG (ADM1278_VOUT_EN | ADM1278_TEMP1_EN | ADM1278_TSFILT) ++ + #define ADM1293_IRANGE_25 0 + #define ADM1293_IRANGE_50 BIT(6) + #define ADM1293_IRANGE_100 BIT(7) +@@ -462,6 +465,22 @@ static const struct i2c_device_id adm1275_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, adm1275_id); + ++/* Enable VOUT & TEMP1 if not enabled (disabled by default) */ ++static int adm1275_enable_vout_temp(struct i2c_client *client, int config) ++{ ++ int ret; ++ ++ if ((config & ADM1278_PMON_DEFCONFIG) != ADM1278_PMON_DEFCONFIG) { ++ config |= ADM1278_PMON_DEFCONFIG; ++ ret = i2c_smbus_write_word_data(client, ADM1275_PMON_CONFIG, config); ++ if (ret < 0) { ++ dev_err(&client->dev, "Failed to enable VOUT/TEMP1 monitoring\n"); ++ return ret; ++ } ++ } ++ return 0; ++} ++ + static int adm1275_probe(struct i2c_client *client) + { + s32 (*config_read_fn)(const struct i2c_client *client, u8 reg); +@@ -615,19 +634,10 @@ static int adm1275_probe(struct i2c_client *client) + PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | + PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP; + +- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */ +- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) != +- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) { +- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN; +- ret = i2c_smbus_write_byte_data(client, +- ADM1275_PMON_CONFIG, +- config); +- if (ret < 0) { +- dev_err(&client->dev, +- "Failed to enable VOUT monitoring\n"); +- return -ENODEV; +- } +- } ++ ret = adm1275_enable_vout_temp(client, config); ++ if (ret) ++ return ret; ++ + if (config & ADM1278_VIN_EN) + info->func[0] |= PMBUS_HAVE_VIN; + break; +@@ -684,19 +694,9 @@ static int adm1275_probe(struct i2c_client *client) + PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | + PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP; + +- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */ +- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) != +- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) { +- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN; +- ret = i2c_smbus_write_word_data(client, +- ADM1275_PMON_CONFIG, +- config); +- if (ret < 0) { +- dev_err(&client->dev, +- "Failed to enable VOUT monitoring\n"); +- return -ENODEV; +- } +- } ++ ret = adm1275_enable_vout_temp(client, config); ++ if (ret) ++ return ret; + + if (config & ADM1278_VIN_EN) + info->func[0] |= PMBUS_HAVE_VIN; +-- +2.39.2 + diff --git a/queue-6.1/hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch b/queue-6.1/hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch new file mode 100644 index 00000000000..1af9ff9b351 --- /dev/null +++ b/queue-6.1/hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch @@ -0,0 +1,96 @@ +From c3a3deb70c95672b339a6eb984f26b9c7f50f94c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 09:58:13 +0100 +Subject: hwrng: st - keep clock enabled while hwrng is registered + +From: Martin Kaiser + +[ Upstream commit 501e197a02d4aef157f53ba3a0b9049c3e52fedc ] + +The st-rng driver uses devres to register itself with the hwrng core, +the driver will be unregistered from hwrng when its device goes out of +scope. This happens after the driver's remove function is called. + +However, st-rng's clock is disabled in the remove function. There's a +short timeframe where st-rng is still registered with the hwrng core +although its clock is disabled. I suppose the clock must be active to +access the hardware and serve requests from the hwrng core. + +Switch to devm_clk_get_enabled and let devres disable the clock and +unregister the hwrng. This avoids the race condition. + +Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API") +Signed-off-by: Martin Kaiser +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/st-rng.c | 21 +-------------------- + 1 file changed, 1 insertion(+), 20 deletions(-) + +diff --git a/drivers/char/hw_random/st-rng.c b/drivers/char/hw_random/st-rng.c +index 15ba1e6fae4d2..6e9dfac9fc9f4 100644 +--- a/drivers/char/hw_random/st-rng.c ++++ b/drivers/char/hw_random/st-rng.c +@@ -42,7 +42,6 @@ + + struct st_rng_data { + void __iomem *base; +- struct clk *clk; + struct hwrng ops; + }; + +@@ -85,26 +84,18 @@ static int st_rng_probe(struct platform_device *pdev) + if (IS_ERR(base)) + return PTR_ERR(base); + +- clk = devm_clk_get(&pdev->dev, NULL); ++ clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); + +- ret = clk_prepare_enable(clk); +- if (ret) +- return ret; +- + ddata->ops.priv = (unsigned long)ddata; + ddata->ops.read = st_rng_read; + ddata->ops.name = pdev->name; + ddata->base = base; +- ddata->clk = clk; +- +- dev_set_drvdata(&pdev->dev, ddata); + + ret = devm_hwrng_register(&pdev->dev, &ddata->ops); + if (ret) { + dev_err(&pdev->dev, "Failed to register HW RNG\n"); +- clk_disable_unprepare(clk); + return ret; + } + +@@ -113,15 +104,6 @@ static int st_rng_probe(struct platform_device *pdev) + return 0; + } + +-static int st_rng_remove(struct platform_device *pdev) +-{ +- struct st_rng_data *ddata = dev_get_drvdata(&pdev->dev); +- +- clk_disable_unprepare(ddata->clk); +- +- return 0; +-} +- + static const struct of_device_id st_rng_match[] __maybe_unused = { + { .compatible = "st,rng" }, + {}, +@@ -134,7 +116,6 @@ static struct platform_driver st_rng_driver = { + .of_match_table = of_match_ptr(st_rng_match), + }, + .probe = st_rng_probe, +- .remove = st_rng_remove + }; + + module_platform_driver(st_rng_driver); +-- +2.39.2 + diff --git a/queue-6.1/hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch b/queue-6.1/hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch new file mode 100644 index 00000000000..c53946d68ff --- /dev/null +++ b/queue-6.1/hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch @@ -0,0 +1,86 @@ +From 16106545dfbd3ae926cd22decf516c6318304b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 11:59:32 +0800 +Subject: hwrng: virtio - Fix race on data_avail and actual data + +From: Herbert Xu + +[ Upstream commit ac52578d6e8d300dd50f790f29a24169b1edd26c ] + +The virtio rng device kicks off a new entropy request whenever the +data available reaches zero. When a new request occurs at the end +of a read operation, that is, when the result of that request is +only needed by the next reader, then there is a race between the +writing of the new data and the next reader. + +This is because there is no synchronisation whatsoever between the +writer and the reader. + +Fix this by writing data_avail with smp_store_release and reading +it with smp_load_acquire when we first enter read. The subsequent +reads are safe because they're either protected by the first load +acquire, or by the completion mechanism. + +Also remove the redundant zeroing of data_idx in random_recv_done +(data_idx must already be zero at this point) and data_avail in +request_entropy (ditto). + +Reported-by: syzbot+726dc8c62c3536431ceb@syzkaller.appspotmail.com +Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.") +Signed-off-by: Herbert Xu +Acked-by: Michael S. Tsirkin +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/virtio-rng.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index a6f3a8a2aca6d..35304117338ab 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -4,6 +4,7 @@ + * Copyright (C) 2007, 2008 Rusty Russell IBM Corporation + */ + ++#include + #include + #include + #include +@@ -37,13 +38,13 @@ struct virtrng_info { + static void random_recv_done(struct virtqueue *vq) + { + struct virtrng_info *vi = vq->vdev->priv; ++ unsigned int len; + + /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */ +- if (!virtqueue_get_buf(vi->vq, &vi->data_avail)) ++ if (!virtqueue_get_buf(vi->vq, &len)) + return; + +- vi->data_idx = 0; +- ++ smp_store_release(&vi->data_avail, len); + complete(&vi->have_data); + } + +@@ -52,7 +53,6 @@ static void request_entropy(struct virtrng_info *vi) + struct scatterlist sg; + + reinit_completion(&vi->have_data); +- vi->data_avail = 0; + vi->data_idx = 0; + + sg_init_one(&sg, vi->data, sizeof(vi->data)); +@@ -88,7 +88,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + read = 0; + + /* copy available data */ +- if (vi->data_avail) { ++ if (smp_load_acquire(&vi->data_avail)) { + chunk = copy_data(vi, buf, size); + size -= chunk; + read += chunk; +-- +2.39.2 + diff --git a/queue-6.1/ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch b/queue-6.1/ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch new file mode 100644 index 00000000000..e809b987873 --- /dev/null +++ b/queue-6.1/ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch @@ -0,0 +1,765 @@ +From e1817dc038a17b7a8eb9b102b44841d2715637ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 12:32:16 -0400 +Subject: IB/hfi1: Fix wrong mmu_node used for user SDMA packet after + invalidate + +From: Brendan Cunningham + +[ Upstream commit c9358de193ecfb360c3ce75f27ce839ca0b0bc8c ] + +The hfi1 user SDMA pinned-page cache will leave a stale cache entry when +the cache-entry's virtual address range is invalidated but that cache +entry is in-use by an outstanding SDMA request. + +Subsequent user SDMA requests with buffers in or spanning the virtual +address range of the stale cache entry will result in packets constructed +from the wrong memory, the physical pages pointed to by the stale cache +entry. + +To fix this, remove mmu_rb_node cache entries from the mmu_rb_handler +cache independent of the cache entry's refcount. Add 'struct kref +refcount' to struct mmu_rb_node and manage mmu_rb_node lifetime with +kref_get() and kref_put(). + +mmu_rb_node.refcount makes sdma_mmu_node.refcount redundant. Remove +'atomic_t refcount' from struct sdma_mmu_node and change sdma_mmu_node +code to use mmu_rb_node.refcount. + +Move the mmu_rb_handler destructor call after a +wait-for-SDMA-request-completion call so mmu_rb_nodes that need +mmu_rb_handler's workqueue to queue themselves up for destruction from an +interrupt context may do so. + +Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging") +Fixes: 00cbce5cbf88 ("IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests") +Link: https://lore.kernel.org/r/168451393605.3700681.13493776139032178861.stgit@awfm-02.cornelisnetworks.com +Reviewed-by: Dean Luick +Signed-off-by: Brendan Cunningham +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 4 +- + drivers/infiniband/hw/hfi1/mmu_rb.c | 101 ++++++++++------- + drivers/infiniband/hw/hfi1/mmu_rb.h | 3 + + drivers/infiniband/hw/hfi1/sdma.c | 23 +++- + drivers/infiniband/hw/hfi1/sdma.h | 47 +++++--- + drivers/infiniband/hw/hfi1/sdma_txreq.h | 2 + + drivers/infiniband/hw/hfi1/user_sdma.c | 137 ++++++++++-------------- + drivers/infiniband/hw/hfi1/user_sdma.h | 1 - + drivers/infiniband/hw/hfi1/vnic_sdma.c | 4 +- + 9 files changed, 177 insertions(+), 145 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 8973a081d641e..e7d831330278d 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -215,11 +215,11 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx, + const skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + + ret = sdma_txadd_page(dd, +- NULL, + txreq, + skb_frag_page(frag), + frag->bv_offset, +- skb_frag_size(frag)); ++ skb_frag_size(frag), ++ NULL, NULL, NULL); + if (unlikely(ret)) + break; + } +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 71b9ac0188875..94f1701667301 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -19,8 +19,7 @@ static int mmu_notifier_range_start(struct mmu_notifier *, + const struct mmu_notifier_range *); + static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *, + unsigned long, unsigned long); +-static void do_remove(struct mmu_rb_handler *handler, +- struct list_head *del_list); ++static void release_immediate(struct kref *refcount); + static void handle_remove(struct work_struct *work); + + static const struct mmu_notifier_ops mn_opts = { +@@ -103,7 +102,11 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- do_remove(handler, &del_list); ++ while (!list_empty(&del_list)) { ++ rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); ++ list_del(&rbnode->list); ++ kref_put(&rbnode->refcount, release_immediate); ++ } + + /* Now the mm may be freed. */ + mmdrop(handler->mn.mm); +@@ -131,12 +134,6 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + } + __mmu_int_rb_insert(mnode, &handler->root); + list_add_tail(&mnode->list, &handler->lru_list); +- +- ret = handler->ops->insert(handler->ops_arg, mnode); +- if (ret) { +- __mmu_int_rb_remove(mnode, &handler->root); +- list_del(&mnode->list); /* remove from LRU list */ +- } + mnode->handler = handler; + unlock: + spin_unlock_irqrestore(&handler->lock, flags); +@@ -180,6 +177,48 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + return node; + } + ++/* ++ * Must NOT call while holding mnode->handler->lock. ++ * mnode->handler->ops->remove() may sleep and mnode->handler->lock is a ++ * spinlock. ++ */ ++static void release_immediate(struct kref *refcount) ++{ ++ struct mmu_rb_node *mnode = ++ container_of(refcount, struct mmu_rb_node, refcount); ++ mnode->handler->ops->remove(mnode->handler->ops_arg, mnode); ++} ++ ++/* Caller must hold mnode->handler->lock */ ++static void release_nolock(struct kref *refcount) ++{ ++ struct mmu_rb_node *mnode = ++ container_of(refcount, struct mmu_rb_node, refcount); ++ list_move(&mnode->list, &mnode->handler->del_list); ++ queue_work(mnode->handler->wq, &mnode->handler->del_work); ++} ++ ++/* ++ * struct mmu_rb_node->refcount kref_put() callback. ++ * Adds mmu_rb_node to mmu_rb_node->handler->del_list and queues ++ * handler->del_work on handler->wq. ++ * Does not remove mmu_rb_node from handler->lru_list or handler->rb_root. ++ * Acquires mmu_rb_node->handler->lock; do not call while already holding ++ * handler->lock. ++ */ ++void hfi1_mmu_rb_release(struct kref *refcount) ++{ ++ struct mmu_rb_node *mnode = ++ container_of(refcount, struct mmu_rb_node, refcount); ++ struct mmu_rb_handler *handler = mnode->handler; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&handler->lock, flags); ++ list_move(&mnode->list, &mnode->handler->del_list); ++ spin_unlock_irqrestore(&handler->lock, flags); ++ queue_work(handler->wq, &handler->del_work); ++} ++ + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + { + struct mmu_rb_node *rbnode, *ptr; +@@ -194,6 +233,10 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + + spin_lock_irqsave(&handler->lock, flags); + list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { ++ /* refcount == 1 implies mmu_rb_handler has only rbnode ref */ ++ if (kref_read(&rbnode->refcount) > 1) ++ continue; ++ + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -206,7 +249,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + spin_unlock_irqrestore(&handler->lock, flags); + + list_for_each_entry_safe(rbnode, ptr, &del_list, list) { +- handler->ops->remove(handler->ops_arg, rbnode); ++ kref_put(&rbnode->refcount, release_immediate); + } + } + +@@ -218,7 +261,6 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn, + struct rb_root_cached *root = &handler->root; + struct mmu_rb_node *node, *ptr = NULL; + unsigned long flags; +- bool added = false; + + spin_lock_irqsave(&handler->lock, flags); + for (node = __mmu_int_rb_iter_first(root, range->start, range->end-1); +@@ -227,38 +269,16 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn, + ptr = __mmu_int_rb_iter_next(node, range->start, + range->end - 1); + trace_hfi1_mmu_mem_invalidate(node->addr, node->len); +- if (handler->ops->invalidate(handler->ops_arg, node)) { +- __mmu_int_rb_remove(node, root); +- /* move from LRU list to delete list */ +- list_move(&node->list, &handler->del_list); +- added = true; +- } ++ /* Remove from rb tree and lru_list. */ ++ __mmu_int_rb_remove(node, root); ++ list_del_init(&node->list); ++ kref_put(&node->refcount, release_nolock); + } + spin_unlock_irqrestore(&handler->lock, flags); + +- if (added) +- queue_work(handler->wq, &handler->del_work); +- + return 0; + } + +-/* +- * Call the remove function for the given handler and the list. This +- * is expected to be called with a delete list extracted from handler. +- * The caller should not be holding the handler lock. +- */ +-static void do_remove(struct mmu_rb_handler *handler, +- struct list_head *del_list) +-{ +- struct mmu_rb_node *node; +- +- while (!list_empty(del_list)) { +- node = list_first_entry(del_list, struct mmu_rb_node, list); +- list_del(&node->list); +- handler->ops->remove(handler->ops_arg, node); +- } +-} +- + /* + * Work queue function to remove all nodes that have been queued up to + * be removed. The key feature is that mm->mmap_lock is not being held +@@ -271,11 +291,16 @@ static void handle_remove(struct work_struct *work) + del_work); + struct list_head del_list; + unsigned long flags; ++ struct mmu_rb_node *node; + + /* remove anything that is queued to get removed */ + spin_lock_irqsave(&handler->lock, flags); + list_replace_init(&handler->del_list, &del_list); + spin_unlock_irqrestore(&handler->lock, flags); + +- do_remove(handler, &del_list); ++ while (!list_empty(&del_list)) { ++ node = list_first_entry(&del_list, struct mmu_rb_node, list); ++ list_del(&node->list); ++ handler->ops->remove(handler->ops_arg, node); ++ } + } +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h +index ed75acdb7b839..dd2c4a0ae95b1 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.h ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h +@@ -16,6 +16,7 @@ struct mmu_rb_node { + struct rb_node node; + struct mmu_rb_handler *handler; + struct list_head list; ++ struct kref refcount; + }; + + /* +@@ -51,6 +52,8 @@ int hfi1_mmu_rb_register(void *ops_arg, + void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler); + int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + struct mmu_rb_node *mnode); ++void hfi1_mmu_rb_release(struct kref *refcount); ++ + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg); + struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, + unsigned long addr, +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index bb2552dd29c1e..26c62162759ba 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -1593,7 +1593,20 @@ static inline void sdma_unmap_desc( + struct hfi1_devdata *dd, + struct sdma_desc *descp) + { +- system_descriptor_complete(dd, descp); ++ switch (sdma_mapping_type(descp)) { ++ case SDMA_MAP_SINGLE: ++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ case SDMA_MAP_PAGE: ++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ } ++ ++ if (descp->pinning_ctx && descp->ctx_put) ++ descp->ctx_put(descp->pinning_ctx); ++ descp->pinning_ctx = NULL; + } + + /* +@@ -3113,8 +3126,8 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx, + + /* Add descriptor for coalesce buffer */ + tx->desc_limit = MAX_DESC; +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, +- addr, tx->tlen); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, ++ addr, tx->tlen, NULL, NULL, NULL); + } + + return 1; +@@ -3157,9 +3170,9 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + make_tx_sdma_desc( + tx, + SDMA_MAP_NONE, +- NULL, + dd->sdma_pad_phys, +- sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); ++ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)), ++ NULL, NULL, NULL); + tx->num_desc++; + _sdma_close_tx(dd, tx); + return rval; +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index 95aaec14c6c28..7fdebab202c4f 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -594,9 +594,11 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d) + static inline void make_tx_sdma_desc( + struct sdma_txreq *tx, + int type, +- void *pinning_ctx, + dma_addr_t addr, +- size_t len) ++ size_t len, ++ void *pinning_ctx, ++ void (*ctx_get)(void *), ++ void (*ctx_put)(void *)) + { + struct sdma_desc *desc = &tx->descp[tx->num_desc]; + +@@ -613,7 +615,11 @@ static inline void make_tx_sdma_desc( + << SDMA_DESC0_PHY_ADDR_SHIFT) | + (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK) + << SDMA_DESC0_BYTE_COUNT_SHIFT); ++ + desc->pinning_ctx = pinning_ctx; ++ desc->ctx_put = ctx_put; ++ if (pinning_ctx && ctx_get) ++ ctx_get(pinning_ctx); + } + + /* helper to extend txreq */ +@@ -645,18 +651,20 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd, + static inline int _sdma_txadd_daddr( + struct hfi1_devdata *dd, + int type, +- void *pinning_ctx, + struct sdma_txreq *tx, + dma_addr_t addr, +- u16 len) ++ u16 len, ++ void *pinning_ctx, ++ void (*ctx_get)(void *), ++ void (*ctx_put)(void *)) + { + int rval = 0; + + make_tx_sdma_desc( + tx, + type, +- pinning_ctx, +- addr, len); ++ addr, len, ++ pinning_ctx, ctx_get, ctx_put); + WARN_ON(len > tx->tlen); + tx->num_desc++; + tx->tlen -= len; +@@ -676,11 +684,18 @@ static inline int _sdma_txadd_daddr( + /** + * sdma_txadd_page() - add a page to the sdma_txreq + * @dd: the device to use for mapping +- * @pinning_ctx: context to be released at descriptor retirement + * @tx: tx request to which the page is added + * @page: page to map + * @offset: offset within the page + * @len: length in bytes ++ * @pinning_ctx: context to be stored on struct sdma_desc .pinning_ctx. Not ++ * added if coalesce buffer is used. E.g. pointer to pinned-page ++ * cache entry for the sdma_desc. ++ * @ctx_get: optional function to take reference to @pinning_ctx. Not called if ++ * @pinning_ctx is NULL. ++ * @ctx_put: optional function to release reference to @pinning_ctx after ++ * sdma_desc completes. May be called in interrupt context so must ++ * not sleep. Not called if @pinning_ctx is NULL. + * + * This is used to add a page/offset/length descriptor. + * +@@ -692,11 +707,13 @@ static inline int _sdma_txadd_daddr( + */ + static inline int sdma_txadd_page( + struct hfi1_devdata *dd, +- void *pinning_ctx, + struct sdma_txreq *tx, + struct page *page, + unsigned long offset, +- u16 len) ++ u16 len, ++ void *pinning_ctx, ++ void (*ctx_get)(void *), ++ void (*ctx_put)(void *)) + { + dma_addr_t addr; + int rval; +@@ -720,7 +737,8 @@ static inline int sdma_txadd_page( + return -ENOSPC; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, tx, addr, len, ++ pinning_ctx, ctx_get, ctx_put); + } + + /** +@@ -754,8 +772,8 @@ static inline int sdma_txadd_daddr( + return rval; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx, +- addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len, ++ NULL, NULL, NULL); + } + + /** +@@ -801,7 +819,8 @@ static inline int sdma_txadd_kvaddr( + return -ENOSPC; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, addr, len, ++ NULL, NULL, NULL); + } + + struct iowait_work; +@@ -1034,6 +1053,4 @@ u16 sdma_get_descq_cnt(void); + extern uint mod_num_sdma; + + void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid); +- +-void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp); + #endif +diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h +index fad946cb5e0d8..85ae7293c2741 100644 +--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h ++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h +@@ -20,6 +20,8 @@ struct sdma_desc { + /* private: don't use directly */ + u64 qw[2]; + void *pinning_ctx; ++ /* Release reference to @pinning_ctx. May be called in interrupt context. Must not sleep. */ ++ void (*ctx_put)(void *ctx); + }; + + /** +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index ae58b48afe074..02bd62b857b75 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -62,18 +62,14 @@ static int defer_packet_queue( + static void activate_packet_queue(struct iowait *wait, int reason); + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len); +-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode); + static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode, + void *arg2, bool *stop); + static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode); +-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode); + + static struct mmu_rb_ops sdma_rb_ops = { + .filter = sdma_rb_filter, +- .insert = sdma_rb_insert, + .evict = sdma_rb_evict, + .remove = sdma_rb_remove, +- .invalidate = sdma_rb_invalidate + }; + + static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, +@@ -247,14 +243,14 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd, + spin_unlock(&fd->pq_rcu_lock); + synchronize_srcu(&fd->pq_srcu); + /* at this point there can be no more new requests */ +- if (pq->handler) +- hfi1_mmu_rb_unregister(pq->handler); + iowait_sdma_drain(&pq->busy); + /* Wait until all requests have been freed. */ + wait_event_interruptible( + pq->wait, + !atomic_read(&pq->n_reqs)); + kfree(pq->reqs); ++ if (pq->handler) ++ hfi1_mmu_rb_unregister(pq->handler); + bitmap_free(pq->req_in_use); + kmem_cache_destroy(pq->txreq_cache); + flush_pq_iowait(pq); +@@ -1275,25 +1271,17 @@ static void free_system_node(struct sdma_mmu_node *node) + kfree(node); + } + +-static inline void acquire_node(struct sdma_mmu_node *node) +-{ +- atomic_inc(&node->refcount); +- WARN_ON(atomic_read(&node->refcount) < 0); +-} +- +-static inline void release_node(struct mmu_rb_handler *handler, +- struct sdma_mmu_node *node) +-{ +- atomic_dec(&node->refcount); +- WARN_ON(atomic_read(&node->refcount) < 0); +-} +- ++/* ++ * kref_get()'s an additional kref on the returned rb_node to prevent rb_node ++ * from being released until after rb_node is assigned to an SDMA descriptor ++ * (struct sdma_desc) under add_system_iovec_to_sdma_packet(), even if the ++ * virtual address range for rb_node is invalidated between now and then. ++ */ + static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, + unsigned long start, + unsigned long end) + { + struct mmu_rb_node *rb_node; +- struct sdma_mmu_node *node; + unsigned long flags; + + spin_lock_irqsave(&handler->lock, flags); +@@ -1302,11 +1290,12 @@ static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, + spin_unlock_irqrestore(&handler->lock, flags); + return NULL; + } +- node = container_of(rb_node, struct sdma_mmu_node, rb); +- acquire_node(node); ++ ++ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */ ++ kref_get(&rb_node->refcount); + spin_unlock_irqrestore(&handler->lock, flags); + +- return node; ++ return container_of(rb_node, struct sdma_mmu_node, rb); + } + + static int pin_system_pages(struct user_sdma_request *req, +@@ -1355,6 +1344,13 @@ static int pin_system_pages(struct user_sdma_request *req, + return 0; + } + ++/* ++ * kref refcount on *node_p will be 2 on successful addition: one kref from ++ * kref_init() for mmu_rb_handler and one kref to prevent *node_p from being ++ * released until after *node_p is assigned to an SDMA descriptor (struct ++ * sdma_desc) under add_system_iovec_to_sdma_packet(), even if the virtual ++ * address range for *node_p is invalidated between now and then. ++ */ + static int add_system_pinning(struct user_sdma_request *req, + struct sdma_mmu_node **node_p, + unsigned long start, unsigned long len) +@@ -1368,6 +1364,12 @@ static int add_system_pinning(struct user_sdma_request *req, + if (!node) + return -ENOMEM; + ++ /* First kref "moves" to mmu_rb_handler */ ++ kref_init(&node->rb.refcount); ++ ++ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */ ++ kref_get(&node->rb.refcount); ++ + node->pq = pq; + ret = pin_system_pages(req, start, len, node, PFN_DOWN(len)); + if (ret == 0) { +@@ -1431,15 +1433,15 @@ static int get_system_cache_entry(struct user_sdma_request *req, + return 0; + } + +- SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d", +- node->rb.addr, atomic_read(&node->refcount)); ++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->rb.refcount %d", ++ node->rb.addr, kref_read(&node->rb.refcount)); + prepend_len = node->rb.addr - start; + + /* + * This node will not be returned, instead a new node + * will be. So release the reference. + */ +- release_node(handler, node); ++ kref_put(&node->rb.refcount, hfi1_mmu_rb_release); + + /* Prepend a node to cover the beginning of the allocation */ + ret = add_system_pinning(req, node_p, start, prepend_len); +@@ -1451,6 +1453,20 @@ static int get_system_cache_entry(struct user_sdma_request *req, + } + } + ++static void sdma_mmu_rb_node_get(void *ctx) ++{ ++ struct mmu_rb_node *node = ctx; ++ ++ kref_get(&node->refcount); ++} ++ ++static void sdma_mmu_rb_node_put(void *ctx) ++{ ++ struct sdma_mmu_node *node = ctx; ++ ++ kref_put(&node->rb.refcount, hfi1_mmu_rb_release); ++} ++ + static int add_mapping_to_sdma_packet(struct user_sdma_request *req, + struct user_sdma_txreq *tx, + struct sdma_mmu_node *cache_entry, +@@ -1494,9 +1510,12 @@ static int add_mapping_to_sdma_packet(struct user_sdma_request *req, + ctx = cache_entry; + } + +- ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq, ++ ret = sdma_txadd_page(pq->dd, &tx->txreq, + cache_entry->pages[page_index], +- page_offset, from_this_page); ++ page_offset, from_this_page, ++ ctx, ++ sdma_mmu_rb_node_get, ++ sdma_mmu_rb_node_put); + if (ret) { + /* + * When there's a failure, the entire request is freed by +@@ -1518,8 +1537,6 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, + struct user_sdma_iovec *iovec, + size_t from_this_iovec) + { +- struct mmu_rb_handler *handler = req->pq->handler; +- + while (from_this_iovec > 0) { + struct sdma_mmu_node *cache_entry; + size_t from_this_cache_entry; +@@ -1540,15 +1557,15 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, + + ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start, + from_this_cache_entry); ++ ++ /* ++ * Done adding cache_entry to zero or more sdma_desc. Can ++ * kref_put() the "safety" kref taken under ++ * get_system_cache_entry(). ++ */ ++ kref_put(&cache_entry->rb.refcount, hfi1_mmu_rb_release); ++ + if (ret) { +- /* +- * We're guaranteed that there will be no descriptor +- * completion callback that releases this node +- * because only the last descriptor referencing it +- * has a context attached, and a failure means the +- * last descriptor was never added. +- */ +- release_node(handler, cache_entry); + SDMA_DBG(req, "add system segment failed %d", ret); + return ret; + } +@@ -1599,42 +1616,12 @@ static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, + return 0; + } + +-void system_descriptor_complete(struct hfi1_devdata *dd, +- struct sdma_desc *descp) +-{ +- switch (sdma_mapping_type(descp)) { +- case SDMA_MAP_SINGLE: +- dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), +- sdma_mapping_len(descp), DMA_TO_DEVICE); +- break; +- case SDMA_MAP_PAGE: +- dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), +- sdma_mapping_len(descp), DMA_TO_DEVICE); +- break; +- } +- +- if (descp->pinning_ctx) { +- struct sdma_mmu_node *node = descp->pinning_ctx; +- +- release_node(node->rb.handler, node); +- } +-} +- + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len) + { + return (bool)(node->addr == addr); + } + +-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode) +-{ +- struct sdma_mmu_node *node = +- container_of(mnode, struct sdma_mmu_node, rb); +- +- atomic_inc(&node->refcount); +- return 0; +-} +- + /* + * Return 1 to remove the node from the rb tree and call the remove op. + * +@@ -1647,10 +1634,6 @@ static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode, + container_of(mnode, struct sdma_mmu_node, rb); + struct evict_data *evict_data = evict_arg; + +- /* is this node still being used? */ +- if (atomic_read(&node->refcount)) +- return 0; /* keep this node */ +- + /* this node will be evicted, add its pages to our count */ + evict_data->cleared += node->npages; + +@@ -1668,13 +1651,3 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode) + + free_system_node(node); + } +- +-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode) +-{ +- struct sdma_mmu_node *node = +- container_of(mnode, struct sdma_mmu_node, rb); +- +- if (!atomic_read(&node->refcount)) +- return 1; +- return 0; +-} +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index a241836371dc1..548347d4c5bc2 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -104,7 +104,6 @@ struct hfi1_user_sdma_comp_q { + struct sdma_mmu_node { + struct mmu_rb_node rb; + struct hfi1_user_sdma_pkt_q *pq; +- atomic_t refcount; + struct page **pages; + unsigned int npages; + }; +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index 727eedfba332a..cc6324d2d1ddc 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -64,11 +64,11 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde, + + /* combine physically continuous fragments later? */ + ret = sdma_txadd_page(sde->dd, +- NULL, + &tx->txreq, + skb_frag_page(frag), + skb_frag_off(frag), +- skb_frag_size(frag)); ++ skb_frag_size(frag), ++ NULL, NULL, NULL); + if (unlikely(ret)) + goto bail_txadd; + } +-- +2.39.2 + diff --git a/queue-6.1/ice-handle-extts-in-the-miscellaneous-interrupt-thre.patch b/queue-6.1/ice-handle-extts-in-the-miscellaneous-interrupt-thre.patch new file mode 100644 index 00000000000..185a5f05261 --- /dev/null +++ b/queue-6.1/ice-handle-extts-in-the-miscellaneous-interrupt-thre.patch @@ -0,0 +1,199 @@ +From 2e648b3c5eaac8ec785c52f755f686314043da6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 14:15:03 -0700 +Subject: ice: handle extts in the miscellaneous interrupt thread + +From: Karol Kolacinski + +[ Upstream commit 6e8b2c88fc8cf95ed09de25946b20b7536c88cd5 ] + +The ice_ptp_extts_work() and ice_ptp_periodic_work() functions are both +scheduled on the same kthread worker, pf.ptp.kworker. The +ice_ptp_periodic_work() function sends to the firmware to interact with the +PHY, and must block to wait for responses. + +This can cause delay in responding to the PFINT_OICR_TSYN_EVNT interrupt +cause, ultimately resulting in disruption to processing an input signal of +the frequency is high enough. In our testing, even 100 Hz signals get +disrupted. + +Fix this by instead processing the signal inside the miscellaneous +interrupt thread prior to handling Tx timestamps. + +Use atomic bits in a new pf->misc_thread bitmap in order to safely +communicate which tasks require processing within the +ice_misc_intr_thread_fn(). This ensures the communication of desired tasks +from the ice_misc_intr() are correctly processed without racing even in the +event that the interrupt triggers again before the thread function exits. + +Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins") +Signed-off-by: Karol Kolacinski +Signed-off-by: Jacob Keller +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice.h | 7 ++++++ + drivers/net/ethernet/intel/ice/ice_main.c | 29 ++++++++++++++++------- + drivers/net/ethernet/intel/ice/ice_ptp.c | 12 +++------- + drivers/net/ethernet/intel/ice/ice_ptp.h | 4 ++-- + 4 files changed, 33 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h +index ca6b877fdde81..f2be383d97df5 100644 +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -491,6 +491,12 @@ enum ice_pf_flags { + ICE_PF_FLAGS_NBITS /* must be last */ + }; + ++enum ice_misc_thread_tasks { ++ ICE_MISC_THREAD_EXTTS_EVENT, ++ ICE_MISC_THREAD_TX_TSTAMP, ++ ICE_MISC_THREAD_NBITS /* must be last */ ++}; ++ + struct ice_switchdev_info { + struct ice_vsi *control_vsi; + struct ice_vsi *uplink_vsi; +@@ -532,6 +538,7 @@ struct ice_pf { + DECLARE_BITMAP(features, ICE_F_MAX); + DECLARE_BITMAP(state, ICE_STATE_NBITS); + DECLARE_BITMAP(flags, ICE_PF_FLAGS_NBITS); ++ DECLARE_BITMAP(misc_thread, ICE_MISC_THREAD_NBITS); + unsigned long *avail_txqs; /* bitmap to track PF Tx queue usage */ + unsigned long *avail_rxqs; /* bitmap to track PF Rx queue usage */ + unsigned long serv_tmr_period; +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 4095fe40dfc9b..7a5ec3ce3407a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3116,20 +3116,28 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data) + + if (oicr & PFINT_OICR_TSYN_TX_M) { + ena_mask &= ~PFINT_OICR_TSYN_TX_M; +- if (!hw->reset_ongoing) ++ if (!hw->reset_ongoing) { ++ set_bit(ICE_MISC_THREAD_TX_TSTAMP, pf->misc_thread); + ret = IRQ_WAKE_THREAD; ++ } + } + + if (oicr & PFINT_OICR_TSYN_EVNT_M) { + u8 tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned; + u32 gltsyn_stat = rd32(hw, GLTSYN_STAT(tmr_idx)); + +- /* Save EVENTs from GTSYN register */ +- pf->ptp.ext_ts_irq |= gltsyn_stat & (GLTSYN_STAT_EVENT0_M | +- GLTSYN_STAT_EVENT1_M | +- GLTSYN_STAT_EVENT2_M); + ena_mask &= ~PFINT_OICR_TSYN_EVNT_M; +- kthread_queue_work(pf->ptp.kworker, &pf->ptp.extts_work); ++ ++ if (hw->func_caps.ts_func_info.src_tmr_owned) { ++ /* Save EVENTs from GLTSYN register */ ++ pf->ptp.ext_ts_irq |= gltsyn_stat & ++ (GLTSYN_STAT_EVENT0_M | ++ GLTSYN_STAT_EVENT1_M | ++ GLTSYN_STAT_EVENT2_M); ++ ++ set_bit(ICE_MISC_THREAD_EXTTS_EVENT, pf->misc_thread); ++ ret = IRQ_WAKE_THREAD; ++ } + } + + #define ICE_AUX_CRIT_ERR (PFINT_OICR_PE_CRITERR_M | PFINT_OICR_HMC_ERR_M | PFINT_OICR_PE_PUSH_M) +@@ -3173,8 +3181,13 @@ static irqreturn_t ice_misc_intr_thread_fn(int __always_unused irq, void *data) + if (ice_is_reset_in_progress(pf->state)) + return IRQ_HANDLED; + +- while (!ice_ptp_process_ts(pf)) +- usleep_range(50, 100); ++ if (test_and_clear_bit(ICE_MISC_THREAD_EXTTS_EVENT, pf->misc_thread)) ++ ice_ptp_extts_event(pf); ++ ++ if (test_and_clear_bit(ICE_MISC_THREAD_TX_TSTAMP, pf->misc_thread)) { ++ while (!ice_ptp_process_ts(pf)) ++ usleep_range(50, 100); ++ } + + return IRQ_HANDLED; + } +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index a3585ede829bb..46b0063a5e128 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -1478,15 +1478,11 @@ static int ice_ptp_adjfine(struct ptp_clock_info *info, long scaled_ppm) + } + + /** +- * ice_ptp_extts_work - Workqueue task function +- * @work: external timestamp work structure +- * +- * Service for PTP external clock event ++ * ice_ptp_extts_event - Process PTP external clock event ++ * @pf: Board private structure + */ +-static void ice_ptp_extts_work(struct kthread_work *work) ++void ice_ptp_extts_event(struct ice_pf *pf) + { +- struct ice_ptp *ptp = container_of(work, struct ice_ptp, extts_work); +- struct ice_pf *pf = container_of(ptp, struct ice_pf, ptp); + struct ptp_clock_event event; + struct ice_hw *hw = &pf->hw; + u8 chan, tmr_idx; +@@ -2512,7 +2508,6 @@ void ice_ptp_prepare_for_reset(struct ice_pf *pf) + ice_ptp_cfg_timestamp(pf, false); + + kthread_cancel_delayed_work_sync(&ptp->work); +- kthread_cancel_work_sync(&ptp->extts_work); + + if (test_bit(ICE_PFR_REQ, pf->state)) + return; +@@ -2610,7 +2605,6 @@ static int ice_ptp_init_work(struct ice_pf *pf, struct ice_ptp *ptp) + + /* Initialize work functions */ + kthread_init_delayed_work(&ptp->work, ice_ptp_periodic_work); +- kthread_init_work(&ptp->extts_work, ice_ptp_extts_work); + + /* Allocate a kworker for handling work required for the ports + * connected to the PTP hardware clock. +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/ethernet/intel/ice/ice_ptp.h +index 028349295b719..e689c05bb001f 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.h ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.h +@@ -159,7 +159,6 @@ struct ice_ptp_port { + * struct ice_ptp - data used for integrating with CONFIG_PTP_1588_CLOCK + * @port: data for the PHY port initialization procedure + * @work: delayed work function for periodic tasks +- * @extts_work: work function for handling external Tx timestamps + * @cached_phc_time: a cached copy of the PHC time for timestamp extension + * @cached_phc_jiffies: jiffies when cached_phc_time was last updated + * @ext_ts_chan: the external timestamp channel in use +@@ -180,7 +179,6 @@ struct ice_ptp_port { + struct ice_ptp { + struct ice_ptp_port port; + struct kthread_delayed_work work; +- struct kthread_work extts_work; + u64 cached_phc_time; + unsigned long cached_phc_jiffies; + u8 ext_ts_chan; +@@ -246,6 +244,7 @@ int ice_ptp_get_ts_config(struct ice_pf *pf, struct ifreq *ifr); + void ice_ptp_cfg_timestamp(struct ice_pf *pf, bool ena); + int ice_get_ptp_clock_index(struct ice_pf *pf); + ++void ice_ptp_extts_event(struct ice_pf *pf); + s8 ice_ptp_request_ts(struct ice_ptp_tx *tx, struct sk_buff *skb); + bool ice_ptp_process_ts(struct ice_pf *pf); + +@@ -274,6 +273,7 @@ static inline int ice_get_ptp_clock_index(struct ice_pf *pf) + return -1; + } + ++static inline void ice_ptp_extts_event(struct ice_pf *pf) { } + static inline s8 + ice_ptp_request_ts(struct ice_ptp_tx *tx, struct sk_buff *skb) + { +-- +2.39.2 + diff --git a/queue-6.1/igc-enable-and-fix-rx-hash-usage-by-netstack.patch b/queue-6.1/igc-enable-and-fix-rx-hash-usage-by-netstack.patch new file mode 100644 index 00000000000..5bb5ecd9ca6 --- /dev/null +++ b/queue-6.1/igc-enable-and-fix-rx-hash-usage-by-netstack.patch @@ -0,0 +1,149 @@ +From 151afd10f10c67925ea11e99be0e6163b7d84e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 15:30:42 +0200 +Subject: igc: Enable and fix RX hash usage by netstack + +From: Jesper Dangaard Brouer + +[ Upstream commit 84214ab4689f962b4bfc47fc9a5838d25ac4274d ] + +When function igc_rx_hash() was introduced in v4.20 via commit 0507ef8a0372 +("igc: Add transmit and receive fastpath and interrupt handlers"), the +hardware wasn't configured to provide RSS hash, thus it made sense to not +enable net_device NETIF_F_RXHASH feature bit. + +The NIC hardware was configured to enable RSS hash info in v5.2 via commit +2121c2712f82 ("igc: Add multiple receive queues control supporting"), but +forgot to set the NETIF_F_RXHASH feature bit. + +The original implementation of igc_rx_hash() didn't extract the associated +pkt_hash_type, but statically set PKT_HASH_TYPE_L3. The largest portions of +this patch are about extracting the RSS Type from the hardware and mapping +this to enum pkt_hash_types. This was based on Foxville i225 software user +manual rev-1.3.1 and tested on Intel Ethernet Controller I225-LM (rev 03). + +For UDP it's worth noting that RSS (type) hashing have been disabled both for +IPv4 and IPv6 (see IGC_MRQC_RSS_FIELD_IPV4_UDP + IGC_MRQC_RSS_FIELD_IPV6_UDP) +because hardware RSS doesn't handle fragmented pkts well when enabled (can +cause out-of-order). This results in PKT_HASH_TYPE_L3 for UDP packets, and +hash value doesn't include UDP port numbers. Not being PKT_HASH_TYPE_L4, have +the effect that netstack will do a software based hash calc calling into +flow_dissect, but only when code calls skb_get_hash(), which doesn't +necessary happen for local delivery. + +For QA verification testing I wrote a small bpftrace prog: + [0] https://github.com/xdp-project/xdp-project/blob/master/areas/hints/monitor_skb_hash_on_dev.bt + +Fixes: 2121c2712f82 ("igc: Add multiple receive queues control supporting") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Acked-by: Song Yoong Siang +Link: https://lore.kernel.org/bpf/168182464270.616355.11391652654430626584.stgit@firesoul +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc.h | 28 ++++++++++++++++++++ + drivers/net/ethernet/intel/igc/igc_main.c | 31 ++++++++++++++++++++--- + 2 files changed, 55 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index df3e26c0cf01a..f83cbc4a1afa8 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include "igc_hw.h" + +@@ -311,6 +312,33 @@ extern char igc_driver_name[]; + #define IGC_MRQC_RSS_FIELD_IPV4_UDP 0x00400000 + #define IGC_MRQC_RSS_FIELD_IPV6_UDP 0x00800000 + ++/* RX-desc Write-Back format RSS Type's */ ++enum igc_rss_type_num { ++ IGC_RSS_TYPE_NO_HASH = 0, ++ IGC_RSS_TYPE_HASH_TCP_IPV4 = 1, ++ IGC_RSS_TYPE_HASH_IPV4 = 2, ++ IGC_RSS_TYPE_HASH_TCP_IPV6 = 3, ++ IGC_RSS_TYPE_HASH_IPV6_EX = 4, ++ IGC_RSS_TYPE_HASH_IPV6 = 5, ++ IGC_RSS_TYPE_HASH_TCP_IPV6_EX = 6, ++ IGC_RSS_TYPE_HASH_UDP_IPV4 = 7, ++ IGC_RSS_TYPE_HASH_UDP_IPV6 = 8, ++ IGC_RSS_TYPE_HASH_UDP_IPV6_EX = 9, ++ IGC_RSS_TYPE_MAX = 10, ++}; ++#define IGC_RSS_TYPE_MAX_TABLE 16 ++#define IGC_RSS_TYPE_MASK GENMASK(3,0) /* 4-bits (3:0) = mask 0x0F */ ++ ++/* igc_rss_type - Rx descriptor RSS type field */ ++static inline u32 igc_rss_type(const union igc_adv_rx_desc *rx_desc) ++{ ++ /* RSS Type 4-bits (3:0) number: 0-9 (above 9 is reserved) ++ * Accessing the same bits via u16 (wb.lower.lo_dword.hs_rss.pkt_info) ++ * is slightly slower than via u32 (wb.lower.lo_dword.data) ++ */ ++ return le32_get_bits(rx_desc->wb.lower.lo_dword.data, IGC_RSS_TYPE_MASK); ++} ++ + /* Interrupt defines */ + #define IGC_START_ITR 648 /* ~6000 ints/sec */ + #define IGC_4K_ITR 980 +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 3509974c1f8e4..b67a6a81474f5 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -1684,14 +1684,36 @@ static void igc_rx_checksum(struct igc_ring *ring, + le32_to_cpu(rx_desc->wb.upper.status_error)); + } + ++/* Mapping HW RSS Type to enum pkt_hash_types */ ++static const enum pkt_hash_types igc_rss_type_table[IGC_RSS_TYPE_MAX_TABLE] = { ++ [IGC_RSS_TYPE_NO_HASH] = PKT_HASH_TYPE_L2, ++ [IGC_RSS_TYPE_HASH_TCP_IPV4] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_IPV4] = PKT_HASH_TYPE_L3, ++ [IGC_RSS_TYPE_HASH_TCP_IPV6] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_IPV6_EX] = PKT_HASH_TYPE_L3, ++ [IGC_RSS_TYPE_HASH_IPV6] = PKT_HASH_TYPE_L3, ++ [IGC_RSS_TYPE_HASH_TCP_IPV6_EX] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_UDP_IPV4] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_UDP_IPV6] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_UDP_IPV6_EX] = PKT_HASH_TYPE_L4, ++ [10] = PKT_HASH_TYPE_NONE, /* RSS Type above 9 "Reserved" by HW */ ++ [11] = PKT_HASH_TYPE_NONE, /* keep array sized for SW bit-mask */ ++ [12] = PKT_HASH_TYPE_NONE, /* to handle future HW revisons */ ++ [13] = PKT_HASH_TYPE_NONE, ++ [14] = PKT_HASH_TYPE_NONE, ++ [15] = PKT_HASH_TYPE_NONE, ++}; ++ + static inline void igc_rx_hash(struct igc_ring *ring, + union igc_adv_rx_desc *rx_desc, + struct sk_buff *skb) + { +- if (ring->netdev->features & NETIF_F_RXHASH) +- skb_set_hash(skb, +- le32_to_cpu(rx_desc->wb.lower.hi_dword.rss), +- PKT_HASH_TYPE_L3); ++ if (ring->netdev->features & NETIF_F_RXHASH) { ++ u32 rss_hash = le32_to_cpu(rx_desc->wb.lower.hi_dword.rss); ++ u32 rss_type = igc_rss_type(rx_desc); ++ ++ skb_set_hash(skb, rss_hash, igc_rss_type_table[rss_type]); ++ } + } + + static void igc_rx_vlan(struct igc_ring *rx_ring, +@@ -6518,6 +6540,7 @@ static int igc_probe(struct pci_dev *pdev, + netdev->features |= NETIF_F_TSO; + netdev->features |= NETIF_F_TSO6; + netdev->features |= NETIF_F_TSO_ECN; ++ netdev->features |= NETIF_F_RXHASH; + netdev->features |= NETIF_F_RXCSUM; + netdev->features |= NETIF_F_HW_CSUM; + netdev->features |= NETIF_F_SCTP_CRC; +-- +2.39.2 + diff --git a/queue-6.1/ima-fix-build-warnings.patch b/queue-6.1/ima-fix-build-warnings.patch new file mode 100644 index 00000000000..bbc5a7deaf1 --- /dev/null +++ b/queue-6.1/ima-fix-build-warnings.patch @@ -0,0 +1,61 @@ +From 95759714c192baab77208ff91c4176ac1695ec2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:41:13 +0200 +Subject: ima: Fix build warnings + +From: Roberto Sassu + +[ Upstream commit 95526d13038c2bbddd567a4d8e39fac42484e182 ] + +Fix build warnings (function parameters description) for +ima_collect_modsig(), ima_match_policy() and ima_parse_add_rule(). + +Fixes: 15588227e086 ("ima: Collect modsig") # v5.4+ +Fixes: 2fe5d6def167 ("ima: integrity appraisal extension") # v5.14+ +Fixes: 4af4662fa4a9 ("integrity: IMA policy") # v3.2+ +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_modsig.c | 3 +++ + security/integrity/ima/ima_policy.c | 3 ++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/security/integrity/ima/ima_modsig.c b/security/integrity/ima/ima_modsig.c +index fb25723c65bc4..3e7bee30080f2 100644 +--- a/security/integrity/ima/ima_modsig.c ++++ b/security/integrity/ima/ima_modsig.c +@@ -89,6 +89,9 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, + + /** + * ima_collect_modsig - Calculate the file hash without the appended signature. ++ * @modsig: parsed module signature ++ * @buf: data to verify the signature on ++ * @size: data size + * + * Since the modsig is part of the file contents, the hash used in its signature + * isn't the same one ordinarily calculated by IMA. Therefore PKCS7 code +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 2edff7f58c25c..bdc40535ff489 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -694,6 +694,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) + * @secid: LSM secid of the task to be validated + * @func: IMA hook identifier + * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) ++ * @flags: IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE) + * @pcr: set the pcr to extend + * @template_desc: the template that should be used for this rule + * @func_data: func specific data, may be NULL +@@ -1885,7 +1886,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + + /** + * ima_parse_add_rule - add a rule to ima_policy_rules +- * @rule - ima measurement policy rule ++ * @rule: ima measurement policy rule + * + * Avoid locking by allowing just one writer at a time in ima_write_policy() + * Returns the length of the rule parsed, an error code on failure +-- +2.39.2 + diff --git a/queue-6.1/input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch b/queue-6.1/input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch new file mode 100644 index 00000000000..fa9e4b558eb --- /dev/null +++ b/queue-6.1/input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch @@ -0,0 +1,39 @@ +From 38369b834255c2d2ba20012aaac833703ee2c6b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 17:27:55 -0700 +Subject: Input: adxl34x - do not hardcode interrupt trigger type + +From: Marek Vasut + +[ Upstream commit e96220bce5176ed2309f77f061dcc0430b82b25e ] + +Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_HIGH, let's +respect the settings specified in the firmware description. + +Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") +Signed-off-by: Marek Vasut +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20230509203555.549158-1-marex@denx.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/adxl34x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c +index a4af314392a9f..69e359ff51805 100644 +--- a/drivers/input/misc/adxl34x.c ++++ b/drivers/input/misc/adxl34x.c +@@ -811,8 +811,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, + AC_WRITE(ac, POWER_CTL, 0); + + err = request_threaded_irq(ac->irq, NULL, adxl34x_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, +- dev_name(dev), ac); ++ IRQF_ONESHOT, dev_name(dev), ac); + if (err) { + dev_err(dev, "irq %d busy?\n", ac->irq); + goto err_free_mem; +-- +2.39.2 + diff --git a/queue-6.1/input-drv260x-sleep-between-polling-go-bit.patch b/queue-6.1/input-drv260x-sleep-between-polling-go-bit.patch new file mode 100644 index 00000000000..4a86652f6c1 --- /dev/null +++ b/queue-6.1/input-drv260x-sleep-between-polling-go-bit.patch @@ -0,0 +1,39 @@ +From 663c6dd6f6cc1ecff71862f12362f8402278f680 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 17:01:45 -0700 +Subject: Input: drv260x - sleep between polling GO bit + +From: Luca Weiss + +[ Upstream commit efef661dfa6bf8cbafe4cd6a97433fcef0118967 ] + +When doing the initial startup there's no need to poll without any +delay and spam the I2C bus. + +Let's sleep 15ms between each attempt, which is the same time as used +in the vendor driver. + +Fixes: 7132fe4f5687 ("Input: drv260x - add TI drv260x haptics driver") +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-2-1fb28b4cc698@z3ntu.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/drv260x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c +index 0efe56f49aa94..1923924fdd444 100644 +--- a/drivers/input/misc/drv260x.c ++++ b/drivers/input/misc/drv260x.c +@@ -435,6 +435,7 @@ static int drv260x_init(struct drv260x_data *haptics) + } + + do { ++ usleep_range(15000, 15500); + error = regmap_read(haptics->regmap, DRV260X_GO, &cal_buf); + if (error) { + dev_err(&haptics->client->dev, +-- +2.39.2 + diff --git a/queue-6.1/input-pm8941-powerkey-fix-debounce-on-gen2-pmics.patch b/queue-6.1/input-pm8941-powerkey-fix-debounce-on-gen2-pmics.patch new file mode 100644 index 00000000000..285d6297d28 --- /dev/null +++ b/queue-6.1/input-pm8941-powerkey-fix-debounce-on-gen2-pmics.patch @@ -0,0 +1,76 @@ +From 9dfac3c63a6f224245645b0722e83dd7b7f07f25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:05:32 -0700 +Subject: Input: pm8941-powerkey - fix debounce on gen2+ PMICs + +From: Caleb Connolly + +[ Upstream commit 8c9cce9cb81b5fdc6e66bf3f129727b89e8daab7 ] + +Since PM8998/PM660, the power key debounce register was redefined to +support shorter debounce times. On PM8941 the shortest debounce time +(represented by register value 0) was 15625us, on PM8998 the shortest +debounce time is 62us, with the default being 2ms. + +Adjust the bit shift to correctly program debounce on PM8998 and newer. + +Fixes: 68c581d5e7d8 ("Input: add Qualcomm PM8941 power key driver") +Signed-off-by: Caleb Connolly +Link: https://lore.kernel.org/r/20230529-pm8941-pwrkey-debounce-v1-2-c043a6d5c814@linaro.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/pm8941-pwrkey.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/misc/pm8941-pwrkey.c b/drivers/input/misc/pm8941-pwrkey.c +index 549df01b6ee33..5dd68a02c4451 100644 +--- a/drivers/input/misc/pm8941-pwrkey.c ++++ b/drivers/input/misc/pm8941-pwrkey.c +@@ -50,7 +50,10 @@ + #define PON_RESIN_PULL_UP BIT(0) + + #define PON_DBC_CTL 0x71 +-#define PON_DBC_DELAY_MASK 0x7 ++#define PON_DBC_DELAY_MASK_GEN1 0x7 ++#define PON_DBC_DELAY_MASK_GEN2 0xf ++#define PON_DBC_SHIFT_GEN1 6 ++#define PON_DBC_SHIFT_GEN2 14 + + struct pm8941_data { + unsigned int pull_up_bit; +@@ -247,7 +250,7 @@ static int pm8941_pwrkey_probe(struct platform_device *pdev) + struct device *parent; + struct device_node *regmap_node; + const __be32 *addr; +- u32 req_delay; ++ u32 req_delay, mask, delay_shift; + int error; + + if (of_property_read_u32(pdev->dev.of_node, "debounce", &req_delay)) +@@ -336,12 +339,20 @@ static int pm8941_pwrkey_probe(struct platform_device *pdev) + pwrkey->input->phys = pwrkey->data->phys; + + if (pwrkey->data->supports_debounce_config) { +- req_delay = (req_delay << 6) / USEC_PER_SEC; ++ if (pwrkey->subtype >= PON_SUBTYPE_GEN2_PRIMARY) { ++ mask = PON_DBC_DELAY_MASK_GEN2; ++ delay_shift = PON_DBC_SHIFT_GEN2; ++ } else { ++ mask = PON_DBC_DELAY_MASK_GEN1; ++ delay_shift = PON_DBC_SHIFT_GEN1; ++ } ++ ++ req_delay = (req_delay << delay_shift) / USEC_PER_SEC; + req_delay = ilog2(req_delay); + + error = regmap_update_bits(pwrkey->regmap, + pwrkey->baseaddr + PON_DBC_CTL, +- PON_DBC_DELAY_MASK, ++ mask, + req_delay); + if (error) { + dev_err(&pdev->dev, "failed to set debounce: %d\n", +-- +2.39.2 + diff --git a/queue-6.1/iommu-virtio-detach-domain-on-endpoint-release.patch b/queue-6.1/iommu-virtio-detach-domain-on-endpoint-release.patch new file mode 100644 index 00000000000..bbd9aeb24ac --- /dev/null +++ b/queue-6.1/iommu-virtio-detach-domain-on-endpoint-release.patch @@ -0,0 +1,70 @@ +From a5bdd8e3708421e74a7b09cd107f0533796a6344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 12:39:48 +0100 +Subject: iommu/virtio: Detach domain on endpoint release + +From: Jean-Philippe Brucker + +[ Upstream commit 809d0810e3520da669d231303608cdf5fe5c1a70 ] + +When an endpoint is released, for example a PCIe VF being destroyed or a +function hot-unplugged, it should be detached from its domain. Send a +DETACH request. + +Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver") +Reported-by: Akihiko Odaki +Link: https://lore.kernel.org/all/15bf1b00-3aa0-973a-3a86-3fa5c4d41d2c@daynix.com/ +Signed-off-by: Jean-Philippe Brucker +Tested-by: Akihiko Odaki +Link: https://lore.kernel.org/r/20230515113946.1017624-2-jean-philippe@linaro.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/virtio-iommu.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c +index 8b1b5c270e502..fe02ac772b651 100644 +--- a/drivers/iommu/virtio-iommu.c ++++ b/drivers/iommu/virtio-iommu.c +@@ -789,6 +789,29 @@ static int viommu_attach_dev(struct iommu_domain *domain, struct device *dev) + return 0; + } + ++static void viommu_detach_dev(struct viommu_endpoint *vdev) ++{ ++ int i; ++ struct virtio_iommu_req_detach req; ++ struct viommu_domain *vdomain = vdev->vdomain; ++ struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(vdev->dev); ++ ++ if (!vdomain) ++ return; ++ ++ req = (struct virtio_iommu_req_detach) { ++ .head.type = VIRTIO_IOMMU_T_DETACH, ++ .domain = cpu_to_le32(vdomain->id), ++ }; ++ ++ for (i = 0; i < fwspec->num_ids; i++) { ++ req.endpoint = cpu_to_le32(fwspec->ids[i]); ++ WARN_ON(viommu_send_req_sync(vdev->viommu, &req, sizeof(req))); ++ } ++ vdomain->nr_endpoints--; ++ vdev->vdomain = NULL; ++} ++ + static int viommu_map_pages(struct iommu_domain *domain, unsigned long iova, + phys_addr_t paddr, size_t pgsize, size_t pgcount, + int prot, gfp_t gfp, size_t *mapped) +@@ -991,6 +1014,7 @@ static void viommu_release_device(struct device *dev) + { + struct viommu_endpoint *vdev = dev_iommu_priv_get(dev); + ++ viommu_detach_dev(vdev); + iommu_put_resv_regions(dev, &vdev->resv_regions); + kfree(vdev); + } +-- +2.39.2 + diff --git a/queue-6.1/iommu-virtio-return-size-mapped-for-a-detached-domai.patch b/queue-6.1/iommu-virtio-return-size-mapped-for-a-detached-domai.patch new file mode 100644 index 00000000000..40a948f14ea --- /dev/null +++ b/queue-6.1/iommu-virtio-return-size-mapped-for-a-detached-domai.patch @@ -0,0 +1,75 @@ +From 911c6aa4a7df241884963c0861be4866caac935f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 12:39:50 +0100 +Subject: iommu/virtio: Return size mapped for a detached domain + +From: Jean-Philippe Brucker + +[ Upstream commit 7061b6af34686e7e2364b7240cfb061293218f2d ] + +When map() is called on a detached domain, the domain does not exist in +the device so we do not send a MAP request, but we do update the +internal mapping tree, to be replayed on the next attach. Since this +constitutes a successful iommu_map() call, return *mapped in this case +too. + +Fixes: 7e62edd7a33a ("iommu/virtio: Add map/unmap_pages() callbacks implementation") +Signed-off-by: Jean-Philippe Brucker +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/20230515113946.1017624-3-jean-philippe@linaro.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/virtio-iommu.c | 33 +++++++++++++++++---------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c +index fe02ac772b651..fd86ccb709ec5 100644 +--- a/drivers/iommu/virtio-iommu.c ++++ b/drivers/iommu/virtio-iommu.c +@@ -834,25 +834,26 @@ static int viommu_map_pages(struct iommu_domain *domain, unsigned long iova, + if (ret) + return ret; + +- map = (struct virtio_iommu_req_map) { +- .head.type = VIRTIO_IOMMU_T_MAP, +- .domain = cpu_to_le32(vdomain->id), +- .virt_start = cpu_to_le64(iova), +- .phys_start = cpu_to_le64(paddr), +- .virt_end = cpu_to_le64(end), +- .flags = cpu_to_le32(flags), +- }; +- +- if (!vdomain->nr_endpoints) +- return 0; ++ if (vdomain->nr_endpoints) { ++ map = (struct virtio_iommu_req_map) { ++ .head.type = VIRTIO_IOMMU_T_MAP, ++ .domain = cpu_to_le32(vdomain->id), ++ .virt_start = cpu_to_le64(iova), ++ .phys_start = cpu_to_le64(paddr), ++ .virt_end = cpu_to_le64(end), ++ .flags = cpu_to_le32(flags), ++ }; + +- ret = viommu_send_req_sync(vdomain->viommu, &map, sizeof(map)); +- if (ret) +- viommu_del_mappings(vdomain, iova, end); +- else if (mapped) ++ ret = viommu_send_req_sync(vdomain->viommu, &map, sizeof(map)); ++ if (ret) { ++ viommu_del_mappings(vdomain, iova, end); ++ return ret; ++ } ++ } ++ if (mapped) + *mapped = size; + +- return ret; ++ return 0; + } + + static size_t viommu_unmap_pages(struct iommu_domain *domain, unsigned long iova, +-- +2.39.2 + diff --git a/queue-6.1/ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch b/queue-6.1/ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch new file mode 100644 index 00000000000..46cec2df7f5 --- /dev/null +++ b/queue-6.1/ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch @@ -0,0 +1,66 @@ +From d0e3663ce1cde94a4c9c7a5b48a36cad6ca70c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 17:33:47 +0800 +Subject: ipvlan: Fix return value of ipvlan_queue_xmit() + +From: Cambda Zhu + +[ Upstream commit 8a9922e7be6d042fa00f894c376473b17a162b66 ] + +ipvlan_queue_xmit() should return NET_XMIT_XXX, but +ipvlan_xmit_mode_l2/l3() returns rx_handler_result_t or NET_RX_XXX +in some cases. ipvlan_rcv_frame() will only return RX_HANDLER_CONSUMED +in ipvlan_xmit_mode_l2/l3() because 'local' is true. It's equal to +NET_XMIT_SUCCESS. But dev_forward_skb() can return NET_RX_SUCCESS or +NET_RX_DROP, and returning NET_RX_DROP(NET_XMIT_DROP) will increase +both ipvlan and ipvlan->phy_dev drops counter. + +The skb to forward can be treated as xmitted successfully. This patch +makes ipvlan_queue_xmit() return NET_XMIT_SUCCESS for forward skb. + +Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") +Signed-off-by: Cambda Zhu +Link: https://lore.kernel.org/r/20230626093347.7492-1-cambda@linux.alibaba.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ipvlan/ipvlan_core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 2de3bd3b0c278..59e29e08398a0 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -585,7 +585,8 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev) + consume_skb(skb); + return NET_XMIT_DROP; + } +- return ipvlan_rcv_frame(addr, &skb, true); ++ ipvlan_rcv_frame(addr, &skb, true); ++ return NET_XMIT_SUCCESS; + } + } + out: +@@ -611,7 +612,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + consume_skb(skb); + return NET_XMIT_DROP; + } +- return ipvlan_rcv_frame(addr, &skb, true); ++ ipvlan_rcv_frame(addr, &skb, true); ++ return NET_XMIT_SUCCESS; + } + } + skb = skb_share_check(skb, GFP_ATOMIC); +@@ -623,7 +625,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + * the skb for the main-dev. At the RX side we just return + * RX_PASS for it to be processed further on the stack. + */ +- return dev_forward_skb(ipvlan->phy_dev, skb); ++ dev_forward_skb(ipvlan->phy_dev, skb); ++ return NET_XMIT_SUCCESS; + + } else if (is_multicast_ether_addr(eth->h_dest)) { + skb_reset_mac_header(skb); +-- +2.39.2 + diff --git a/queue-6.1/irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch b/queue-6.1/irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch new file mode 100644 index 00000000000..611377b2dc3 --- /dev/null +++ b/queue-6.1/irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch @@ -0,0 +1,53 @@ +From a63082d3f485e71655242aabf3f0be74c0bc503c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 18:33:42 +0200 +Subject: irqchip/jcore-aic: Fix missing allocation of IRQ descriptors + +From: John Paul Adrian Glaubitz + +[ Upstream commit 4848229494a323eeaab62eee5574ef9f7de80374 ] + +The initialization function for the J-Core AIC aic_irq_of_init() is +currently missing the call to irq_alloc_descs() which allocates and +initializes all the IRQ descriptors. Add missing function call and +return the error code from irq_alloc_descs() in case the allocation +fails. + +Fixes: 981b58f66cfc ("irqchip/jcore-aic: Add J-Core AIC driver") +Signed-off-by: John Paul Adrian Glaubitz +Tested-by: Rob Landley +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230510163343.43090-1-glaubitz@physik.fu-berlin.de +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-jcore-aic.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c +index 5f47d8ee4ae39..b9dcc8e78c750 100644 +--- a/drivers/irqchip/irq-jcore-aic.c ++++ b/drivers/irqchip/irq-jcore-aic.c +@@ -68,6 +68,7 @@ static int __init aic_irq_of_init(struct device_node *node, + unsigned min_irq = JCORE_AIC2_MIN_HWIRQ; + unsigned dom_sz = JCORE_AIC_MAX_HWIRQ+1; + struct irq_domain *domain; ++ int ret; + + pr_info("Initializing J-Core AIC\n"); + +@@ -100,6 +101,12 @@ static int __init aic_irq_of_init(struct device_node *node, + jcore_aic.irq_unmask = noop; + jcore_aic.name = "AIC"; + ++ ret = irq_alloc_descs(-1, min_irq, dom_sz - min_irq, ++ of_node_to_nid(node)); ++ ++ if (ret < 0) ++ return ret; ++ + domain = irq_domain_add_legacy(node, dom_sz - min_irq, min_irq, min_irq, + &jcore_aic_irqdomain_ops, + &jcore_aic); +-- +2.39.2 + diff --git a/queue-6.1/irqchip-stm32-exti-fix-warning-on-initialized-field-.patch b/queue-6.1/irqchip-stm32-exti-fix-warning-on-initialized-field-.patch new file mode 100644 index 00000000000..3725cf7e41d --- /dev/null +++ b/queue-6.1/irqchip-stm32-exti-fix-warning-on-initialized-field-.patch @@ -0,0 +1,62 @@ +From 7e840ee0f7d819afff062441e70afc7ac46236a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 17:56:14 +0200 +Subject: irqchip/stm32-exti: Fix warning on initialized field overwritten + +From: Antonio Borneo + +[ Upstream commit 48f31e496488a25f443c0df52464da446fb1d10c ] + +While compiling with W=1, both gcc and clang complain about a +tricky way to initialize an array by filling it with a non-zero +value and then overrride some of the array elements. +In this case the override is intentional, so just disable the +specific warning for only this part of the code. + +Note: the flag "-Woverride-init" is recognized by both compilers, +but the warning msg from clang reports "-Winitializer-overrides". +The doc of clang clarifies that the two flags are synonyms, so use +here only the flag name common on both compilers. + +Signed-off-by: Antonio Borneo +Fixes: c297493336b7 ("irqchip/stm32-exti: Simplify irq description table") +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230601155614.34490-1-antonio.borneo@foss.st.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-stm32-exti.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c +index 6a3f7498ea8ea..8bbb2b114636c 100644 +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -173,6 +173,16 @@ static struct irq_chip stm32_exti_h_chip_direct; + #define EXTI_INVALID_IRQ U8_MAX + #define STM32MP1_DESC_IRQ_SIZE (ARRAY_SIZE(stm32mp1_exti_banks) * IRQS_PER_BANK) + ++/* ++ * Use some intentionally tricky logic here to initialize the whole array to ++ * EXTI_INVALID_IRQ, but then override certain fields, requiring us to indicate ++ * that we "know" that there are overrides in this structure, and we'll need to ++ * disable that warning from W=1 builds. ++ */ ++__diag_push(); ++__diag_ignore_all("-Woverride-init", ++ "logic to initialize all and then override some is OK"); ++ + static const u8 stm32mp1_desc_irq[] = { + /* default value */ + [0 ... (STM32MP1_DESC_IRQ_SIZE - 1)] = EXTI_INVALID_IRQ, +@@ -266,6 +276,8 @@ static const u8 stm32mp13_desc_irq[] = { + [70] = 98, + }; + ++__diag_pop(); ++ + static const struct stm32_exti_drv_data stm32mp1_drv_data = { + .exti_banks = stm32mp1_exti_banks, + .bank_nr = ARRAY_SIZE(stm32mp1_exti_banks), +-- +2.39.2 + diff --git a/queue-6.1/kbuild-disable-gcov-for-.mod.o.patch b/queue-6.1/kbuild-disable-gcov-for-.mod.o.patch new file mode 100644 index 00000000000..49441f9aa92 --- /dev/null +++ b/queue-6.1/kbuild-disable-gcov-for-.mod.o.patch @@ -0,0 +1,50 @@ +From 2c19277d5c9ddf606b3b8610fcc9ca776686dafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 00:11:43 +0000 +Subject: kbuild: Disable GCOV for *.mod.o + +From: Sami Tolvanen + +[ Upstream commit 25a21fbb934a0d989e1858f83c2ddf4cfb2ebe30 ] + +With GCOV_PROFILE_ALL, Clang injects __llvm_gcov_* functions to each +object file, including the *.mod.o. As we filter out CC_FLAGS_CFI +for *.mod.o, the compiler won't generate type hashes for the +injected functions, and therefore indirectly calling them during +module loading trips indirect call checking. + +Enabling CFI for *.mod.o isn't sufficient to fix this issue after +commit 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization"), +as *.mod.o aren't processed by objtool, which means any hashes +emitted there won't be randomized. Therefore, in addition to +disabling CFI for *.mod.o, also disable GCOV, as the object files +don't otherwise contain any executable code. + +Fixes: cf68fffb66d6 ("add support for Clang CFI") +Reported-by: Joe Fradley +Signed-off-by: Sami Tolvanen +Acked-by: Peter Zijlstra (Intel) +Reviewed-by: Kees Cook +Reviewed-by: Nick Desaulniers +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/Makefile.modfinal | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal +index 25bedd83644b0..3af5e5807983a 100644 +--- a/scripts/Makefile.modfinal ++++ b/scripts/Makefile.modfinal +@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=)) + part-of-module = y + + quiet_cmd_cc_o_c = CC [M] $@ +- cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI), $(c_flags)) -c -o $@ $< ++ cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $< + + %.mod.o: %.mod.c FORCE + $(call if_changed_dep,cc_o_c) +-- +2.39.2 + diff --git a/queue-6.1/kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch b/queue-6.1/kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch new file mode 100644 index 00000000000..471ff79b83b --- /dev/null +++ b/queue-6.1/kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch @@ -0,0 +1,71 @@ +From 677e43770670e357e50cf7bf639fc64ab13b72ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 17:31:17 +0200 +Subject: kcsan: Don't expect 64 bits atomic builtins from 32 bits + architectures + +From: Christophe Leroy + +[ Upstream commit 353e7300a1db928e427462f2745f9a2cd1625b3d ] + +Activating KCSAN on a 32 bits architecture leads to the following +link-time failure: + + LD .tmp_vmlinux.kallsyms1 + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_load': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_load_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_store': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_store_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_exchange': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_exchange_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_add': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_add_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_sub': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_sub_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_and': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_and_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_or': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_or_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_xor': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_xor_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_nand': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_nand_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_strong': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_weak': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_val': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8' + +32 bits architectures don't have 64 bits atomic builtins. Only +include DEFINE_TSAN_ATOMIC_OPS(64) on 64 bits architectures. + +Fixes: 0f8ad5f2e934 ("kcsan: Add support for atomic builtins") +Suggested-by: Marco Elver +Signed-off-by: Christophe Leroy +Reviewed-by: Marco Elver +Acked-by: Marco Elver +Signed-off-by: Michael Ellerman +Link: https://msgid.link/d9c6afc28d0855240171a4e0ad9ffcdb9d07fceb.1683892665.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + kernel/kcsan/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c +index 5a60cc52adc0c..8a7baf4e332e3 100644 +--- a/kernel/kcsan/core.c ++++ b/kernel/kcsan/core.c +@@ -1270,7 +1270,9 @@ static __always_inline void kcsan_atomic_builtin_memorder(int memorder) + DEFINE_TSAN_ATOMIC_OPS(8); + DEFINE_TSAN_ATOMIC_OPS(16); + DEFINE_TSAN_ATOMIC_OPS(32); ++#ifdef CONFIG_64BIT + DEFINE_TSAN_ATOMIC_OPS(64); ++#endif + + void __tsan_atomic_thread_fence(int memorder); + void __tsan_atomic_thread_fence(int memorder) +-- +2.39.2 + diff --git a/queue-6.1/kexec-fix-a-memory-leak-in-crash_shrink_memory.patch b/queue-6.1/kexec-fix-a-memory-leak-in-crash_shrink_memory.patch new file mode 100644 index 00000000000..ba861d5258c --- /dev/null +++ b/queue-6.1/kexec-fix-a-memory-leak-in-crash_shrink_memory.patch @@ -0,0 +1,93 @@ +From 6b1df7cf428a2121a184b39616c164b299005d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 20:34:34 +0800 +Subject: kexec: fix a memory leak in crash_shrink_memory() + +From: Zhen Lei + +[ Upstream commit 1cba6c4309f03de570202c46f03df3f73a0d4c82 ] + +Patch series "kexec: enable kexec_crash_size to support two crash kernel +regions". + +When crashkernel=X fails to reserve region under 4G, it will fall back to +reserve region above 4G and a region of the default size will also be +reserved under 4G. Unfortunately, /sys/kernel/kexec_crash_size only +supports one crash kernel region now, the user cannot sense the low memory +reserved by reading /sys/kernel/kexec_crash_size. Also, low memory cannot +be freed by writing this file. + +For example: +resource_size(crashk_res) = 512M +resource_size(crashk_low_res) = 256M + +The result of 'cat /sys/kernel/kexec_crash_size' is 512M, but it should be +768M. When we execute 'echo 0 > /sys/kernel/kexec_crash_size', the size +of crashk_res becomes 0 and resource_size(crashk_low_res) is still 256 MB, +which is incorrect. + +Since crashk_res manages the memory with high address and crashk_low_res +manages the memory with low address, crashk_low_res is shrunken only when +all crashk_res is shrunken. And because when there is only one crash +kernel region, crashk_res is always used. Therefore, if all crashk_res is +shrunken and crashk_low_res still exists, swap them. + +This patch (of 6): + +If the value of parameter 'new_size' is in the semi-open and semi-closed +interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the +calculation result of ram_res is: + + ram_res->start = crashk_res.end + 1 + ram_res->end = crashk_res.end + +The operation of insert_resource() fails, and ram_res is not added to +iomem_resource. As a result, the memory of the control block ram_res is +leaked. + +In fact, on all architectures, the start address and size of crashk_res +are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need +to round up crashk_res.start again. Instead, we should round up +'new_size' in advance. + +Link: https://lkml.kernel.org/r/20230527123439.772-1-thunder.leizhen@huawei.com +Link: https://lkml.kernel.org/r/20230527123439.772-2-thunder.leizhen@huawei.com +Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()") +Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size") +Signed-off-by: Zhen Lei +Acked-by: Baoquan He +Cc: Cong Wang +Cc: Eric W. Biederman +Cc: Michael Holzheu +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/kexec_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c +index ca2743f9c634e..79c012fbb49c8 100644 +--- a/kernel/kexec_core.c ++++ b/kernel/kexec_core.c +@@ -1035,6 +1035,7 @@ int crash_shrink_memory(unsigned long new_size) + start = crashk_res.start; + end = crashk_res.end; + old_size = (end == 0) ? 0 : end - start + 1; ++ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN); + if (new_size >= old_size) { + ret = (new_size == old_size) ? 0 : -EINVAL; + goto unlock; +@@ -1046,9 +1047,7 @@ int crash_shrink_memory(unsigned long new_size) + goto unlock; + } + +- start = roundup(start, KEXEC_CRASH_MEM_ALIGN); +- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN); +- ++ end = start + new_size; + crash_free_reserved_phys_range(end, crashk_res.end); + + if ((start == end) && (crashk_res.parent != NULL)) +-- +2.39.2 + diff --git a/queue-6.1/kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch b/queue-6.1/kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch new file mode 100644 index 00000000000..3b54512ce4b --- /dev/null +++ b/queue-6.1/kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch @@ -0,0 +1,46 @@ +From 19360243dd89e7019e791f5cfed71a16256a56b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 11:47:43 +0100 +Subject: kselftest: vDSO: Fix accumulation of uninitialized ret when + CLOCK_REALTIME is undefined + +From: Colin Ian King + +[ Upstream commit 375b9ff53cb6f9c042817b75f2be0a650626dc4f ] + +In the unlikely case that CLOCK_REALTIME is not defined, variable ret is +not initialized and further accumulation of return values to ret can leave +ret in an undefined state. Fix this by initialized ret to zero and changing +the assignment of ret to an accumulation for the CLOCK_REALTIME case. + +Fixes: 03f55c7952c9 ("kselftest: Extend vDSO selftest to clock_getres") +Signed-off-by: Colin Ian King +Reviewed-by: Vincenzo Frascino +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_test_clock_getres.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c +index 15dcee16ff726..38d46a8bf7cba 100644 +--- a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c ++++ b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c +@@ -84,12 +84,12 @@ static inline int vdso_test_clock(unsigned int clock_id) + + int main(int argc, char **argv) + { +- int ret; ++ int ret = 0; + + #if _POSIX_TIMERS > 0 + + #ifdef CLOCK_REALTIME +- ret = vdso_test_clock(CLOCK_REALTIME); ++ ret += vdso_test_clock(CLOCK_REALTIME); + #endif + + #ifdef CLOCK_BOOTTIME +-- +2.39.2 + diff --git a/queue-6.1/ksmbd-avoid-field-overflow-warning.patch b/queue-6.1/ksmbd-avoid-field-overflow-warning.patch new file mode 100644 index 00000000000..340a631e0ef --- /dev/null +++ b/queue-6.1/ksmbd-avoid-field-overflow-warning.patch @@ -0,0 +1,47 @@ +From 5f6cd72e492d443ffeea0fd6a327a1b19f625da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 10:19:38 +0200 +Subject: ksmbd: avoid field overflow warning + +From: Arnd Bergmann + +[ Upstream commit 9cedc58bdbe9fff9aacd0ca19ee5777659f28fd7 ] + +clang warns about a possible field overflow in a memcpy: + +In file included from fs/smb/server/smb_common.c:7: +include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] + __write_overflow_field(p_size_field, size); + +It appears to interpret the "&out[baselen + 4]" as referring to a single +byte of the character array, while the equivalen "out + baselen + 4" is +seen as an offset into the array. + +I don't see that kind of warning elsewhere, so just go with the simple +rework. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Signed-off-by: Arnd Bergmann +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 05d7f3e910bf4..d937e2f45c829 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -536,7 +536,7 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname, + out[baselen + 3] = PERIOD; + + if (dot_present) +- memcpy(&out[baselen + 4], extension, 4); ++ memcpy(out + baselen + 4, extension, 4); + else + out[baselen + 4] = '\0'; + smbConvertToUTF16((__le16 *)shortname, out, PATH_MAX, +-- +2.39.2 + diff --git a/queue-6.1/lib-ts_bm-reset-initial-match-offset-for-every-block.patch b/queue-6.1/lib-ts_bm-reset-initial-match-offset-for-every-block.patch new file mode 100644 index 00000000000..26d5c242b54 --- /dev/null +++ b/queue-6.1/lib-ts_bm-reset-initial-match-offset-for-every-block.patch @@ -0,0 +1,59 @@ +From 375781f3d010a4f3e65df5a7610a0b526c161b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 20:06:57 +0100 +Subject: lib/ts_bm: reset initial match offset for every block of text + +From: Jeremy Sowden + +[ Upstream commit 6f67fbf8192da80c4db01a1800c7fceaca9cf1f9 ] + +The `shift` variable which indicates the offset in the string at which +to start matching the pattern is initialized to `bm->patlen - 1`, but it +is not reset when a new block is retrieved. This means the implemen- +tation may start looking at later and later positions in each successive +block and miss occurrences of the pattern at the beginning. E.g., +consider a HTTP packet held in a non-linear skb, where the HTTP request +line occurs in the second block: + + [... 52 bytes of packet headers ...] + GET /bmtest HTTP/1.1\r\nHost: www.example.com\r\n\r\n + +and the pattern is "GET /bmtest". + +Once the first block comprising the packet headers has been examined, +`shift` will be pointing to somewhere near the end of the block, and so +when the second block is examined the request line at the beginning will +be missed. + +Reinitialize the variable for each new block. + +Fixes: 8082e4ed0a61 ("[LIB]: Boyer-Moore extension for textsearch infrastructure strike #2") +Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 +Signed-off-by: Jeremy Sowden +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + lib/ts_bm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/ts_bm.c b/lib/ts_bm.c +index 1f2234221dd11..c8ecbf74ef295 100644 +--- a/lib/ts_bm.c ++++ b/lib/ts_bm.c +@@ -60,10 +60,12 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state) + struct ts_bm *bm = ts_config_priv(conf); + unsigned int i, text_len, consumed = state->offset; + const u8 *text; +- int shift = bm->patlen - 1, bs; ++ int bs; + const u8 icase = conf->flags & TS_IGNORECASE; + + for (;;) { ++ int shift = bm->patlen - 1; ++ + text_len = conf->get_next_block(consumed, &text, conf, state); + + if (unlikely(text_len == 0)) +-- +2.39.2 + diff --git a/queue-6.1/libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch b/queue-6.1/libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch new file mode 100644 index 00000000000..9d9c85291cf --- /dev/null +++ b/queue-6.1/libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch @@ -0,0 +1,120 @@ +From 3ec4b068fc4ec36a90cda33cc90c911b1ca93dc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 18:36:38 -0700 +Subject: libbpf: btf_dump_type_data_check_overflow needs to consider + BTF_MEMBER_BITFIELD_SIZE + +From: Martin KaFai Lau + +[ Upstream commit c39028b333f3a3a765c5c0b9726b8e38aedf0ba1 ] + +The btf_dump/struct_data selftest is failing with: + + [...] + test_btf_dump_struct_data:FAIL:unexpected return value dumping fs_context unexpected unexpected return value dumping fs_context: actual -7 != expected 264 + [...] + +The reason is in btf_dump_type_data_check_overflow(). It does not use +BTF_MEMBER_BITFIELD_SIZE from the struct's member (btf_member). Instead, +it is using the enum size which is 4. It had been working till the recent +commit 4e04143c869c ("fs_context: drop the unused lsm_flags member") +removed an integer member which also removed the 4 bytes padding at the +end of the fs_context. Missing this 4 bytes padding exposed this bug. In +particular, when btf_dump_type_data_check_overflow() reaches the member +'phase', -E2BIG is returned. + +The fix is to pass bit_sz to btf_dump_type_data_check_overflow(). In +btf_dump_type_data_check_overflow(), it does a different size check when +bit_sz is not zero. + +The current fs_context: + +[3600] ENUM 'fs_context_purpose' encoding=UNSIGNED size=4 vlen=3 + 'FS_CONTEXT_FOR_MOUNT' val=0 + 'FS_CONTEXT_FOR_SUBMOUNT' val=1 + 'FS_CONTEXT_FOR_RECONFIGURE' val=2 +[3601] ENUM 'fs_context_phase' encoding=UNSIGNED size=4 vlen=7 + 'FS_CONTEXT_CREATE_PARAMS' val=0 + 'FS_CONTEXT_CREATING' val=1 + 'FS_CONTEXT_AWAITING_MOUNT' val=2 + 'FS_CONTEXT_AWAITING_RECONF' val=3 + 'FS_CONTEXT_RECONF_PARAMS' val=4 + 'FS_CONTEXT_RECONFIGURING' val=5 + 'FS_CONTEXT_FAILED' val=6 +[3602] STRUCT 'fs_context' size=264 vlen=21 + 'ops' type_id=3603 bits_offset=0 + 'uapi_mutex' type_id=235 bits_offset=64 + 'fs_type' type_id=872 bits_offset=1216 + 'fs_private' type_id=21 bits_offset=1280 + 'sget_key' type_id=21 bits_offset=1344 + 'root' type_id=781 bits_offset=1408 + 'user_ns' type_id=251 bits_offset=1472 + 'net_ns' type_id=984 bits_offset=1536 + 'cred' type_id=1785 bits_offset=1600 + 'log' type_id=3621 bits_offset=1664 + 'source' type_id=42 bits_offset=1792 + 'security' type_id=21 bits_offset=1856 + 's_fs_info' type_id=21 bits_offset=1920 + 'sb_flags' type_id=20 bits_offset=1984 + 'sb_flags_mask' type_id=20 bits_offset=2016 + 's_iflags' type_id=20 bits_offset=2048 + 'purpose' type_id=3600 bits_offset=2080 bitfield_size=8 + 'phase' type_id=3601 bits_offset=2088 bitfield_size=8 + 'need_free' type_id=67 bits_offset=2096 bitfield_size=1 + 'global' type_id=67 bits_offset=2097 bitfield_size=1 + 'oldapi' type_id=67 bits_offset=2098 bitfield_size=1 + +Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data") +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20230428013638.1581263-1-martin.lau@linux.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index 4cd1d49c94d6d..713264899250a 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -2213,9 +2213,25 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d, + const struct btf_type *t, + __u32 id, + const void *data, +- __u8 bits_offset) ++ __u8 bits_offset, ++ __u8 bit_sz) + { +- __s64 size = btf__resolve_size(d->btf, id); ++ __s64 size; ++ ++ if (bit_sz) { ++ /* bits_offset is at most 7. bit_sz is at most 128. */ ++ __u8 nr_bytes = (bits_offset + bit_sz + 7) / 8; ++ ++ /* When bit_sz is non zero, it is called from ++ * btf_dump_struct_data() where it only cares about ++ * negative error value. ++ * Return nr_bytes in success case to make it ++ * consistent as the regular integer case below. ++ */ ++ return data + nr_bytes > d->typed_dump->data_end ? -E2BIG : nr_bytes; ++ } ++ ++ size = btf__resolve_size(d->btf, id); + + if (size < 0 || size >= INT_MAX) { + pr_warn("unexpected size [%zu] for id [%u]\n", +@@ -2370,7 +2386,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d, + { + int size, err = 0; + +- size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset); ++ size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset, bit_sz); + if (size < 0) + return size; + err = btf_dump_type_data_check_zero(d, t, id, data, bits_offset, bit_sz); +-- +2.39.2 + diff --git a/queue-6.1/libbpf-fix-offsetof-and-container_of-to-work-with-co.patch b/queue-6.1/libbpf-fix-offsetof-and-container_of-to-work-with-co.patch new file mode 100644 index 00000000000..cf2f39c8097 --- /dev/null +++ b/queue-6.1/libbpf-fix-offsetof-and-container_of-to-work-with-co.patch @@ -0,0 +1,62 @@ +From ae3bd5d5e11204b4f65fb88bbdc798424ba630b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 23:55:02 -0700 +Subject: libbpf: fix offsetof() and container_of() to work with CO-RE + +From: Andrii Nakryiko + +[ Upstream commit bdeeed3498c7871c17465bb4f11d1bc67f9098af ] + +It seems like __builtin_offset() doesn't preserve CO-RE field +relocations properly. So if offsetof() macro is defined through +__builtin_offset(), CO-RE-enabled BPF code using container_of() will be +subtly and silently broken. + +To avoid this problem, redefine offsetof() and container_of() in the +form that works with CO-RE relocations more reliably. + +Fixes: 5fbc220862fc ("tools/libpf: Add offsetof/container_of macro in bpf_helpers.h") +Reported-by: Lennart Poettering +Signed-off-by: Andrii Nakryiko +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20230509065502.2306180-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/bpf_helpers.h | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/tools/lib/bpf/bpf_helpers.h b/tools/lib/bpf/bpf_helpers.h +index d37c4fe2849d2..2b3b300bf4dfa 100644 +--- a/tools/lib/bpf/bpf_helpers.h ++++ b/tools/lib/bpf/bpf_helpers.h +@@ -77,16 +77,21 @@ + /* + * Helper macros to manipulate data structures + */ +-#ifndef offsetof +-#define offsetof(TYPE, MEMBER) ((unsigned long)&((TYPE *)0)->MEMBER) +-#endif +-#ifndef container_of ++ ++/* offsetof() definition that uses __builtin_offset() might not preserve field ++ * offset CO-RE relocation properly, so force-redefine offsetof() using ++ * old-school approach which works with CO-RE correctly ++ */ ++#undef offsetof ++#define offsetof(type, member) ((unsigned long)&((type *)0)->member) ++ ++/* redefined container_of() to ensure we use the above offsetof() macro */ ++#undef container_of + #define container_of(ptr, type, member) \ + ({ \ + void *__mptr = (void *)(ptr); \ + ((type *)(__mptr - offsetof(type, member))); \ + }) +-#endif + + /* + * Compiler (optimization) barrier. +-- +2.39.2 + diff --git a/queue-6.1/lockd-drop-inappropriate-svc_get-from-locked_get.patch b/queue-6.1/lockd-drop-inappropriate-svc_get-from-locked_get.patch new file mode 100644 index 00000000000..9f263c0e69b --- /dev/null +++ b/queue-6.1/lockd-drop-inappropriate-svc_get-from-locked_get.patch @@ -0,0 +1,57 @@ +From 7c56d1de5d33094091700a8af15c9bb1da96bed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jun 2023 07:14:14 +1000 +Subject: lockd: drop inappropriate svc_get() from locked_get() + +From: NeilBrown + +[ Upstream commit 665e89ab7c5af1f2d260834c861a74b01a30f95f ] + +The below-mentioned patch was intended to simplify refcounting on the +svc_serv used by locked. The goal was to only ever have a single +reference from the single thread. To that end we dropped a call to +lockd_start_svc() (except when creating thread) which would take a +reference, and dropped the svc_put(serv) that would drop that reference. + +Unfortunately we didn't also remove the svc_get() from +lockd_create_svc() in the case where the svc_serv already existed. +So after the patch: + - on the first call the svc_serv was allocated and the one reference + was given to the thread, so there are no extra references + - on subsequent calls svc_get() was called so there is now an extra + reference. +This is clearly not consistent. + +The inconsistency is also clear in the current code in lockd_get() +takes *two* references, one on nlmsvc_serv and one by incrementing +nlmsvc_users. This clearly does not match lockd_put(). + +So: drop that svc_get() from lockd_get() (which used to be in +lockd_create_svc(). + +Reported-by: Ido Schimmel +Closes: https://lore.kernel.org/linux-nfs/ZHsI%2FH16VX9kJQX1@shredder/T/#u +Fixes: b73a2972041b ("lockd: move lockd_start_svc() call into lockd_create_svc()") +Signed-off-by: NeilBrown +Tested-by: Ido Schimmel +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/svc.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c +index 59ef8a1f843f3..5579e67da17db 100644 +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -355,7 +355,6 @@ static int lockd_get(void) + int error; + + if (nlmsvc_serv) { +- svc_get(nlmsvc_serv); + nlmsvc_users++; + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/locking-atomic-arm-fix-sync-ops.patch b/queue-6.1/locking-atomic-arm-fix-sync-ops.patch new file mode 100644 index 00000000000..62cfb955368 --- /dev/null +++ b/queue-6.1/locking-atomic-arm-fix-sync-ops.patch @@ -0,0 +1,191 @@ +From 9f83b7dd5aade2c47b058776940ecf00ad0309bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 08:00:58 +0100 +Subject: locking/atomic: arm: fix sync ops + +From: Mark Rutland + +[ Upstream commit dda5f312bb09e56e7a1c3e3851f2000eb2e9c879 ] + +The sync_*() ops on arch/arm are defined in terms of the regular bitops +with no special handling. This is not correct, as UP kernels elide +barriers for the fully-ordered operations, and so the required ordering +is lost when such UP kernels are run under a hypervsior on an SMP +system. + +Fix this by defining sync ops with the required barriers. + +Note: On 32-bit arm, the sync_*() ops are currently only used by Xen, +which requires ARMv7, but the semantics can be implemented for ARMv6+. + +Fixes: e54d2f61528165bb ("xen/arm: sync_bitops") +Signed-off-by: Mark Rutland +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20230605070124.3741859-2-mark.rutland@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/assembler.h | 17 +++++++++++++++++ + arch/arm/include/asm/sync_bitops.h | 29 +++++++++++++++++++++++++---- + arch/arm/lib/bitops.h | 14 +++++++++++--- + arch/arm/lib/testchangebit.S | 4 ++++ + arch/arm/lib/testclearbit.S | 4 ++++ + arch/arm/lib/testsetbit.S | 4 ++++ + 6 files changed, 65 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index 90fbe4a3f9c84..84912b19cac85 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -402,6 +402,23 @@ ALT_UP_B(.L0_\@) + #endif + .endm + ++/* ++ * Raw SMP data memory barrier ++ */ ++ .macro __smp_dmb mode ++#if __LINUX_ARM_ARCH__ >= 7 ++ .ifeqs "\mode","arm" ++ dmb ish ++ .else ++ W(dmb) ish ++ .endif ++#elif __LINUX_ARM_ARCH__ == 6 ++ mcr p15, 0, r0, c7, c10, 5 @ dmb ++#else ++ .error "Incompatible SMP platform" ++#endif ++ .endm ++ + #if defined(CONFIG_CPU_V7M) + /* + * setmode is used to assert to be in svc mode during boot. For v7-M +diff --git a/arch/arm/include/asm/sync_bitops.h b/arch/arm/include/asm/sync_bitops.h +index 6f5d627c44a3c..f46b3c570f92e 100644 +--- a/arch/arm/include/asm/sync_bitops.h ++++ b/arch/arm/include/asm/sync_bitops.h +@@ -14,14 +14,35 @@ + * ops which are SMP safe even on a UP kernel. + */ + ++/* ++ * Unordered ++ */ ++ + #define sync_set_bit(nr, p) _set_bit(nr, p) + #define sync_clear_bit(nr, p) _clear_bit(nr, p) + #define sync_change_bit(nr, p) _change_bit(nr, p) +-#define sync_test_and_set_bit(nr, p) _test_and_set_bit(nr, p) +-#define sync_test_and_clear_bit(nr, p) _test_and_clear_bit(nr, p) +-#define sync_test_and_change_bit(nr, p) _test_and_change_bit(nr, p) + #define sync_test_bit(nr, addr) test_bit(nr, addr) +-#define arch_sync_cmpxchg arch_cmpxchg + ++/* ++ * Fully ordered ++ */ ++ ++int _sync_test_and_set_bit(int nr, volatile unsigned long * p); ++#define sync_test_and_set_bit(nr, p) _sync_test_and_set_bit(nr, p) ++ ++int _sync_test_and_clear_bit(int nr, volatile unsigned long * p); ++#define sync_test_and_clear_bit(nr, p) _sync_test_and_clear_bit(nr, p) ++ ++int _sync_test_and_change_bit(int nr, volatile unsigned long * p); ++#define sync_test_and_change_bit(nr, p) _sync_test_and_change_bit(nr, p) ++ ++#define arch_sync_cmpxchg(ptr, old, new) \ ++({ \ ++ __typeof__(*(ptr)) __ret; \ ++ __smp_mb__before_atomic(); \ ++ __ret = arch_cmpxchg_relaxed((ptr), (old), (new)); \ ++ __smp_mb__after_atomic(); \ ++ __ret; \ ++}) + + #endif +diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h +index 95bd359912889..f069d1b2318e6 100644 +--- a/arch/arm/lib/bitops.h ++++ b/arch/arm/lib/bitops.h +@@ -28,7 +28,7 @@ UNWIND( .fnend ) + ENDPROC(\name ) + .endm + +- .macro testop, name, instr, store ++ .macro __testop, name, instr, store, barrier + ENTRY( \name ) + UNWIND( .fnstart ) + ands ip, r1, #3 +@@ -38,7 +38,7 @@ UNWIND( .fnstart ) + mov r0, r0, lsr #5 + add r1, r1, r0, lsl #2 @ Get word offset + mov r3, r2, lsl r3 @ create mask +- smp_dmb ++ \barrier + #if __LINUX_ARM_ARCH__ >= 7 && defined(CONFIG_SMP) + .arch_extension mp + ALT_SMP(W(pldw) [r1]) +@@ -50,13 +50,21 @@ UNWIND( .fnstart ) + strex ip, r2, [r1] + cmp ip, #0 + bne 1b +- smp_dmb ++ \barrier + cmp r0, #0 + movne r0, #1 + 2: bx lr + UNWIND( .fnend ) + ENDPROC(\name ) + .endm ++ ++ .macro testop, name, instr, store ++ __testop \name, \instr, \store, smp_dmb ++ .endm ++ ++ .macro sync_testop, name, instr, store ++ __testop \name, \instr, \store, __smp_dmb ++ .endm + #else + .macro bitop, name, instr + ENTRY( \name ) +diff --git a/arch/arm/lib/testchangebit.S b/arch/arm/lib/testchangebit.S +index 4ebecc67e6e04..f13fe9bc2399a 100644 +--- a/arch/arm/lib/testchangebit.S ++++ b/arch/arm/lib/testchangebit.S +@@ -10,3 +10,7 @@ + .text + + testop _test_and_change_bit, eor, str ++ ++#if __LINUX_ARM_ARCH__ >= 6 ++sync_testop _sync_test_and_change_bit, eor, str ++#endif +diff --git a/arch/arm/lib/testclearbit.S b/arch/arm/lib/testclearbit.S +index 009afa0f5b4a7..4d2c5ca620ebf 100644 +--- a/arch/arm/lib/testclearbit.S ++++ b/arch/arm/lib/testclearbit.S +@@ -10,3 +10,7 @@ + .text + + testop _test_and_clear_bit, bicne, strne ++ ++#if __LINUX_ARM_ARCH__ >= 6 ++sync_testop _sync_test_and_clear_bit, bicne, strne ++#endif +diff --git a/arch/arm/lib/testsetbit.S b/arch/arm/lib/testsetbit.S +index f3192e55acc87..649dbab65d8d0 100644 +--- a/arch/arm/lib/testsetbit.S ++++ b/arch/arm/lib/testsetbit.S +@@ -10,3 +10,7 @@ + .text + + testop _test_and_set_bit, orreq, streq ++ ++#if __LINUX_ARM_ARCH__ >= 6 ++sync_testop _sync_test_and_set_bit, orreq, streq ++#endif +-- +2.39.2 + diff --git a/queue-6.1/md-raid1-10-factor-out-a-helper-to-add-bio-to-plug.patch b/queue-6.1/md-raid1-10-factor-out-a-helper-to-add-bio-to-plug.patch new file mode 100644 index 00000000000..f39b7827f94 --- /dev/null +++ b/queue-6.1/md-raid1-10-factor-out-a-helper-to-add-bio-to-plug.patch @@ -0,0 +1,109 @@ +From 2e44b94246aa2272ea30075ecbbe5b86d58b9b77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 21:11:01 +0800 +Subject: md/raid1-10: factor out a helper to add bio to plug + +From: Yu Kuai + +[ Upstream commit 5ec6ca140a034682e421e2e808ef5ddfdfd65242 ] + +The code in raid1 and raid10 is identical, prepare to limit the number +of plugged bios. + +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230529131106.2123367-3-yukuai1@huaweicloud.com +Stable-dep-of: 7db922bae3ab ("md/raid1-10: submit write io directly if bitmap is not enabled") +Signed-off-by: Sasha Levin +--- + drivers/md/raid1-10.c | 16 ++++++++++++++++ + drivers/md/raid1.c | 12 +----------- + drivers/md/raid10.c | 11 +---------- + 3 files changed, 18 insertions(+), 21 deletions(-) + +diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c +index e61f6cad4e08e..9bf19a3409cef 100644 +--- a/drivers/md/raid1-10.c ++++ b/drivers/md/raid1-10.c +@@ -109,3 +109,19 @@ static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp, + size -= len; + } while (idx++ < RESYNC_PAGES && size > 0); + } ++ ++static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio, ++ blk_plug_cb_fn unplug) ++{ ++ struct raid1_plug_cb *plug = NULL; ++ struct blk_plug_cb *cb = blk_check_plugged(unplug, mddev, ++ sizeof(*plug)); ++ ++ if (!cb) ++ return false; ++ ++ plug = container_of(cb, struct raid1_plug_cb, cb); ++ bio_list_add(&plug->pending, bio); ++ ++ return true; ++} +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 58f705f429480..f3f2078d69e77 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1343,8 +1343,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + struct bitmap *bitmap = mddev->bitmap; + unsigned long flags; + struct md_rdev *blocked_rdev; +- struct blk_plug_cb *cb; +- struct raid1_plug_cb *plug = NULL; + int first_clone; + int max_sectors; + bool write_behind = false; +@@ -1573,15 +1571,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + r1_bio->sector); + /* flush_pending_writes() needs access to the rdev so...*/ + mbio->bi_bdev = (void *)rdev; +- +- cb = blk_check_plugged(raid1_unplug, mddev, sizeof(*plug)); +- if (cb) +- plug = container_of(cb, struct raid1_plug_cb, cb); +- else +- plug = NULL; +- if (plug) { +- bio_list_add(&plug->pending, mbio); +- } else { ++ if (!raid1_add_bio_to_plug(mddev, mbio, raid1_unplug)) { + spin_lock_irqsave(&conf->device_lock, flags); + bio_list_add(&conf->pending_bio_list, mbio); + spin_unlock_irqrestore(&conf->device_lock, flags); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 386c16c398269..14001cceb6186 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1288,8 +1288,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, + const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; + const blk_opf_t do_fua = bio->bi_opf & REQ_FUA; + unsigned long flags; +- struct blk_plug_cb *cb; +- struct raid1_plug_cb *plug = NULL; + struct r10conf *conf = mddev->private; + struct md_rdev *rdev; + int devnum = r10_bio->devs[n_copy].devnum; +@@ -1329,14 +1327,7 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, + + atomic_inc(&r10_bio->remaining); + +- cb = blk_check_plugged(raid10_unplug, mddev, sizeof(*plug)); +- if (cb) +- plug = container_of(cb, struct raid1_plug_cb, cb); +- else +- plug = NULL; +- if (plug) { +- bio_list_add(&plug->pending, mbio); +- } else { ++ if (!raid1_add_bio_to_plug(mddev, mbio, raid10_unplug)) { + spin_lock_irqsave(&conf->device_lock, flags); + bio_list_add(&conf->pending_bio_list, mbio); + spin_unlock_irqrestore(&conf->device_lock, flags); +-- +2.39.2 + diff --git a/queue-6.1/md-raid1-10-factor-out-a-helper-to-submit-normal-wri.patch b/queue-6.1/md-raid1-10-factor-out-a-helper-to-submit-normal-wri.patch new file mode 100644 index 00000000000..0700f052f51 --- /dev/null +++ b/queue-6.1/md-raid1-10-factor-out-a-helper-to-submit-normal-wri.patch @@ -0,0 +1,123 @@ +From 38bed6664d0c4d6a21e0d3fcd7ce027c380f95d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 21:11:02 +0800 +Subject: md/raid1-10: factor out a helper to submit normal write + +From: Yu Kuai + +[ Upstream commit 8295efbe68c080047e98d9c0eb5cb933b238a8cb ] + +There are multiple places to do the same thing, factor out a helper to +prevent redundant code, and the helper will be used in following patch +as well. + +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230529131106.2123367-4-yukuai1@huaweicloud.com +Stable-dep-of: 7db922bae3ab ("md/raid1-10: submit write io directly if bitmap is not enabled") +Signed-off-by: Sasha Levin +--- + drivers/md/raid1-10.c | 17 +++++++++++++++++ + drivers/md/raid1.c | 13 ++----------- + drivers/md/raid10.c | 26 ++++---------------------- + 3 files changed, 23 insertions(+), 33 deletions(-) + +diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c +index 9bf19a3409cef..506299bd55cb6 100644 +--- a/drivers/md/raid1-10.c ++++ b/drivers/md/raid1-10.c +@@ -110,6 +110,23 @@ static void md_bio_reset_resync_pages(struct bio *bio, struct resync_pages *rp, + } while (idx++ < RESYNC_PAGES && size > 0); + } + ++ ++static inline void raid1_submit_write(struct bio *bio) ++{ ++ struct md_rdev *rdev = (struct md_rdev *)bio->bi_bdev; ++ ++ bio->bi_next = NULL; ++ bio_set_dev(bio, rdev->bdev); ++ if (test_bit(Faulty, &rdev->flags)) ++ bio_io_error(bio); ++ else if (unlikely(bio_op(bio) == REQ_OP_DISCARD && ++ !bdev_max_discard_sectors(bio->bi_bdev))) ++ /* Just ignore it */ ++ bio_endio(bio); ++ else ++ submit_bio_noacct(bio); ++} ++ + static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio, + blk_plug_cb_fn unplug) + { +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index f3f2078d69e77..ac64c587191b9 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -799,17 +799,8 @@ static void flush_bio_list(struct r1conf *conf, struct bio *bio) + + while (bio) { /* submit pending writes */ + struct bio *next = bio->bi_next; +- struct md_rdev *rdev = (void *)bio->bi_bdev; +- bio->bi_next = NULL; +- bio_set_dev(bio, rdev->bdev); +- if (test_bit(Faulty, &rdev->flags)) { +- bio_io_error(bio); +- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) && +- !bdev_max_discard_sectors(bio->bi_bdev))) +- /* Just ignore it */ +- bio_endio(bio); +- else +- submit_bio_noacct(bio); ++ ++ raid1_submit_write(bio); + bio = next; + cond_resched(); + } +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 14001cceb6186..ea6228ff3bb5e 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -917,17 +917,8 @@ static void flush_pending_writes(struct r10conf *conf) + + while (bio) { /* submit pending writes */ + struct bio *next = bio->bi_next; +- struct md_rdev *rdev = (void*)bio->bi_bdev; +- bio->bi_next = NULL; +- bio_set_dev(bio, rdev->bdev); +- if (test_bit(Faulty, &rdev->flags)) { +- bio_io_error(bio); +- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) && +- !bdev_max_discard_sectors(bio->bi_bdev))) +- /* Just ignore it */ +- bio_endio(bio); +- else +- submit_bio_noacct(bio); ++ ++ raid1_submit_write(bio); + bio = next; + } + blk_finish_plug(&plug); +@@ -1136,17 +1127,8 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule) + + while (bio) { /* submit pending writes */ + struct bio *next = bio->bi_next; +- struct md_rdev *rdev = (void*)bio->bi_bdev; +- bio->bi_next = NULL; +- bio_set_dev(bio, rdev->bdev); +- if (test_bit(Faulty, &rdev->flags)) { +- bio_io_error(bio); +- } else if (unlikely((bio_op(bio) == REQ_OP_DISCARD) && +- !bdev_max_discard_sectors(bio->bi_bdev))) +- /* Just ignore it */ +- bio_endio(bio); +- else +- submit_bio_noacct(bio); ++ ++ raid1_submit_write(bio); + bio = next; + } + kfree(plug); +-- +2.39.2 + diff --git a/queue-6.1/md-raid1-10-submit-write-io-directly-if-bitmap-is-no.patch b/queue-6.1/md-raid1-10-submit-write-io-directly-if-bitmap-is-no.patch new file mode 100644 index 00000000000..c07885cbf61 --- /dev/null +++ b/queue-6.1/md-raid1-10-submit-write-io-directly-if-bitmap-is-no.patch @@ -0,0 +1,97 @@ +From 1b1c497acf4212539a351bf90f908f99d5bae1c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 21:11:03 +0800 +Subject: md/raid1-10: submit write io directly if bitmap is not enabled + +From: Yu Kuai + +[ Upstream commit 7db922bae3abdf0a1db81ef7228cc0b996a0c1e3 ] + +Commit 6cce3b23f6f8 ("[PATCH] md: write intent bitmap support for raid10") +add bitmap support, and it changed that write io is submitted through +daemon thread because bitmap need to be updated before write io. And +later, plug is used to fix performance regression because all the write io +will go to demon thread, which means io can't be issued concurrently. + +However, if bitmap is not enabled, the write io should not go to daemon +thread in the first place, and plug is not needed as well. + +Fixes: 6cce3b23f6f8 ("[PATCH] md: write intent bitmap support for raid10") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230529131106.2123367-5-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 4 +--- + drivers/md/md-bitmap.h | 7 +++++++ + drivers/md/raid1-10.c | 13 +++++++++++-- + 3 files changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 9640741e8d369..8bbeeec70905c 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -993,7 +993,6 @@ static int md_bitmap_file_test_bit(struct bitmap *bitmap, sector_t block) + return set; + } + +- + /* this gets called when the md device is ready to unplug its underlying + * (slave) device queues -- before we let any writes go down, we need to + * sync the dirty pages of the bitmap file to disk */ +@@ -1003,8 +1002,7 @@ void md_bitmap_unplug(struct bitmap *bitmap) + int dirty, need_write; + int writing = 0; + +- if (!bitmap || !bitmap->storage.filemap || +- test_bit(BITMAP_STALE, &bitmap->flags)) ++ if (!md_bitmap_enabled(bitmap)) + return; + + /* look at each page to see if there are any set bits that need to be +diff --git a/drivers/md/md-bitmap.h b/drivers/md/md-bitmap.h +index cfd7395de8fd3..3a4750952b3a7 100644 +--- a/drivers/md/md-bitmap.h ++++ b/drivers/md/md-bitmap.h +@@ -273,6 +273,13 @@ int md_bitmap_copy_from_slot(struct mddev *mddev, int slot, + sector_t *lo, sector_t *hi, bool clear_bits); + void md_bitmap_free(struct bitmap *bitmap); + void md_bitmap_wait_behind_writes(struct mddev *mddev); ++ ++static inline bool md_bitmap_enabled(struct bitmap *bitmap) ++{ ++ return bitmap && bitmap->storage.filemap && ++ !test_bit(BITMAP_STALE, &bitmap->flags); ++} ++ + #endif + + #endif +diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c +index 506299bd55cb6..73cc3cb9154d8 100644 +--- a/drivers/md/raid1-10.c ++++ b/drivers/md/raid1-10.c +@@ -131,9 +131,18 @@ static inline bool raid1_add_bio_to_plug(struct mddev *mddev, struct bio *bio, + blk_plug_cb_fn unplug) + { + struct raid1_plug_cb *plug = NULL; +- struct blk_plug_cb *cb = blk_check_plugged(unplug, mddev, +- sizeof(*plug)); ++ struct blk_plug_cb *cb; ++ ++ /* ++ * If bitmap is not enabled, it's safe to submit the io directly, and ++ * this can get optimal performance. ++ */ ++ if (!md_bitmap_enabled(mddev->bitmap)) { ++ raid1_submit_write(bio); ++ return true; ++ } + ++ cb = blk_check_plugged(unplug, mddev, sizeof(*plug)); + if (!cb) + return false; + +-- +2.39.2 + diff --git a/queue-6.1/md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch b/queue-6.1/md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch new file mode 100644 index 00000000000..94e3ad69e0a --- /dev/null +++ b/queue-6.1/md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch @@ -0,0 +1,65 @@ +From d6b477420b1b9f106a17daeb8e0df5e90cb6487b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 21:48:05 +0800 +Subject: md/raid10: check slab-out-of-bounds in md_bitmap_get_counter + +From: Li Nan + +[ Upstream commit 301867b1c16805aebbc306aafa6ecdc68b73c7e5 ] + +If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage() +will return -EINVAL because 'page >= bitmap->pages', but the return value +was not checked immediately in md_bitmap_get_counter() in order to set +*blocks value and slab-out-of-bounds occurs. + +Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and +return directly if true. + +Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230515134808.3936750-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index e7cc6ba1b657f..9640741e8d369 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -54,14 +54,7 @@ __acquires(bitmap->lock) + { + unsigned char *mappage; + +- if (page >= bitmap->pages) { +- /* This can happen if bitmap_start_sync goes beyond +- * End-of-device while looking for a whole page. +- * It is harmless. +- */ +- return -EINVAL; +- } +- ++ WARN_ON_ONCE(page >= bitmap->pages); + if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */ + return 0; + +@@ -1364,6 +1357,14 @@ __acquires(bitmap->lock) + sector_t csize; + int err; + ++ if (page >= bitmap->pages) { ++ /* ++ * This can happen if bitmap_start_sync goes beyond ++ * End-of-device while looking for a whole page or ++ * user set a huge number to sysfs bitmap_set_bits. ++ */ ++ return NULL; ++ } + err = md_bitmap_checkpage(bitmap, page, create, 0); + + if (bitmap->bp[page].hijacked || +-- +2.39.2 + diff --git a/queue-6.1/md-raid10-fix-io-loss-while-replacement-replace-rdev.patch b/queue-6.1/md-raid10-fix-io-loss-while-replacement-replace-rdev.patch new file mode 100644 index 00000000000..c1e95ced001 --- /dev/null +++ b/queue-6.1/md-raid10-fix-io-loss-while-replacement-replace-rdev.patch @@ -0,0 +1,79 @@ +From a1d1d7ea461c4beacb14bc3c0aba4cc0823e7f11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 17:18:39 +0800 +Subject: md/raid10: fix io loss while replacement replace rdev + +From: Li Nan + +[ Upstream commit 2ae6aaf76912bae53c74b191569d2ab484f24bf3 ] + +When removing a disk with replacement, the replacement will be used to +replace rdev. During this process, there is a brief window in which both +rdev and replacement are read as NULL in raid10_write_request(). This +will result in io not being submitted but it should be. + + //remove //write + raid10_remove_disk raid10_write_request + mirror->rdev = NULL + read rdev -> NULL + mirror->rdev = mirror->replacement + mirror->replacement = NULL + read replacement -> NULL + +Fix it by reading replacement first and rdev later, meanwhile, use smp_mb() +to prevent memory reordering. + +Fixes: 475b0321a4df ("md/raid10: writes should get directed to replacement as well as original.") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230602091839.743798-3-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 0eb2eb83ddb9e..386c16c398269 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -779,8 +779,16 @@ static struct md_rdev *read_balance(struct r10conf *conf, + disk = r10_bio->devs[slot].devnum; + rdev = rcu_dereference(conf->mirrors[disk].replacement); + if (rdev == NULL || test_bit(Faulty, &rdev->flags) || +- r10_bio->devs[slot].addr + sectors > rdev->recovery_offset) ++ r10_bio->devs[slot].addr + sectors > ++ rdev->recovery_offset) { ++ /* ++ * Read replacement first to prevent reading both rdev ++ * and replacement as NULL during replacement replace ++ * rdev. ++ */ ++ smp_mb(); + rdev = rcu_dereference(conf->mirrors[disk].rdev); ++ } + if (rdev == NULL || + test_bit(Faulty, &rdev->flags)) + continue; +@@ -1477,9 +1485,15 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + + for (i = 0; i < conf->copies; i++) { + int d = r10_bio->devs[i].devnum; +- struct md_rdev *rdev = rcu_dereference(conf->mirrors[d].rdev); +- struct md_rdev *rrdev = rcu_dereference( +- conf->mirrors[d].replacement); ++ struct md_rdev *rdev, *rrdev; ++ ++ rrdev = rcu_dereference(conf->mirrors[d].replacement); ++ /* ++ * Read replacement first to prevent reading both rdev and ++ * replacement as NULL during replacement replace rdev. ++ */ ++ smp_mb(); ++ rdev = rcu_dereference(conf->mirrors[d].rdev); + if (rdev == rrdev) + rrdev = NULL; + if (rdev && (test_bit(Faulty, &rdev->flags))) +-- +2.39.2 + diff --git a/queue-6.1/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch b/queue-6.1/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch new file mode 100644 index 00000000000..f8ff68d9044 --- /dev/null +++ b/queue-6.1/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch @@ -0,0 +1,81 @@ +From dc741a7e0e3f40c7ab899861f2e02b5e6505b50d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 15:22:15 +0800 +Subject: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request + +From: Li Nan + +[ Upstream commit 34817a2441747b48e444cb0e05d84e14bc9443da ] + +There are two check of 'mreplace' in raid10_sync_request(). In the first +check, 'need_replace' will be set and 'mreplace' will be used later if +no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be +set to NULL if it is Faulty, but 'need_replace' will not be changed +accordingly. null-ptr-deref occurs if Faulty is set between two check. + +Fix it by merging two checks into one. And replace 'need_replace' with +'mreplace' because their values are always the same. + +Fixes: ee37d7314a32 ("md/raid10: Fix raid10 replace hang when new added disk faulty") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230527072218.2365857-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 67398394cc9c9..0eb2eb83ddb9e 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3436,7 +3436,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + int must_sync; + int any_working; + int need_recover = 0; +- int need_replace = 0; + struct raid10_info *mirror = &conf->mirrors[i]; + struct md_rdev *mrdev, *mreplace; + +@@ -3448,11 +3447,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + !test_bit(Faulty, &mrdev->flags) && + !test_bit(In_sync, &mrdev->flags)) + need_recover = 1; +- if (mreplace != NULL && +- !test_bit(Faulty, &mreplace->flags)) +- need_replace = 1; ++ if (mreplace && test_bit(Faulty, &mreplace->flags)) ++ mreplace = NULL; + +- if (!need_recover && !need_replace) { ++ if (!need_recover && !mreplace) { + rcu_read_unlock(); + continue; + } +@@ -3468,8 +3466,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + rcu_read_unlock(); + continue; + } +- if (mreplace && test_bit(Faulty, &mreplace->flags)) +- mreplace = NULL; + /* Unless we are doing a full sync, or a replacement + * we only need to recover the block if it is set in + * the bitmap +@@ -3592,11 +3588,11 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + bio = r10_bio->devs[1].repl_bio; + if (bio) + bio->bi_end_io = NULL; +- /* Note: if need_replace, then bio ++ /* Note: if replace is not NULL, then bio + * cannot be NULL as r10buf_pool_alloc will + * have allocated it. + */ +- if (!need_replace) ++ if (!mreplace) + break; + bio->bi_next = biolist; + biolist = bio; +-- +2.39.2 + diff --git a/queue-6.1/md-raid10-fix-overflow-of-md-safe_mode_delay.patch b/queue-6.1/md-raid10-fix-overflow-of-md-safe_mode_delay.patch new file mode 100644 index 00000000000..52a06b566c1 --- /dev/null +++ b/queue-6.1/md-raid10-fix-overflow-of-md-safe_mode_delay.patch @@ -0,0 +1,51 @@ +From 548a23eca974abb9b8ee85fcad94e9c5a0c43b4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 15:25:33 +0800 +Subject: md/raid10: fix overflow of md/safe_mode_delay + +From: Li Nan + +[ Upstream commit 6beb489b2eed25978523f379a605073f99240c50 ] + +There is no input check when echo md/safe_mode_delay in safe_delay_store(). +And msec might also overflow when HZ < 1000 in safe_delay_show(), Fix it by +checking overflow in safe_delay_store() and use unsigned long conversion in +safe_delay_show(). + +Fixes: 72e02075a33f ("md: factor out parsing of fixed-point numbers") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230522072535.1523740-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index bb73a541bb193..0c97531d35038 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -3830,8 +3830,9 @@ int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale) + static ssize_t + safe_delay_show(struct mddev *mddev, char *page) + { +- int msec = (mddev->safemode_delay*1000)/HZ; +- return sprintf(page, "%d.%03d\n", msec/1000, msec%1000); ++ unsigned int msec = ((unsigned long)mddev->safemode_delay*1000)/HZ; ++ ++ return sprintf(page, "%u.%03u\n", msec/1000, msec%1000); + } + static ssize_t + safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len) +@@ -3843,7 +3844,7 @@ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len) + return -EINVAL; + } + +- if (strict_strtoul_scaled(cbuf, &msec, 3) < 0) ++ if (strict_strtoul_scaled(cbuf, &msec, 3) < 0 || msec > UINT_MAX / HZ) + return -EINVAL; + if (msec == 0) + mddev->safemode_delay = 0; +-- +2.39.2 + diff --git a/queue-6.1/md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch b/queue-6.1/md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch new file mode 100644 index 00000000000..7c0fe99504a --- /dev/null +++ b/queue-6.1/md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch @@ -0,0 +1,38 @@ +From 88ef16eebb72999150fd7bdce4407a6aff3c430e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 15:25:34 +0800 +Subject: md/raid10: fix wrong setting of max_corr_read_errors + +From: Li Nan + +[ Upstream commit f8b20a405428803bd9881881d8242c9d72c6b2b2 ] + +There is no input check when echo md/max_read_errors and overflow might +occur. Add check of input number. + +Fixes: 1e50915fe0bb ("raid: improve MD/raid10 handling of correctable read errors.") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230522072535.1523740-3-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 0c97531d35038..829e1bd9bcbf9 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4513,6 +4513,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len + rv = kstrtouint(buf, 10, &n); + if (rv < 0) + return rv; ++ if (n > INT_MAX) ++ return -EINVAL; + atomic_set(&mddev->max_corr_read_errors, n); + return len; + } +-- +2.39.2 + diff --git a/queue-6.1/memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch b/queue-6.1/memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch new file mode 100644 index 00000000000..b07ecf66241 --- /dev/null +++ b/queue-6.1/memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch @@ -0,0 +1,50 @@ +From e169f7e89d2c82fd6baf145613ef3e8e308cff11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 13:29:31 +0200 +Subject: memory: brcmstb_dpfe: fix testing array offset after use + +From: Krzysztof Kozlowski + +[ Upstream commit 1d9e93fad549bc38f593147479ee063f2872c170 ] + +Code should first check for valid value of array offset, then use it as +the index. Fixes smatch warning: + + drivers/memory/brcmstb_dpfe.c:443 __send_command() error: testing array offset 'cmd' after use. + +Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE") +Acked-by: Markus Mayer +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230513112931.176066-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/brcmstb_dpfe.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c +index 76c82e9c8fceb..9339f80b21c50 100644 +--- a/drivers/memory/brcmstb_dpfe.c ++++ b/drivers/memory/brcmstb_dpfe.c +@@ -434,15 +434,17 @@ static void __finalize_command(struct brcmstb_dpfe_priv *priv) + static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd, + u32 result[]) + { +- const u32 *msg = priv->dpfe_api->command[cmd]; + void __iomem *regs = priv->regs; + unsigned int i, chksum, chksum_idx; ++ const u32 *msg; + int ret = 0; + u32 resp; + + if (cmd >= DPFE_CMD_MAX) + return -1; + ++ msg = priv->dpfe_api->command[cmd]; ++ + mutex_lock(&priv->lock); + + /* Wait for DCPU to become ready */ +-- +2.39.2 + diff --git a/queue-6.1/memstick-r592-make-memstick_debug_get_tpc_name-stati.patch b/queue-6.1/memstick-r592-make-memstick_debug_get_tpc_name-stati.patch new file mode 100644 index 00000000000..d48df061e71 --- /dev/null +++ b/queue-6.1/memstick-r592-make-memstick_debug_get_tpc_name-stati.patch @@ -0,0 +1,49 @@ +From dea0440665944b1736f1d4a44b3960d586aac44f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:27:04 +0200 +Subject: memstick r592: make memstick_debug_get_tpc_name() static + +From: Arnd Bergmann + +[ Upstream commit 434587df9f7fd68575f99a889cc5f2efc2eaee5e ] + +There are no other files referencing this function, apparently +it was left global to avoid an 'unused function' warning when +the only caller is left out. With a 'W=1' build, it causes +a 'missing prototype' warning though: + +drivers/memstick/host/r592.c:47:13: error: no previous prototype for 'memstick_debug_get_tpc_name' [-Werror=missing-prototypes] + +Annotate the function as 'static __maybe_unused' to avoid both +problems. + +Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230516202714.560929-1-arnd@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/host/r592.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index 42bfc46842b82..461f5ffd02bc1 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -44,12 +44,10 @@ static const char *tpc_names[] = { + * memstick_debug_get_tpc_name - debug helper that returns string for + * a TPC number + */ +-const char *memstick_debug_get_tpc_name(int tpc) ++static __maybe_unused const char *memstick_debug_get_tpc_name(int tpc) + { + return tpc_names[tpc-1]; + } +-EXPORT_SYMBOL(memstick_debug_get_tpc_name); +- + + /* Read a register*/ + static inline u32 r592_read_reg(struct r592_device *dev, int address) +-- +2.39.2 + diff --git a/queue-6.1/mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch b/queue-6.1/mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch new file mode 100644 index 00000000000..7d0b47d3cac --- /dev/null +++ b/queue-6.1/mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch @@ -0,0 +1,72 @@ +From bfb66726b6abc83dcca11250f5a095ad9aca914c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:36 +0200 +Subject: MIPS: DTS: CI20: Add parent supplies to ACT8600 regulators + +From: Paul Cercueil + +[ Upstream commit fbf1e42093f8d6346baf17079585fbcebb2ff284 ] + +Provide parent regulators to the ACT8600 regulators that need one. + +Signed-off-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Stable-dep-of: 944520f85d5b ("MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts") +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 994c7ebfddc80..0da8182698e36 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -242,16 +242,19 @@ regulators { + vddcore: DCDC1 { + regulator-min-microvolt = <1100000>; + regulator-max-microvolt = <1100000>; ++ vp1-supply = <&vcc_33v>; + regulator-always-on; + }; + vddmem: DCDC2 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; ++ vp2-supply = <&vcc_33v>; + regulator-always-on; + }; + vcc_33: DCDC3 { + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; ++ vp3-supply = <&vcc_33v>; + regulator-always-on; + }; + vcc_50: SUDCDC_REG4 { +@@ -262,21 +265,25 @@ vcc_50: SUDCDC_REG4 { + vcc_25: LDO5 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + wifi_io: LDO6 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + cim_io_28: LDO7 { + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + cim_io_15: LDO8 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + vrtc_18: LDO_REG9 { +-- +2.39.2 + diff --git a/queue-6.1/mips-dts-ci20-fix-act8600-regulator-node-names.patch b/queue-6.1/mips-dts-ci20-fix-act8600-regulator-node-names.patch new file mode 100644 index 00000000000..aec36201c6d --- /dev/null +++ b/queue-6.1/mips-dts-ci20-fix-act8600-regulator-node-names.patch @@ -0,0 +1,113 @@ +From 22800b93383156a4c30e421edc2bce1df81ab8c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:35 +0200 +Subject: MIPS: DTS: CI20: Fix ACT8600 regulator node names + +From: Paul Cercueil + +[ Upstream commit 08384e80a70fb1942510ab5f0ce27bad134e634e ] + +The Device Tree was using invalid node names for the ACT8600 regulators. +To be fair, it is not the original committer's fault, as the +documentation did gives invalid names as well. + +In theory, the fix should have been to modify the driver to accept the +alternative names. However, even though the act8865 driver spits +warnings, the kernel seemed to work fine with what is currently +supported upstream. For that reason, I think it is okay to just update +the DTS. + +I removed the "regulator-name" too, since they really didn't bring any +information. The node names are enough. + +Fixes: 73f2b940474d ("MIPS: CI20: DTS: Add I2C nodes") +Signed-off-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 27 ++++++++------------------- + 1 file changed, 8 insertions(+), 19 deletions(-) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 8f21d2304737c..994c7ebfddc80 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -237,59 +237,49 @@ &i2c0 { + act8600: act8600@5a { + compatible = "active-semi,act8600"; + reg = <0x5a>; +- status = "okay"; + + regulators { +- vddcore: SUDCDC1 { +- regulator-name = "DCDC_REG1"; ++ vddcore: DCDC1 { + regulator-min-microvolt = <1100000>; + regulator-max-microvolt = <1100000>; + regulator-always-on; + }; +- vddmem: SUDCDC2 { +- regulator-name = "DCDC_REG2"; ++ vddmem: DCDC2 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; + regulator-always-on; + }; +- vcc_33: SUDCDC3 { +- regulator-name = "DCDC_REG3"; ++ vcc_33: DCDC3 { + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-always-on; + }; +- vcc_50: SUDCDC4 { +- regulator-name = "SUDCDC_REG4"; ++ vcc_50: SUDCDC_REG4 { + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + regulator-always-on; + }; +- vcc_25: LDO_REG5 { +- regulator-name = "LDO_REG5"; ++ vcc_25: LDO5 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; + regulator-always-on; + }; +- wifi_io: LDO_REG6 { +- regulator-name = "LDO_REG6"; ++ wifi_io: LDO6 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; + regulator-always-on; + }; +- vcc_28: LDO_REG7 { +- regulator-name = "LDO_REG7"; ++ cim_io_28: LDO7 { + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; + regulator-always-on; + }; +- vcc_15: LDO_REG8 { +- regulator-name = "LDO_REG8"; ++ cim_io_15: LDO8 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; + regulator-always-on; + }; + vrtc_18: LDO_REG9 { +- regulator-name = "LDO_REG9"; + /* Despite the datasheet stating 3.3V + * for REG9 and the driver expecting that, + * REG9 outputs 1.8V. +@@ -303,7 +293,6 @@ vrtc_18: LDO_REG9 { + regulator-always-on; + }; + vcc_11: LDO_REG10 { +- regulator-name = "LDO_REG10"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1200000>; + regulator-always-on; +-- +2.39.2 + diff --git a/queue-6.1/mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch b/queue-6.1/mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch new file mode 100644 index 00000000000..cee6f068535 --- /dev/null +++ b/queue-6.1/mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch @@ -0,0 +1,51 @@ +From 4e09d8e67aecb3958787b56bc17a193de5f9a5e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 19:59:34 +0200 +Subject: MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts + +From: Paul Cercueil + +[ Upstream commit 944520f85d5b1fb2f9ea243be41f9c9af3d4cef3 ] + +Commit 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node +names") caused the VDDCORE power supply (regulated by the ACT8600's +DCDC1 output) to drop from a voltage of 1.2V configured by the +bootloader, to the 1.1V set in the Device Tree. + +According to the documentation, the VDDCORE supply should be between +0.99V and 1.21V; both values are therefore within the supported range. + +However, VDDCORE being 1.1V results in the CI20 being very unstable, +with corrupted memory, failures to boot, or reboots at random. The +reason might be succint drops of the voltage below the minimum required. + +Raising the minimum voltage to 1.125 volts seems to be enough to address +this issue, while still keeping a relatively low core voltage which +helps for power consumption and thermals. + +Fixes: 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node names") +Signed-off-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 0da8182698e36..6a179e0322c59 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -240,8 +240,8 @@ act8600: act8600@5a { + + regulators { + vddcore: DCDC1 { +- regulator-min-microvolt = <1100000>; +- regulator-max-microvolt = <1100000>; ++ regulator-min-microvolt = <1125000>; ++ regulator-max-microvolt = <1125000>; + vp1-supply = <&vcc_33v>; + regulator-always-on; + }; +-- +2.39.2 + diff --git a/queue-6.1/mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch b/queue-6.1/mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch new file mode 100644 index 00000000000..0c6dc433d46 --- /dev/null +++ b/queue-6.1/mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch @@ -0,0 +1,169 @@ +From a9fb646dc55f1e08aa01917af99818efd6bfa78f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 12:27:13 +0200 +Subject: mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from + 11/2019 + +From: Marek Vasut + +[ Upstream commit c467c8f081859d4f4ca4eee4fba54bb5d85d6c97 ] + +This microSD card never clears Flush Cache bit after cache flush has +been started in sd_flush_cache(). This leads e.g. to failure to mount +file system. Add a quirk which disables the SD cache for this specific +card from specific manufacturing date of 11/2019, since on newer dated +cards from 05/2023 the cache flush works correctly. + +Fixes: 08ebf903af57 ("mmc: core: Fixup support for writeback-cache for eMMC and SD") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230620102713.7701-1-marex@denx.de +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/card.h | 30 +++++++++++++++++++++++------- + drivers/mmc/core/quirks.h | 13 +++++++++++++ + drivers/mmc/core/sd.c | 2 +- + include/linux/mmc/card.h | 1 + + 4 files changed, 38 insertions(+), 8 deletions(-) + +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index cfdd1ff40b865..4edf9057fa79d 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -53,6 +53,10 @@ struct mmc_fixup { + unsigned int manfid; + unsigned short oemid; + ++ /* Manufacturing date */ ++ unsigned short year; ++ unsigned char month; ++ + /* SDIO-specific fields. You can use SDIO_ANY_ID here of course */ + u16 cis_vendor, cis_device; + +@@ -68,6 +72,8 @@ struct mmc_fixup { + + #define CID_MANFID_ANY (-1u) + #define CID_OEMID_ANY ((unsigned short) -1) ++#define CID_YEAR_ANY ((unsigned short) -1) ++#define CID_MONTH_ANY ((unsigned char) -1) + #define CID_NAME_ANY (NULL) + + #define EXT_CSD_REV_ANY (-1u) +@@ -81,17 +87,21 @@ struct mmc_fixup { + #define CID_MANFID_APACER 0x27 + #define CID_MANFID_KINGSTON 0x70 + #define CID_MANFID_HYNIX 0x90 ++#define CID_MANFID_KINGSTON_SD 0x9F + #define CID_MANFID_NUMONYX 0xFE + + #define END_FIXUP { NULL } + +-#define _FIXUP_EXT(_name, _manfid, _oemid, _rev_start, _rev_end, \ +- _cis_vendor, _cis_device, \ +- _fixup, _data, _ext_csd_rev) \ ++#define _FIXUP_EXT(_name, _manfid, _oemid, _year, _month, \ ++ _rev_start, _rev_end, \ ++ _cis_vendor, _cis_device, \ ++ _fixup, _data, _ext_csd_rev) \ + { \ + .name = (_name), \ + .manfid = (_manfid), \ + .oemid = (_oemid), \ ++ .year = (_year), \ ++ .month = (_month), \ + .rev_start = (_rev_start), \ + .rev_end = (_rev_end), \ + .cis_vendor = (_cis_vendor), \ +@@ -103,8 +113,8 @@ struct mmc_fixup { + + #define MMC_FIXUP_REV(_name, _manfid, _oemid, _rev_start, _rev_end, \ + _fixup, _data, _ext_csd_rev) \ +- _FIXUP_EXT(_name, _manfid, \ +- _oemid, _rev_start, _rev_end, \ ++ _FIXUP_EXT(_name, _manfid, _oemid, CID_YEAR_ANY, CID_MONTH_ANY, \ ++ _rev_start, _rev_end, \ + SDIO_ANY_ID, SDIO_ANY_ID, \ + _fixup, _data, _ext_csd_rev) \ + +@@ -118,8 +128,9 @@ struct mmc_fixup { + _ext_csd_rev) + + #define SDIO_FIXUP(_vendor, _device, _fixup, _data) \ +- _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, \ +- CID_OEMID_ANY, 0, -1ull, \ ++ _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, CID_OEMID_ANY, \ ++ CID_YEAR_ANY, CID_MONTH_ANY, \ ++ 0, -1ull, \ + _vendor, _device, \ + _fixup, _data, EXT_CSD_REV_ANY) \ + +@@ -264,4 +275,9 @@ static inline int mmc_card_broken_sd_discard(const struct mmc_card *c) + return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD; + } + ++static inline int mmc_card_broken_sd_cache(const struct mmc_card *c) ++{ ++ return c->quirks & MMC_QUIRK_BROKEN_SD_CACHE; ++} ++ + #endif +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 29b9497936df9..a7ffbc930ea9d 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -53,6 +53,15 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { + MMC_FIXUP("MMC32G", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BLK_NO_CMD23), + ++ /* ++ * Kingston Canvas Go! Plus microSD cards never finish SD cache flush. ++ * This has so far only been observed on cards from 11/2019, while new ++ * cards from 2023/05 do not exhibit this behavior. ++ */ ++ _FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11, ++ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, ++ MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY), ++ + /* + * Some SD cards lockup while using CMD23 multiblock transfers. + */ +@@ -209,6 +218,10 @@ static inline void mmc_fixup_device(struct mmc_card *card, + if (f->of_compatible && + !mmc_fixup_of_compatible_match(card, f->of_compatible)) + continue; ++ if (f->year != CID_YEAR_ANY && f->year != card->cid.year) ++ continue; ++ if (f->month != CID_MONTH_ANY && f->month != card->cid.month) ++ continue; + + dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup); + f->vendor_fixup(card, f->data); +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 72b664ed90cf6..246ce027ae0aa 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -1170,7 +1170,7 @@ static int sd_parse_ext_reg_perf(struct mmc_card *card, u8 fno, u8 page, + card->ext_perf.feature_support |= SD_EXT_PERF_HOST_MAINT; + + /* Cache support at bit 0. */ +- if (reg_buf[4] & BIT(0)) ++ if ((reg_buf[4] & BIT(0)) && !mmc_card_broken_sd_cache(card)) + card->ext_perf.feature_support |= SD_EXT_PERF_CACHE; + + /* Command queue support indicated via queue depth bits (0 to 4). */ +diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h +index c726ea7812552..daa2f40d9ce65 100644 +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -294,6 +294,7 @@ struct mmc_card { + #define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */ + #define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */ + #define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */ ++#define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */ + + bool reenable_cmdq; /* Re-enable Command Queue */ + +-- +2.39.2 + diff --git a/queue-6.1/mmc-mediatek-avoid-ugly-error-message-when-sdio-wake.patch b/queue-6.1/mmc-mediatek-avoid-ugly-error-message-when-sdio-wake.patch new file mode 100644 index 00000000000..23d9ee52c2c --- /dev/null +++ b/queue-6.1/mmc-mediatek-avoid-ugly-error-message-when-sdio-wake.patch @@ -0,0 +1,44 @@ +From 5826b701c871b884f2c7137e69ed2b2eccfa4d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 06:44:54 -0700 +Subject: mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isn't + used + +From: Douglas Anderson + +[ Upstream commit a3332b7aad346b14770797e03ddd02ebdb14db41 ] + +When I boot a kukui-kodama board, I see an ugly warning in my kernel +log: + mtk-msdc 11240000.mmc: error -ENXIO: IRQ sdio_wakeup not found + +It's pretty normal not to have an "sdio_wakeup" IRQ defined. In fact, +no device trees in mainline seem to have it. Let's use the +platform_get_irq_byname_optional() to avoid the error message. + +Fixes: 527f36f5efa4 ("mmc: mediatek: add support for SDIO eint wakup IRQ") +Signed-off-by: Douglas Anderson +Reviewed-by: Matthias Brugger +Link: https://lore.kernel.org/r/20230510064434.1.I935404c5396e6bf952e99bb7ffb744c6f7fd430b@changeid +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mtk-sd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 425efb3fba048..1a0d4dc24717c 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -2685,7 +2685,7 @@ static int msdc_drv_probe(struct platform_device *pdev) + + /* Support for SDIO eint irq ? */ + if ((mmc->pm_caps & MMC_PM_WAKE_SDIO_IRQ) && (mmc->pm_caps & MMC_PM_KEEP_POWER)) { +- host->eint_irq = platform_get_irq_byname(pdev, "sdio_wakeup"); ++ host->eint_irq = platform_get_irq_byname_optional(pdev, "sdio_wakeup"); + if (host->eint_irq > 0) { + host->pins_eint = pinctrl_lookup_state(host->pinctrl, "state_eint"); + if (IS_ERR(host->pins_eint)) { +-- +2.39.2 + diff --git a/queue-6.1/modpost-fix-off-by-one-in-is_executable_section.patch b/queue-6.1/modpost-fix-off-by-one-in-is_executable_section.patch new file mode 100644 index 00000000000..1cd64aea207 --- /dev/null +++ b/queue-6.1/modpost-fix-off-by-one-in-is_executable_section.patch @@ -0,0 +1,36 @@ +From ea73218c3ea9b849e42724c78ac6eb1bcb108aed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 11:23:40 +0300 +Subject: modpost: fix off by one in is_executable_section() + +From: Dan Carpenter + +[ Upstream commit 3a3f1e573a105328a2cca45a7cfbebabbf5e3192 ] + +The > comparison should be >= to prevent an out of bounds array +access. + +Fixes: 52dc0595d540 ("modpost: handle relocations mismatch in __ex_table.") +Signed-off-by: Dan Carpenter +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 9e370e77f52d1..e6be7fc2625fd 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1297,7 +1297,7 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf, + + static int is_executable_section(struct elf_info* elf, unsigned int section_index) + { +- if (section_index > elf->num_sections) ++ if (section_index >= elf->num_sections) + fatal("section_index is outside elf->num_sections!\n"); + + return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR); +-- +2.39.2 + diff --git a/queue-6.1/modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch b/queue-6.1/modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch new file mode 100644 index 00000000000..3b7fa013be0 --- /dev/null +++ b/queue-6.1/modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch @@ -0,0 +1,106 @@ +From 1e508ab222e42e219baaa3aff1846db50f823f7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 21:09:56 +0900 +Subject: modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} + +From: Masahiro Yamada + +[ Upstream commit 56a24b8ce6a7f9c4a21b2276a8644f6f3d8fc14d ] + +addend_arm_rel() processes R_ARM_PC24, R_ARM_CALL, R_ARM_JUMP24 in a +wrong way. + +Here, test code. + +[test code for R_ARM_JUMP24] + + .section .init.text,"ax" + bar: + bx lr + + .section .text,"ax" + .globl foo + foo: + b bar + +[test code for R_ARM_CALL] + + .section .init.text,"ax" + bar: + bx lr + + .section .text,"ax" + .globl foo + foo: + push {lr} + bl bar + pop {pc} + +If you compile it with ARM multi_v7_defconfig, modpost will show the +symbol name, (unknown). + + WARNING: modpost: vmlinux.o: section mismatch in reference: foo (section: .text) -> (unknown) (section: .init.text) + +(You need to use GNU linker instead of LLD to reproduce it.) + +Fix the code to make modpost show the correct symbol name. + +I imported (with adjustment) sign_extend32() from include/linux/bitops.h. + +The '+8' is the compensation for pc-relative instruction. It is +documented in "ELF for the Arm Architecture" [1]. + + "If the relocation is pc-relative then compensation for the PC bias + (the PC value is 8 bytes ahead of the executing instruction in Arm + state and 4 bytes in Thumb state) must be encoded in the relocation + by the object producer." + +[1]: https://github.com/ARM-software/abi-aa/blob/main/aaelf32/aaelf32.rst + +Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm") +Fixes: 6e2e340b59d2 ("ARM: 7324/1: modpost: Fix section warnings for ARM for many compilers") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index f7a67f111d846..9e370e77f52d1 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1419,12 +1419,20 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + #define R_ARM_THM_JUMP19 51 + #endif + ++static int32_t sign_extend32(int32_t value, int index) ++{ ++ uint8_t shift = 31 - index; ++ ++ return (int32_t)(value << shift) >> shift; ++} ++ + static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + { + unsigned int r_typ = ELF_R_TYPE(r->r_info); + Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info); + void *loc = reloc_location(elf, sechdr, r); + uint32_t inst; ++ int32_t offset; + + switch (r_typ) { + case R_ARM_ABS32: +@@ -1434,6 +1442,10 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + case R_ARM_PC24: + case R_ARM_CALL: + case R_ARM_JUMP24: ++ inst = TO_NATIVE(*(uint32_t *)loc); ++ offset = sign_extend32((inst & 0x00ffffff) << 2, 25); ++ r->r_addend = offset + sym->st_value + 8; ++ break; + case R_ARM_THM_CALL: + case R_ARM_THM_JUMP24: + case R_ARM_THM_JUMP19: +-- +2.39.2 + diff --git a/queue-6.1/modpost-fix-section-mismatch-message-for-r_arm_abs32.patch b/queue-6.1/modpost-fix-section-mismatch-message-for-r_arm_abs32.patch new file mode 100644 index 00000000000..f123c521fee --- /dev/null +++ b/queue-6.1/modpost-fix-section-mismatch-message-for-r_arm_abs32.patch @@ -0,0 +1,133 @@ +From 6a60909d7801814c56ce0d16f31130286ce011da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 21:09:55 +0900 +Subject: modpost: fix section mismatch message for R_ARM_ABS32 + +From: Masahiro Yamada + +[ Upstream commit b7c63520f6703a25eebb4f8138fed764fcae1c6f ] + +addend_arm_rel() processes R_ARM_ABS32 in a wrong way. + +Here, test code. + + [test code 1] + + #include + + int __initdata foo; + int get_foo(void) { return foo; } + +If you compile it with ARM versatile_defconfig, modpost will show the +symbol name, (unknown). + + WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> (unknown) (section: .init.data) + +(You need to use GNU linker instead of LLD to reproduce it.) + +If you compile it for other architectures, modpost will show the correct +symbol name. + + WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data) + +For R_ARM_ABS32, addend_arm_rel() sets r->r_addend to a wrong value. + +I just mimicked the code in arch/arm/kernel/module.c. + +However, there is more difficulty for ARM. + +Here, test code. + + [test code 2] + + #include + + int __initdata foo; + int get_foo(void) { return foo; } + + int __initdata bar; + int get_bar(void) { return bar; } + +With this commit applied, modpost will show the following messages +for ARM versatile_defconfig: + + WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data) + WARNING: modpost: vmlinux.o: section mismatch in reference: get_bar (section: .text) -> foo (section: .init.data) + +The reference from 'get_bar' to 'foo' seems wrong. + +I have no solution for this because it is true in assembly level. + +In the following output, relocation at 0x1c is no longer associated +with 'bar'. The two relocation entries point to the same symbol, and +the offset to 'bar' is encoded in the instruction 'r0, [r3, #4]'. + + Disassembly of section .text: + + 00000000 : + 0: e59f3004 ldr r3, [pc, #4] @ c + 4: e5930000 ldr r0, [r3] + 8: e12fff1e bx lr + c: 00000000 .word 0x00000000 + + 00000010 : + 10: e59f3004 ldr r3, [pc, #4] @ 1c + 14: e5930004 ldr r0, [r3, #4] + 18: e12fff1e bx lr + 1c: 00000000 .word 0x00000000 + + Relocation section '.rel.text' at offset 0x244 contains 2 entries: + Offset Info Type Sym.Value Sym. Name + 0000000c 00000c02 R_ARM_ABS32 00000000 .init.data + 0000001c 00000c02 R_ARM_ABS32 00000000 .init.data + +When find_elf_symbol() gets into a situation where relsym->st_name is +zero, there is no guarantee to get the symbol name as written in C. + +I am keeping the current logic because it is useful in many architectures, +but the symbol name is not always correct depending on the optimization. +I left some comments in find_tosym(). + +Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index d08cf73e4a3ff..f7a67f111d846 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1157,6 +1157,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, + if (relsym->st_name != 0) + return relsym; + ++ /* ++ * Strive to find a better symbol name, but the resulting name may not ++ * match the symbol referenced in the original code. ++ */ + relsym_secindex = get_secindex(elf, relsym); + for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (get_secindex(elf, sym) != relsym_secindex) +@@ -1418,12 +1422,14 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + { + unsigned int r_typ = ELF_R_TYPE(r->r_info); ++ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info); ++ void *loc = reloc_location(elf, sechdr, r); ++ uint32_t inst; + + switch (r_typ) { + case R_ARM_ABS32: +- /* From ARM ABI: (S + A) | T */ +- r->r_addend = (int)(long) +- (elf->symtab_start + ELF_R_SYM(r->r_info)); ++ inst = TO_NATIVE(*(uint32_t *)loc); ++ r->r_addend = inst + sym->st_value; + break; + case R_ARM_PC24: + case R_ARM_CALL: +-- +2.39.2 + diff --git a/queue-6.1/modpost-remove-broken-calculation-of-exception_table.patch b/queue-6.1/modpost-remove-broken-calculation-of-exception_table.patch new file mode 100644 index 00000000000..689052c9fbe --- /dev/null +++ b/queue-6.1/modpost-remove-broken-calculation-of-exception_table.patch @@ -0,0 +1,161 @@ +From 4ac55579ea380759c370329f63fe0f099c6ab699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 00:27:19 +0900 +Subject: modpost: remove broken calculation of exception_table_entry size + +From: Masahiro Yamada + +[ Upstream commit d0acc76a49aa917c1a455d11d32d34a01e8b2835 ] + +find_extable_entry_size() is completely broken. It has awesome comments +about how to calculate sizeof(struct exception_table_entry). + +It was based on these assumptions: + + - struct exception_table_entry has two fields + - both of the fields have the same size + +Then, we came up with this equation: + + (offset of the second field) * 2 == (size of struct) + +It was true for all architectures when commit 52dc0595d540 ("modpost: +handle relocations mismatch in __ex_table.") was applied. + +Our mathematics broke when commit 548acf19234d ("x86/mm: Expand the +exception table logic to allow new handling options") introduced the +third field. + +Now, the definition of exception_table_entry is highly arch-dependent. + +For x86, sizeof(struct exception_table_entry) is apparently 12, but +find_extable_entry_size() sets extable_entry_size to 8. + +I could fix it, but I do not see much value in this code. + +extable_entry_size is used just for selecting a slightly different +error message. + +If the first field ("insn") references to a non-executable section, + + The relocation at %s+0x%lx references + section "%s" which is not executable, IOW + it is not possible for the kernel to fault + at that address. Something is seriously wrong + and should be fixed. + +If the second field ("fixup") references to a non-executable section, + + The relocation at %s+0x%lx references + section "%s" which is not executable, IOW + the kernel will fault if it ever tries to + jump to it. Something is seriously wrong + and should be fixed. + +Merge the two error messages rather than adding even more complexity. + +Change fatal() to error() to make it continue running and catch more +possible errors. + +Fixes: 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 60 +++---------------------------------------- + 1 file changed, 3 insertions(+), 57 deletions(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 1dfa80c6b471e..d08cf73e4a3ff 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1299,43 +1299,6 @@ static int is_executable_section(struct elf_info* elf, unsigned int section_inde + return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR); + } + +-/* +- * We rely on a gross hack in section_rel[a]() calling find_extable_entry_size() +- * to know the sizeof(struct exception_table_entry) for the target architecture. +- */ +-static unsigned int extable_entry_size = 0; +-static void find_extable_entry_size(const char* const sec, const Elf_Rela* r) +-{ +- /* +- * If we're currently checking the second relocation within __ex_table, +- * that relocation offset tells us the offsetof(struct +- * exception_table_entry, fixup) which is equal to sizeof(struct +- * exception_table_entry) divided by two. We use that to our advantage +- * since there's no portable way to get that size as every architecture +- * seems to go with different sized types. Not pretty but better than +- * hard-coding the size for every architecture.. +- */ +- if (!extable_entry_size) +- extable_entry_size = r->r_offset * 2; +-} +- +-static inline bool is_extable_fault_address(Elf_Rela *r) +-{ +- /* +- * extable_entry_size is only discovered after we've handled the +- * _second_ relocation in __ex_table, so only abort when we're not +- * handling the first reloc and extable_entry_size is zero. +- */ +- if (r->r_offset && extable_entry_size == 0) +- fatal("extable_entry size hasn't been discovered!\n"); +- +- return ((r->r_offset == 0) || +- (r->r_offset % extable_entry_size == 0)); +-} +- +-#define is_second_extable_reloc(Start, Cur, Sec) \ +- (((Cur) == (Start) + 1) && (strcmp("__ex_table", (Sec)) == 0)) +- + static void report_extable_warnings(const char* modname, struct elf_info* elf, + const struct sectioncheck* const mismatch, + Elf_Rela* r, Elf_Sym* sym, +@@ -1392,22 +1355,9 @@ static void extable_mismatch_handler(const char* modname, struct elf_info *elf, + "You might get more information about where this is\n" + "coming from by using scripts/check_extable.sh %s\n", + fromsec, (long)r->r_offset, tosec, modname); +- else if (!is_executable_section(elf, get_secindex(elf, sym))) { +- if (is_extable_fault_address(r)) +- fatal("The relocation at %s+0x%lx references\n" +- "section \"%s\" which is not executable, IOW\n" +- "it is not possible for the kernel to fault\n" +- "at that address. Something is seriously wrong\n" +- "and should be fixed.\n", +- fromsec, (long)r->r_offset, tosec); +- else +- fatal("The relocation at %s+0x%lx references\n" +- "section \"%s\" which is not executable, IOW\n" +- "the kernel will fault if it ever tries to\n" +- "jump to it. Something is seriously wrong\n" +- "and should be fixed.\n", +- fromsec, (long)r->r_offset, tosec); +- } ++ else if (!is_executable_section(elf, get_secindex(elf, sym))) ++ error("%s+0x%lx references non-executable section '%s'\n", ++ fromsec, (long)r->r_offset, tosec); + } + + static void check_section_mismatch(const char *modname, struct elf_info *elf, +@@ -1569,8 +1519,6 @@ static void section_rela(const char *modname, struct elf_info *elf, + /* Skip special sections */ + if (is_shndx_special(sym->st_shndx)) + continue; +- if (is_second_extable_reloc(start, rela, fromsec)) +- find_extable_entry_size(fromsec, &r); + check_section_mismatch(modname, elf, &r, sym, fromsec); + } + } +@@ -1628,8 +1576,6 @@ static void section_rel(const char *modname, struct elf_info *elf, + /* Skip special sections */ + if (is_shndx_special(sym->st_shndx)) + continue; +- if (is_second_extable_reloc(start, rel, fromsec)) +- find_extable_entry_size(fromsec, &r); + check_section_mismatch(modname, elf, &r, sym, fromsec); + } + } +-- +2.39.2 + diff --git a/queue-6.1/net-axienet-move-reset-before-64-bit-dma-detection.patch b/queue-6.1/net-axienet-move-reset-before-64-bit-dma-detection.patch new file mode 100644 index 00000000000..cb8dc1bef56 --- /dev/null +++ b/queue-6.1/net-axienet-move-reset-before-64-bit-dma-detection.patch @@ -0,0 +1,60 @@ +From 174b20818df9f634a03ef1807c71544dab66d513 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 22:22:45 +0300 +Subject: net: axienet: Move reset before 64-bit DMA detection + +From: Maxim Kochetkov + +[ Upstream commit f1bc9fc4a06de0108e0dca2a9a7e99ba1fc632f9 ] + +64-bit DMA detection will fail if axienet was started before (by boot +loader, boot ROM, etc). In this state axienet will not start properly. +XAXIDMA_TX_CDESC_OFFSET + 4 register (MM2S_CURDESC_MSB) is used to detect +64-bit DMA capability here. But datasheet says: When DMACR.RS is 1 +(axienet is in enabled state), CURDESC_PTR becomes Read Only (RO) and +is used to fetch the first descriptor. So iowrite32()/ioread32() trick +to this register to detect 64-bit DMA will not work. +So move axienet reset before 64-bit DMA detection. + +Fixes: f735c40ed93c ("net: axienet: Autodetect 64-bit DMA capability") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Robert Hancock +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20230622192245.116864-1-fido_max@inbox.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index d1d772580da98..d14648558338b 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -2043,6 +2043,11 @@ static int axienet_probe(struct platform_device *pdev) + goto cleanup_clk; + } + ++ /* Reset core now that clocks are enabled, prior to accessing MDIO */ ++ ret = __axienet_device_reset(lp); ++ if (ret) ++ goto cleanup_clk; ++ + /* Autodetect the need for 64-bit DMA pointers. + * When the IP is configured for a bus width bigger than 32 bits, + * writing the MSB registers is mandatory, even if they are all 0. +@@ -2097,11 +2102,6 @@ static int axienet_probe(struct platform_device *pdev) + lp->coalesce_count_tx = XAXIDMA_DFT_TX_THRESHOLD; + lp->coalesce_usec_tx = XAXIDMA_DFT_TX_USEC; + +- /* Reset core now that clocks are enabled, prior to accessing MDIO */ +- ret = __axienet_device_reset(lp); +- if (ret) +- goto cleanup_clk; +- + ret = axienet_mdio_setup(lp); + if (ret) + dev_warn(&pdev->dev, +-- +2.39.2 + diff --git a/queue-6.1/net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch b/queue-6.1/net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch new file mode 100644 index 00000000000..6bb44b5db15 --- /dev/null +++ b/queue-6.1/net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch @@ -0,0 +1,558 @@ +From 0d42fa69c739856e9b1063f89aa59ec305d17cf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 17:10:07 +0800 +Subject: net: nfc: Fix use-after-free caused by nfc_llcp_find_local + +From: Lin Ma + +[ Upstream commit 6709d4b7bc2e079241fdef15d1160581c5261c10 ] + +This commit fixes several use-after-free that caused by function +nfc_llcp_find_local(). For example, one UAF can happen when below buggy +time window occurs. + +// nfc_genl_llc_get_params | // nfc_unregister_device + | +dev = nfc_get_device(idx); | device_lock(...) +if (!dev) | dev->shutting_down = true; + return -ENODEV; | device_unlock(...); + | +device_lock(...); | // nfc_llcp_unregister_device + | nfc_llcp_find_local() +nfc_llcp_find_local(...); | + | local_cleanup() +if (!local) { | + rc = -ENODEV; | // nfc_llcp_local_put + goto exit; | kref_put(.., local_release) +} | + | // local_release + | list_del(&local->list) + // nfc_genl_send_params | kfree() + local->dev->idx !!!UAF!!! | + | + +and the crash trace for the one of the discussed UAF like: + +BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 +Read of size 8 at addr ffff888105b0e410 by task 20114 + +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:319 [inline] + print_report+0xcc/0x620 mm/kasan/report.c:430 + kasan_report+0xb2/0xe0 mm/kasan/report.c:536 + nfc_genl_send_params net/nfc/netlink.c:999 [inline] + nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 + genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968 + genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] + genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065 + netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548 + genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b6/0x200 net/socket.c:747 + ____sys_sendmsg+0x6e9/0x890 net/socket.c:2501 + ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555 + __sys_sendmsg+0xf7/0x1d0 net/socket.c:2584 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7f34640a2389 +RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389 +RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006 +RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000 + + +Allocated by task 20116: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + ____kasan_kmalloc mm/kasan/common.c:374 [inline] + __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383 + kmalloc include/linux/slab.h:580 [inline] + kzalloc include/linux/slab.h:720 [inline] + nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567 + nfc_register_device+0x61/0x260 net/nfc/core.c:1124 + nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257 + virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148 + misc_open+0x379/0x4a0 drivers/char/misc.c:165 + chrdev_open+0x26c/0x780 fs/char_dev.c:414 + do_dentry_open+0x6c4/0x12a0 fs/open.c:920 + do_open fs/namei.c:3560 [inline] + path_openat+0x24fe/0x37e0 fs/namei.c:3715 + do_filp_open+0x1ba/0x410 fs/namei.c:3742 + do_sys_openat2+0x171/0x4c0 fs/open.c:1356 + do_sys_open fs/open.c:1372 [inline] + __do_sys_openat fs/open.c:1388 [inline] + __se_sys_openat fs/open.c:1383 [inline] + __x64_sys_openat+0x143/0x200 fs/open.c:1383 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Freed by task 20115: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + ____kasan_slab_free mm/kasan/common.c:200 [inline] + __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 + kasan_slab_free include/linux/kasan.h:162 [inline] + slab_free_hook mm/slub.c:1781 [inline] + slab_free_freelist_hook mm/slub.c:1807 [inline] + slab_free mm/slub.c:3787 [inline] + __kmem_cache_free+0x7a/0x190 mm/slub.c:3800 + local_release net/nfc/llcp_core.c:174 [inline] + kref_put include/linux/kref.h:65 [inline] + nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline] + nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline] + nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620 + nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179 + virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163 + __fput+0x252/0xa20 fs/file_table.c:321 + task_work_run+0x174/0x270 kernel/task_work.c:179 + resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] + exit_to_user_mode_loop kernel/entry/common.c:171 [inline] + exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204 + __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] + syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297 + do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Last potentially related work creation: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + __kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491 + kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328 + drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735 + unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773 + unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753 + neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895 + addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684 + notifier_call_chain+0xbe/0x210 kernel/notifier.c:87 + call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937 + call_netdevice_notifiers_extack net/core/dev.c:1975 [inline] + call_netdevice_notifiers net/core/dev.c:1989 [inline] + dev_change_name+0x3c3/0x870 net/core/dev.c:1211 + dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376 + dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542 + sock_do_ioctl+0x160/0x260 net/socket.c:1213 + sock_ioctl+0x3f9/0x670 net/socket.c:1316 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:870 [inline] + __se_sys_ioctl fs/ioctl.c:856 [inline] + __x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The buggy address belongs to the object at ffff888105b0e400 + which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 16 bytes inside of + freed 1024-byte region [ffff888105b0e400, ffff888105b0e800) + +The buggy address belongs to the physical page: +head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +flags: 0x200000000010200(slab|head|node=0|zone=2) +raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10 +raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +In summary, this patch solves those use-after-free by + +1. Re-implement the nfc_llcp_find_local(). The current version does not +grab the reference when getting the local from the linked list. For +example, the llcp_sock_bind() gets the reference like below: + +// llcp_sock_bind() + + local = nfc_llcp_find_local(dev); // A + ..... \ + | raceable + ..... / + llcp_sock->local = nfc_llcp_local_get(local); // B + +There is an apparent race window that one can drop the reference +and free the local object fetched in (A) before (B) gets the reference. + +2. Some callers of the nfc_llcp_find_local() do not grab the reference +at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions. +We add the nfc_llcp_local_put() for them. Moreover, we add the necessary +error handling function to put the reference. + +3. Add the nfc_llcp_remove_local() helper. The local object is removed +from the linked list in local_release() when all reference is gone. This +patch removes it when nfc_llcp_unregister_device() is called. + +Therefore, every caller of nfc_llcp_find_local() will get a reference +even when the nfc_llcp_unregister_device() is called. This promises no +use-after-free for the local object is ever possible. + +Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support") +Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket") +Signed-off-by: Lin Ma +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/llcp.h | 1 - + net/nfc/llcp_commands.c | 12 +++++++--- + net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ + net/nfc/llcp_sock.c | 18 ++++++++------- + net/nfc/netlink.c | 20 ++++++++++++----- + net/nfc/nfc.h | 1 + + 6 files changed, 77 insertions(+), 24 deletions(-) + +diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h +index c1d9be636933c..d8345ed57c954 100644 +--- a/net/nfc/llcp.h ++++ b/net/nfc/llcp.h +@@ -201,7 +201,6 @@ void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *s); + void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *s); + void nfc_llcp_socket_remote_param_init(struct nfc_llcp_sock *sock); + struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev); +-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local); + int nfc_llcp_local_put(struct nfc_llcp_local *local); + u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, + struct nfc_llcp_sock *sock); +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index cdb001de06928..e2680a3bef799 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -359,6 +359,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) + struct sk_buff *skb; + struct nfc_llcp_local *local; + u16 size = 0; ++ int err; + + local = nfc_llcp_find_local(dev); + if (local == NULL) +@@ -368,8 +369,10 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) + size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE; + + skb = alloc_skb(size, GFP_KERNEL); +- if (skb == NULL) +- return -ENOMEM; ++ if (skb == NULL) { ++ err = -ENOMEM; ++ goto out; ++ } + + skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE); + +@@ -379,8 +382,11 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) + + nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX); + +- return nfc_data_exchange(dev, local->target_idx, skb, ++ err = nfc_data_exchange(dev, local->target_idx, skb, + nfc_llcp_recv, local); ++out: ++ nfc_llcp_local_put(local); ++ return err; + } + + int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) +diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c +index a27e1842b2a09..f60e424e06076 100644 +--- a/net/nfc/llcp_core.c ++++ b/net/nfc/llcp_core.c +@@ -17,6 +17,8 @@ + static u8 llcp_magic[3] = {0x46, 0x66, 0x6d}; + + static LIST_HEAD(llcp_devices); ++/* Protects llcp_devices list */ ++static DEFINE_SPINLOCK(llcp_devices_lock); + + static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb); + +@@ -141,7 +143,7 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, + write_unlock(&local->raw_sockets.lock); + } + +-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) ++static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) + { + kref_get(&local->ref); + +@@ -169,7 +171,6 @@ static void local_release(struct kref *ref) + + local = container_of(ref, struct nfc_llcp_local, ref); + +- list_del(&local->list); + local_cleanup(local); + kfree(local); + } +@@ -282,12 +283,33 @@ static void nfc_llcp_sdreq_timer(struct timer_list *t) + struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev) + { + struct nfc_llcp_local *local; ++ struct nfc_llcp_local *res = NULL; + ++ spin_lock(&llcp_devices_lock); + list_for_each_entry(local, &llcp_devices, list) +- if (local->dev == dev) ++ if (local->dev == dev) { ++ res = nfc_llcp_local_get(local); ++ break; ++ } ++ spin_unlock(&llcp_devices_lock); ++ ++ return res; ++} ++ ++static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev) ++{ ++ struct nfc_llcp_local *local, *tmp; ++ ++ spin_lock(&llcp_devices_lock); ++ list_for_each_entry_safe(local, tmp, &llcp_devices, list) ++ if (local->dev == dev) { ++ list_del(&local->list); ++ spin_unlock(&llcp_devices_lock); + return local; ++ } ++ spin_unlock(&llcp_devices_lock); + +- pr_debug("No device found\n"); ++ pr_warn("Shutting down device not found\n"); + + return NULL; + } +@@ -608,12 +630,15 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len) + + *general_bytes_len = local->gb_len; + ++ nfc_llcp_local_put(local); ++ + return local->gb; + } + + int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len) + { + struct nfc_llcp_local *local; ++ int err; + + if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN) + return -EINVAL; +@@ -630,12 +655,16 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len) + + if (memcmp(local->remote_gb, llcp_magic, 3)) { + pr_err("MAC does not support LLCP\n"); +- return -EINVAL; ++ err = -EINVAL; ++ goto out; + } + +- return nfc_llcp_parse_gb_tlv(local, ++ err = nfc_llcp_parse_gb_tlv(local, + &local->remote_gb[3], + local->remote_gb_len - 3); ++out: ++ nfc_llcp_local_put(local); ++ return err; + } + + static u8 nfc_llcp_dsap(const struct sk_buff *pdu) +@@ -1517,6 +1546,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb) + + __nfc_llcp_recv(local, skb); + ++ nfc_llcp_local_put(local); ++ + return 0; + } + +@@ -1533,6 +1564,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev) + + /* Close and purge all existing sockets */ + nfc_llcp_socket_release(local, true, 0); ++ ++ nfc_llcp_local_put(local); + } + + void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, +@@ -1558,6 +1591,8 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, + mod_timer(&local->link_timer, + jiffies + msecs_to_jiffies(local->remote_lto)); + } ++ ++ nfc_llcp_local_put(local); + } + + int nfc_llcp_register_device(struct nfc_dev *ndev) +@@ -1608,7 +1643,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) + + void nfc_llcp_unregister_device(struct nfc_dev *dev) + { +- struct nfc_llcp_local *local = nfc_llcp_find_local(dev); ++ struct nfc_llcp_local *local = nfc_llcp_remove_local(dev); + + if (local == NULL) { + pr_debug("No such device\n"); +diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c +index 77642d18a3b43..645677f84dba2 100644 +--- a/net/nfc/llcp_sock.c ++++ b/net/nfc/llcp_sock.c +@@ -99,7 +99,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) + } + + llcp_sock->dev = dev; +- llcp_sock->local = nfc_llcp_local_get(local); ++ llcp_sock->local = local; + llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; + llcp_sock->service_name_len = min_t(unsigned int, + llcp_addr.service_name_len, +@@ -186,7 +186,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr, + } + + llcp_sock->dev = dev; +- llcp_sock->local = nfc_llcp_local_get(local); ++ llcp_sock->local = local; + llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; + + nfc_llcp_sock_link(&local->raw_sockets, sk); +@@ -696,22 +696,22 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + if (dev->dep_link_up == false) { + ret = -ENOLINK; + device_unlock(&dev->dev); +- goto put_dev; ++ goto sock_llcp_put_local; + } + device_unlock(&dev->dev); + + if (local->rf_mode == NFC_RF_INITIATOR && + addr->target_idx != local->target_idx) { + ret = -ENOLINK; +- goto put_dev; ++ goto sock_llcp_put_local; + } + + llcp_sock->dev = dev; +- llcp_sock->local = nfc_llcp_local_get(local); ++ llcp_sock->local = local; + llcp_sock->ssap = nfc_llcp_get_local_ssap(local); + if (llcp_sock->ssap == LLCP_SAP_MAX) { + ret = -ENOMEM; +- goto sock_llcp_put_local; ++ goto sock_llcp_nullify; + } + + llcp_sock->reserved_ssap = llcp_sock->ssap; +@@ -757,11 +757,13 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + sock_llcp_release: + nfc_llcp_put_ssap(local, llcp_sock->ssap); + +-sock_llcp_put_local: +- nfc_llcp_local_put(llcp_sock->local); ++sock_llcp_nullify: + llcp_sock->local = NULL; + llcp_sock->dev = NULL; + ++sock_llcp_put_local: ++ nfc_llcp_local_put(local); ++ + put_dev: + nfc_put_device(dev); + +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index b9264e730fd93..e9ac6a6f934e7 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -1039,11 +1039,14 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info) + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!msg) { + rc = -ENOMEM; +- goto exit; ++ goto put_local; + } + + rc = nfc_genl_send_params(msg, local, info->snd_portid, info->snd_seq); + ++put_local: ++ nfc_llcp_local_put(local); ++ + exit: + device_unlock(&dev->dev); + +@@ -1105,7 +1108,7 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) + if (info->attrs[NFC_ATTR_LLC_PARAM_LTO]) { + if (dev->dep_link_up) { + rc = -EINPROGRESS; +- goto exit; ++ goto put_local; + } + + local->lto = nla_get_u8(info->attrs[NFC_ATTR_LLC_PARAM_LTO]); +@@ -1117,6 +1120,9 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) + if (info->attrs[NFC_ATTR_LLC_PARAM_MIUX]) + local->miux = cpu_to_be16(miux); + ++put_local: ++ nfc_llcp_local_put(local); ++ + exit: + device_unlock(&dev->dev); + +@@ -1172,7 +1178,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) + + if (rc != 0) { + rc = -EINVAL; +- goto exit; ++ goto put_local; + } + + if (!sdp_attrs[NFC_SDP_ATTR_URI]) +@@ -1191,7 +1197,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) + sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len); + if (sdreq == NULL) { + rc = -ENOMEM; +- goto exit; ++ goto put_local; + } + + tlvs_len += sdreq->tlv_len; +@@ -1201,10 +1207,14 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) + + if (hlist_empty(&sdreq_list)) { + rc = -EINVAL; +- goto exit; ++ goto put_local; + } + + rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len); ++ ++put_local: ++ nfc_llcp_local_put(local); ++ + exit: + device_unlock(&dev->dev); + +diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h +index de2ec66d7e83a..0b1e6466f4fbf 100644 +--- a/net/nfc/nfc.h ++++ b/net/nfc/nfc.h +@@ -52,6 +52,7 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len); + u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len); + int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb); + struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev); ++int nfc_llcp_local_put(struct nfc_llcp_local *local); + int __init nfc_llcp_init(void); + void nfc_llcp_exit(void); + void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp); +-- +2.39.2 + diff --git a/queue-6.1/net-stmmac-fix-double-serdes-powerdown.patch b/queue-6.1/net-stmmac-fix-double-serdes-powerdown.patch new file mode 100644 index 00000000000..4310db56292 --- /dev/null +++ b/queue-6.1/net-stmmac-fix-double-serdes-powerdown.patch @@ -0,0 +1,50 @@ +From c2b62f31c17b1fb3d730e624fa8781b3a12f8fd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 15:55:37 +0200 +Subject: net: stmmac: fix double serdes powerdown + +From: Bartosz Golaszewski + +[ Upstream commit c4fc88ad2a765224a648db8ab35f125e120fe41b ] + +Commit 49725ffc15fc ("net: stmmac: power up/down serdes in +stmmac_open/release") correctly added a call to the serdes_powerdown() +callback to stmmac_release() but did not remove the one from +stmmac_remove() which leads to a doubled call to serdes_powerdown(). + +This can lead to all kinds of problems: in the case of the qcom ethqos +driver, it caused an unbalanced regulator disable splat. + +Fixes: 49725ffc15fc ("net: stmmac: power up/down serdes in stmmac_open/release") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Jiri Pirko +Acked-by: Junxiao Chang +Reviewed-by: Andrew Halaney +Tested-by: Andrew Halaney +Link: https://lore.kernel.org/r/20230621135537.376649-1-brgl@bgdev.pl +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 30ce073055785..a07bcb2f5d2e2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7388,12 +7388,6 @@ int stmmac_dvr_remove(struct device *dev) + netif_carrier_off(ndev); + unregister_netdev(ndev); + +- /* Serdes power down needs to happen after VLAN filter +- * is deleted that is triggered by unregister_netdev(). +- */ +- if (priv->plat->serdes_powerdown) +- priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv); +- + #ifdef CONFIG_DEBUG_FS + stmmac_exit_fs(ndev); + #endif +-- +2.39.2 + diff --git a/queue-6.1/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch b/queue-6.1/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch new file mode 100644 index 00000000000..2371833417b --- /dev/null +++ b/queue-6.1/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch @@ -0,0 +1,148 @@ +From 137ab32f7407ff39466b805f1551ad4ff1d83899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 17:56:53 +0200 +Subject: netfilter: conntrack: dccp: copy entire header to stack buffer, not + just basic one + +From: Florian Westphal + +[ Upstream commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 ] + +Eric Dumazet says: + nf_conntrack_dccp_packet() has an unique: + + dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); + + And nothing more is 'pulled' from the packet, depending on the content. + dh->dccph_doff, and/or dh->dccph_x ...) + So dccp_ack_seq() is happily reading stuff past the _dh buffer. + +BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 +Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 +[..] + +Fix this by increasing the stack buffer to also include room for +the extra sequence numbers and all the known dccp packet type headers, +then pull again after the initial validation of the basic header. + +While at it, mark packets invalid that lack 48bit sequence bit but +where RFC says the type MUST use them. + +Compile tested only. + +v2: first skb_header_pointer() now needs to adjust the size to + only pull the generic header. (Eric) + +Heads-up: I intend to remove dccp conntrack support later this year. + +Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") +Reported-by: Eric Dumazet +Signed-off-by: Florian Westphal +Reviewed-by: Eric Dumazet +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_dccp.c | 52 +++++++++++++++++++++++-- + 1 file changed, 49 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index c1557d47ccd1e..d4fd626d2b8c3 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -432,9 +432,19 @@ static bool dccp_error(const struct dccp_hdr *dh, + struct sk_buff *skb, unsigned int dataoff, + const struct nf_hook_state *state) + { ++ static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST | ++ 1 << DCCP_PKT_RESPONSE | ++ 1 << DCCP_PKT_CLOSEREQ | ++ 1 << DCCP_PKT_CLOSE | ++ 1 << DCCP_PKT_RESET | ++ 1 << DCCP_PKT_SYNC | ++ 1 << DCCP_PKT_SYNCACK; + unsigned int dccp_len = skb->len - dataoff; + unsigned int cscov; + const char *msg; ++ u8 type; ++ ++ BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG); + + if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) || + dh->dccph_doff * 4 > dccp_len) { +@@ -459,34 +469,70 @@ static bool dccp_error(const struct dccp_hdr *dh, + goto out_invalid; + } + +- if (dh->dccph_type >= DCCP_PKT_INVALID) { ++ type = dh->dccph_type; ++ if (type >= DCCP_PKT_INVALID) { + msg = "nf_ct_dccp: reserved packet type "; + goto out_invalid; + } ++ ++ if (test_bit(type, &require_seq48) && !dh->dccph_x) { ++ msg = "nf_ct_dccp: type lacks 48bit sequence numbers"; ++ goto out_invalid; ++ } ++ + return false; + out_invalid: + nf_l4proto_log_invalid(skb, state, IPPROTO_DCCP, "%s", msg); + return true; + } + ++struct nf_conntrack_dccp_buf { ++ struct dccp_hdr dh; /* generic header part */ ++ struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ ++ union { /* depends on header type */ ++ struct dccp_hdr_ack_bits ack; ++ struct dccp_hdr_request req; ++ struct dccp_hdr_response response; ++ struct dccp_hdr_reset rst; ++ } u; ++}; ++ ++static struct dccp_hdr * ++dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, ++ struct nf_conntrack_dccp_buf *buf) ++{ ++ unsigned int hdrlen = __dccp_hdr_len(dh); ++ ++ if (hdrlen > sizeof(*buf)) ++ return NULL; ++ ++ return skb_header_pointer(skb, offset, hdrlen, buf); ++} ++ + int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, + unsigned int dataoff, + enum ip_conntrack_info ctinfo, + const struct nf_hook_state *state) + { + enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); +- struct dccp_hdr _dh, *dh; ++ struct nf_conntrack_dccp_buf _dh; + u_int8_t type, old_state, new_state; + enum ct_dccp_roles role; + unsigned int *timeouts; ++ struct dccp_hdr *dh; + +- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); ++ dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); + if (!dh) + return NF_DROP; + + if (dccp_error(dh, skb, dataoff, state)) + return -NF_ACCEPT; + ++ /* pull again, including possible 48 bit sequences and subtype header */ ++ dh = dccp_header_pointer(skb, dataoff, dh, &_dh); ++ if (!dh) ++ return NF_DROP; ++ + type = dh->dccph_type; + if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state)) + return -NF_ACCEPT; +-- +2.39.2 + diff --git a/queue-6.1/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch b/queue-6.1/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch new file mode 100644 index 00000000000..2bab0a23073 --- /dev/null +++ b/queue-6.1/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch @@ -0,0 +1,53 @@ +From 13a7a753fd04fc1388ef807678e337f06f4defe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 11:23:46 +0000 +Subject: netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() + return value. + +From: Ilia.Gavrilov + +[ Upstream commit f188d30087480eab421cd8ca552fb15f55d57f4d ] + +ct_sip_parse_numerical_param() returns only 0 or 1 now. +But process_register_request() and process_register_response() imply +checking for a negative value if parsing of a numerical header parameter +failed. +The invocation in nf_nat_sip() looks correct: + if (ct_sip_parse_numerical_param(...) > 0 && + ...) { ... } + +Make the return value of the function ct_sip_parse_numerical_param() +a tristate to fix all the cases +a) return 1 if value is found; *val is set +b) return 0 if value is not found; *val is unchanged +c) return -1 on error; *val is undefined + +Found by InfoTeCS on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: 0f32a40fc91a ("[NETFILTER]: nf_conntrack_sip: create signalling expectations") +Signed-off-by: Ilia.Gavrilov +Reviewed-by: Simon Horman +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_sip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c +index 77f5e82d8e3fe..d0eac27f6ba03 100644 +--- a/net/netfilter/nf_conntrack_sip.c ++++ b/net/netfilter/nf_conntrack_sip.c +@@ -611,7 +611,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr, + start += strlen(name); + *val = simple_strtoul(start, &end, 0); + if (start == end) +- return 0; ++ return -1; + if (matchoff && matchlen) { + *matchoff = start - dptr; + *matchlen = end - start; +-- +2.39.2 + diff --git a/queue-6.1/netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch b/queue-6.1/netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch new file mode 100644 index 00000000000..4eda1272887 --- /dev/null +++ b/queue-6.1/netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch @@ -0,0 +1,152 @@ +From 56bbab32d589c6bfd42253967a4c36b8cac0af82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 09:43:13 -0700 +Subject: netlink: Add __sock_i_ino() for __netlink_diag_dump(). + +From: Kuniyuki Iwashima + +[ Upstream commit 25a9c8a4431c364f97f75558cb346d2ad3f53fbb ] + +syzbot reported a warning in __local_bh_enable_ip(). [0] + +Commit 8d61f926d420 ("netlink: fix potential deadlock in +netlink_set_err()") converted read_lock(&nl_table_lock) to +read_lock_irqsave() in __netlink_diag_dump() to prevent a deadlock. + +However, __netlink_diag_dump() calls sock_i_ino() that uses +read_lock_bh() and read_unlock_bh(). If CONFIG_TRACE_IRQFLAGS=y, +read_unlock_bh() finally enables IRQ even though it should stay +disabled until the following read_unlock_irqrestore(). + +Using read_lock() in sock_i_ino() would trigger a lockdep splat +in another place that was fixed in commit f064af1e500a ("net: fix +a lockdep splat"), so let's add __sock_i_ino() that would be safe +to use under BH disabled. + +[0]: +WARNING: CPU: 0 PID: 5012 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 +Modules linked in: +CPU: 0 PID: 5012 Comm: syz-executor487 Not tainted 6.4.0-rc7-syzkaller-00202-g6f68fc395f49 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 +RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 +Code: 45 bf 01 00 00 00 e8 91 5b 0a 00 e8 3c 15 3d 00 fb 65 8b 05 ec e9 b5 7e 85 c0 74 58 5b 5d c3 65 8b 05 b2 b6 b4 7e 85 c0 75 a2 <0f> 0b eb 9e e8 89 15 3d 00 eb 9f 48 89 ef e8 6f 49 18 00 eb a8 0f +RSP: 0018:ffffc90003a1f3d0 EFLAGS: 00010046 +RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1cf5996 +RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8805c6f3 +RBP: ffffffff8805c6f3 R08: 0000000000000001 R09: ffff8880152b03a3 +R10: ffffed1002a56074 R11: 0000000000000005 R12: 00000000000073e4 +R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 +FS: 0000555556726300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000000045ad50 CR3: 000000007c646000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + sock_i_ino+0x83/0xa0 net/core/sock.c:2559 + __netlink_diag_dump+0x45c/0x790 net/netlink/diag.c:171 + netlink_diag_dump+0xd6/0x230 net/netlink/diag.c:207 + netlink_dump+0x570/0xc50 net/netlink/af_netlink.c:2269 + __netlink_dump_start+0x64b/0x910 net/netlink/af_netlink.c:2374 + netlink_dump_start include/linux/netlink.h:329 [inline] + netlink_diag_handler_dump+0x1ae/0x250 net/netlink/diag.c:238 + __sock_diag_cmd net/core/sock_diag.c:238 [inline] + sock_diag_rcv_msg+0x31e/0x440 net/core/sock_diag.c:269 + netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2547 + sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1914 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0xde/0x190 net/socket.c:747 + ____sys_sendmsg+0x71c/0x900 net/socket.c:2503 + ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557 + __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f5303aaabb9 +Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc7506e548 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5303aaabb9 +RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 +RBP: 00007f5303a6ed60 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5303a6edf0 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Fixes: 8d61f926d420 ("netlink: fix potential deadlock in netlink_set_err()") +Reported-by: syzbot+5da61cf6a9bc1902d422@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=5da61cf6a9bc1902d422 +Suggested-by: Eric Dumazet +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230626164313.52528-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 1 + + net/core/sock.c | 17 ++++++++++++++--- + net/netlink/diag.c | 2 +- + 3 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 2f35b82a123f8..1bbdddcf61542 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2124,6 +2124,7 @@ static inline void sock_graft(struct sock *sk, struct socket *parent) + } + + kuid_t sock_i_uid(struct sock *sk); ++unsigned long __sock_i_ino(struct sock *sk); + unsigned long sock_i_ino(struct sock *sk); + + static inline kuid_t sock_net_uid(const struct net *net, const struct sock *sk) +diff --git a/net/core/sock.c b/net/core/sock.c +index b021cb9c95ef3..0c1baa5517f11 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2542,13 +2542,24 @@ kuid_t sock_i_uid(struct sock *sk) + } + EXPORT_SYMBOL(sock_i_uid); + +-unsigned long sock_i_ino(struct sock *sk) ++unsigned long __sock_i_ino(struct sock *sk) + { + unsigned long ino; + +- read_lock_bh(&sk->sk_callback_lock); ++ read_lock(&sk->sk_callback_lock); + ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0; +- read_unlock_bh(&sk->sk_callback_lock); ++ read_unlock(&sk->sk_callback_lock); ++ return ino; ++} ++EXPORT_SYMBOL(__sock_i_ino); ++ ++unsigned long sock_i_ino(struct sock *sk) ++{ ++ unsigned long ino; ++ ++ local_bh_disable(); ++ ino = __sock_i_ino(sk); ++ local_bh_enable(); + return ino; + } + EXPORT_SYMBOL(sock_i_ino); +diff --git a/net/netlink/diag.c b/net/netlink/diag.c +index 4143b2ea4195a..e4f21b1067bcc 100644 +--- a/net/netlink/diag.c ++++ b/net/netlink/diag.c +@@ -168,7 +168,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, + NLM_F_MULTI, +- sock_i_ino(sk)) < 0) { ++ __sock_i_ino(sk)) < 0) { + ret = 1; + break; + } +-- +2.39.2 + diff --git a/queue-6.1/netlink-do-not-hard-code-device-address-lenth-in-fdb.patch b/queue-6.1/netlink-do-not-hard-code-device-address-lenth-in-fdb.patch new file mode 100644 index 00000000000..32d8d0d47b8 --- /dev/null +++ b/queue-6.1/netlink-do-not-hard-code-device-address-lenth-in-fdb.patch @@ -0,0 +1,157 @@ +From 06801f677144b378e0d0da211bd81f43eebf565f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 17:47:20 +0000 +Subject: netlink: do not hard code device address lenth in fdb dumps + +From: Eric Dumazet + +[ Upstream commit aa5406950726e336c5c9585b09799a734b6e77bf ] + +syzbot reports that some netdev devices do not have a six bytes +address [1] + +Replace ETH_ALEN by dev->addr_len. + +[1] (Case of a device where dev->addr_len = 4) + +BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] +BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169 +instrument_copy_to_user include/linux/instrumented.h:114 [inline] +copyout+0xb8/0x100 lib/iov_iter.c:169 +_copy_to_iter+0x6d8/0x1d00 lib/iov_iter.c:536 +copy_to_iter include/linux/uio.h:206 [inline] +simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513 +__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 +skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527 +skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] +netlink_recvmsg+0x4ae/0x15a0 net/netlink/af_netlink.c:1970 +sock_recvmsg_nosec net/socket.c:1019 [inline] +sock_recvmsg net/socket.c:1040 [inline] +____sys_recvmsg+0x283/0x7f0 net/socket.c:2722 +___sys_recvmsg+0x223/0x840 net/socket.c:2764 +do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858 +__sys_recvmmsg net/socket.c:2937 [inline] +__do_sys_recvmmsg net/socket.c:2960 [inline] +__se_sys_recvmmsg net/socket.c:2953 [inline] +__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was stored to memory at: +__nla_put lib/nlattr.c:1009 [inline] +nla_put+0x1c6/0x230 lib/nlattr.c:1067 +nlmsg_populate_fdb_fill+0x2b8/0x600 net/core/rtnetlink.c:4071 +nlmsg_populate_fdb net/core/rtnetlink.c:4418 [inline] +ndo_dflt_fdb_dump+0x616/0x840 net/core/rtnetlink.c:4456 +rtnl_fdb_dump+0x14ff/0x1fc0 net/core/rtnetlink.c:4629 +netlink_dump+0x9d1/0x1310 net/netlink/af_netlink.c:2268 +netlink_recvmsg+0xc5c/0x15a0 net/netlink/af_netlink.c:1995 +sock_recvmsg_nosec+0x7a/0x120 net/socket.c:1019 +____sys_recvmsg+0x664/0x7f0 net/socket.c:2720 +___sys_recvmsg+0x223/0x840 net/socket.c:2764 +do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858 +__sys_recvmmsg net/socket.c:2937 [inline] +__do_sys_recvmmsg net/socket.c:2960 [inline] +__se_sys_recvmmsg net/socket.c:2953 [inline] +__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: +slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716 +slab_alloc_node mm/slub.c:3451 [inline] +__kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490 +kmalloc_trace+0x51/0x200 mm/slab_common.c:1057 +kmalloc include/linux/slab.h:559 [inline] +__hw_addr_create net/core/dev_addr_lists.c:60 [inline] +__hw_addr_add_ex+0x2e5/0x9e0 net/core/dev_addr_lists.c:118 +__dev_mc_add net/core/dev_addr_lists.c:867 [inline] +dev_mc_add+0x9a/0x130 net/core/dev_addr_lists.c:885 +igmp6_group_added+0x267/0xbc0 net/ipv6/mcast.c:680 +ipv6_mc_up+0x296/0x3b0 net/ipv6/mcast.c:2754 +ipv6_mc_remap+0x1e/0x30 net/ipv6/mcast.c:2708 +addrconf_type_change net/ipv6/addrconf.c:3731 [inline] +addrconf_notify+0x4d3/0x1d90 net/ipv6/addrconf.c:3699 +notifier_call_chain kernel/notifier.c:93 [inline] +raw_notifier_call_chain+0xe4/0x430 kernel/notifier.c:461 +call_netdevice_notifiers_info net/core/dev.c:1935 [inline] +call_netdevice_notifiers_extack net/core/dev.c:1973 [inline] +call_netdevice_notifiers+0x1ee/0x2d0 net/core/dev.c:1987 +bond_enslave+0xccd/0x53f0 drivers/net/bonding/bond_main.c:1906 +do_set_master net/core/rtnetlink.c:2626 [inline] +rtnl_newlink_create net/core/rtnetlink.c:3460 [inline] +__rtnl_newlink net/core/rtnetlink.c:3660 [inline] +rtnl_newlink+0x378c/0x40e0 net/core/rtnetlink.c:3673 +rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6395 +netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546 +rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6413 +netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] +netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365 +netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913 +sock_sendmsg_nosec net/socket.c:724 [inline] +sock_sendmsg net/socket.c:747 [inline] +____sys_sendmsg+0x999/0xd50 net/socket.c:2503 +___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557 +__sys_sendmsg net/socket.c:2586 [inline] +__do_sys_sendmsg net/socket.c:2595 [inline] +__se_sys_sendmsg net/socket.c:2593 [inline] +__x64_sys_sendmsg+0x304/0x490 net/socket.c:2593 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Bytes 2856-2857 of 3500 are uninitialized +Memory access of size 3500 starts at ffff888018d99104 +Data copied to user address 0000000020000480 + +Fixes: d83b06036048 ("net: add fdb generic dump routine") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20230621174720.1845040-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index ef2a07ae5496e..5625ed30a06f3 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -3992,7 +3992,7 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb, + ndm->ndm_ifindex = dev->ifindex; + ndm->ndm_state = ndm_state; + +- if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr)) ++ if (nla_put(skb, NDA_LLADDR, dev->addr_len, addr)) + goto nla_put_failure; + if (vid) + if (nla_put(skb, NDA_VLAN, sizeof(u16), &vid)) +@@ -4006,10 +4006,10 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb, + return -EMSGSIZE; + } + +-static inline size_t rtnl_fdb_nlmsg_size(void) ++static inline size_t rtnl_fdb_nlmsg_size(const struct net_device *dev) + { + return NLMSG_ALIGN(sizeof(struct ndmsg)) + +- nla_total_size(ETH_ALEN) + /* NDA_LLADDR */ ++ nla_total_size(dev->addr_len) + /* NDA_LLADDR */ + nla_total_size(sizeof(u16)) + /* NDA_VLAN */ + 0; + } +@@ -4021,7 +4021,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type, + struct sk_buff *skb; + int err = -ENOBUFS; + +- skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC); ++ skb = nlmsg_new(rtnl_fdb_nlmsg_size(dev), GFP_ATOMIC); + if (!skb) + goto errout; + +-- +2.39.2 + diff --git a/queue-6.1/netlink-fix-potential-deadlock-in-netlink_set_err.patch b/queue-6.1/netlink-fix-potential-deadlock-in-netlink_set_err.patch new file mode 100644 index 00000000000..7a0e2e30059 --- /dev/null +++ b/queue-6.1/netlink-fix-potential-deadlock-in-netlink_set_err.patch @@ -0,0 +1,117 @@ +From af3e460c0ea4d27c30c8eb1390529f0559654dc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 15:43:37 +0000 +Subject: netlink: fix potential deadlock in netlink_set_err() + +From: Eric Dumazet + +[ Upstream commit 8d61f926d42045961e6b65191c09e3678d86a9cf ] + +syzbot reported a possible deadlock in netlink_set_err() [1] + +A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs +for netlink_lock_table()") in netlink_lock_table() + +This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump() +which were not covered by cited commit. + +[1] + +WARNING: possible irq lock inversion dependency detected +6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted + +syz-executor.2/23011 just changed the state of lock: +ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612 +but this lock was taken by another, SOFTIRQ-safe lock in the past: + (&local->queue_stop_reason_lock){..-.}-{2:2} + +and interrupts could create inverse lock ordering between them. + +other info that might help us debug this: + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(nl_table_lock); + local_irq_disable(); + lock(&local->queue_stop_reason_lock); + lock(nl_table_lock); + + lock(&local->queue_stop_reason_lock); + + *** DEADLOCK *** + +Fixes: 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()") +Reported-by: syzbot+a7d200a347f912723e5c@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=a7d200a347f912723e5c +Link: https://lore.kernel.org/netdev/000000000000e38d1605fea5747e@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Johannes Berg +Link: https://lore.kernel.org/r/20230621154337.1668594-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 5 +++-- + net/netlink/diag.c | 5 +++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 6d493a0ccf399..ed123cf462afe 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1589,6 +1589,7 @@ static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p) + int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) + { + struct netlink_set_err_data info; ++ unsigned long flags; + struct sock *sk; + int ret = 0; + +@@ -1598,12 +1599,12 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) + /* sk->sk_err wants a positive error value */ + info.code = -code; + +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + + sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) + ret += do_one_set_err(sk, &info); + +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + return ret; + } + EXPORT_SYMBOL(netlink_set_err); +diff --git a/net/netlink/diag.c b/net/netlink/diag.c +index c6255eac305c7..4143b2ea4195a 100644 +--- a/net/netlink/diag.c ++++ b/net/netlink/diag.c +@@ -94,6 +94,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + struct net *net = sock_net(skb->sk); + struct netlink_diag_req *req; + struct netlink_sock *nlsk; ++ unsigned long flags; + struct sock *sk; + int num = 2; + int ret = 0; +@@ -152,7 +153,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + num++; + + mc_list: +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + sk_for_each_bound(sk, &tbl->mc_list) { + if (sk_hashed(sk)) + continue; +@@ -173,7 +174,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + } + num++; + } +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + + done: + cb->args[0] = num; +-- +2.39.2 + diff --git a/queue-6.1/nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch b/queue-6.1/nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch new file mode 100644 index 00000000000..f49c4ab49c6 --- /dev/null +++ b/queue-6.1/nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch @@ -0,0 +1,41 @@ +From 7ed64f8f7f593739d4308cff6fa3d191e79e3e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 13:52:04 +0200 +Subject: nfc: llcp: fix possible use of uninitialized variable in + nfc_llcp_send_connect() + +From: Krzysztof Kozlowski + +[ Upstream commit 0d9b41daa5907756a31772d8af8ac5ff25cf17c1 ] + +If sock->service_name is NULL, the local variable +service_name_tlv_length will not be assigned by nfc_llcp_build_tlv(), +later leading to using value frmo the stack. Smatch warning: + + net/nfc/llcp_commands.c:442 nfc_llcp_send_connect() error: uninitialized symbol 'service_name_tlv_length'. + +Fixes: de9e5aeb4f40 ("NFC: llcp: Fix usage of llcp_add_tlv()") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_commands.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index 41e3a20c89355..cdb001de06928 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -390,7 +390,8 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) + const u8 *service_name_tlv = NULL; + const u8 *miux_tlv = NULL; + const u8 *rw_tlv = NULL; +- u8 service_name_tlv_length, miux_tlv_length, rw_tlv_length, rw; ++ u8 service_name_tlv_length = 0; ++ u8 miux_tlv_length, rw_tlv_length, rw; + int err; + u16 size = 0; + __be16 miux; +-- +2.39.2 + diff --git a/queue-6.1/nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch b/queue-6.1/nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch new file mode 100644 index 00000000000..b6e0f398909 --- /dev/null +++ b/queue-6.1/nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch @@ -0,0 +1,41 @@ +From 6c0e33fccf3b1d1041513da4875b68a574372a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 17:32:25 -0400 +Subject: NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION + +From: Olga Kornievskaia + +[ Upstream commit c907e72f58ed979a24a9fdcadfbc447c51d5e509 ] + +When the client received NFS4ERR_BADSESSION, it schedules recovery +and start the state manager thread which in turn freezes the +session table and does not allow for any new requests to use the +no-longer valid session. However, it is possible that before +the state manager thread runs, a new operation would use the +released slot that received BADSESSION and was therefore not +updated its sequence number. Such re-use of the slot can lead +the application errors. + +Fixes: 5c441544f045 ("NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 70e76359909cc..177cb7b089b9a 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -921,6 +921,7 @@ static int nfs41_sequence_process(struct rpc_task *task, + out_noaction: + return ret; + session_recover: ++ set_bit(NFS4_SLOT_TBL_DRAINING, &session->fc_slot_table.slot_tbl_state); + nfs4_schedule_session_recovery(session, status); + dprintk("%s ERROR: %d Reset session\n", __func__, status); + nfs41_sequence_free_slot(res); +-- +2.39.2 + diff --git a/queue-6.1/nfsv4.2-fix-wrong-shrinker_id.patch b/queue-6.1/nfsv4.2-fix-wrong-shrinker_id.patch new file mode 100644 index 00000000000..2d8826aa5a6 --- /dev/null +++ b/queue-6.1/nfsv4.2-fix-wrong-shrinker_id.patch @@ -0,0 +1,170 @@ +From e196d2c5a07b17fe0e8e0af5b22ca1ef78429668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 11:19:46 +0000 +Subject: NFSv4.2: fix wrong shrinker_id + +From: Qi Zheng + +[ Upstream commit 7f7ab336898f281e58540ef781a8fb375acc32a9 ] + +Currently, the list_lru::shrinker_id corresponding to the nfs4_xattr +shrinkers is wrong: + +>>> prog["nfs4_xattr_cache_lru"].shrinker_id +(int)0 +>>> prog["nfs4_xattr_entry_lru"].shrinker_id +(int)0 +>>> prog["nfs4_xattr_large_entry_lru"].shrinker_id +(int)0 +>>> prog["nfs4_xattr_cache_shrinker"].id +(int)18 +>>> prog["nfs4_xattr_entry_shrinker"].id +(int)19 +>>> prog["nfs4_xattr_large_entry_shrinker"].id +(int)20 + +This is not what we expect, which will cause these shrinkers +not to be found in shrink_slab_memcg(). + +We should assign shrinker::id before calling list_lru_init_memcg(), +so that the corresponding list_lru::shrinker_id will be assigned +the correct value like below: + +>>> prog["nfs4_xattr_cache_lru"].shrinker_id +(int)16 +>>> prog["nfs4_xattr_entry_lru"].shrinker_id +(int)17 +>>> prog["nfs4_xattr_large_entry_lru"].shrinker_id +(int)18 +>>> prog["nfs4_xattr_cache_shrinker"].id +(int)16 +>>> prog["nfs4_xattr_entry_shrinker"].id +(int)17 +>>> prog["nfs4_xattr_large_entry_shrinker"].id +(int)18 + +So just do it. + +Fixes: 95ad37f90c33 ("NFSv4.2: add client side xattr caching.") +Signed-off-by: Qi Zheng +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xattr.c | 79 +++++++++++++++++++++++++-------------------- + 1 file changed, 44 insertions(+), 35 deletions(-) + +diff --git a/fs/nfs/nfs42xattr.c b/fs/nfs/nfs42xattr.c +index 76ae118342066..911f634ba3da7 100644 +--- a/fs/nfs/nfs42xattr.c ++++ b/fs/nfs/nfs42xattr.c +@@ -991,6 +991,29 @@ static void nfs4_xattr_cache_init_once(void *p) + INIT_LIST_HEAD(&cache->dispose); + } + ++static int nfs4_xattr_shrinker_init(struct shrinker *shrinker, ++ struct list_lru *lru, const char *name) ++{ ++ int ret = 0; ++ ++ ret = register_shrinker(shrinker, name); ++ if (ret) ++ return ret; ++ ++ ret = list_lru_init_memcg(lru, shrinker); ++ if (ret) ++ unregister_shrinker(shrinker); ++ ++ return ret; ++} ++ ++static void nfs4_xattr_shrinker_destroy(struct shrinker *shrinker, ++ struct list_lru *lru) ++{ ++ unregister_shrinker(shrinker); ++ list_lru_destroy(lru); ++} ++ + int __init nfs4_xattr_cache_init(void) + { + int ret = 0; +@@ -1002,44 +1025,30 @@ int __init nfs4_xattr_cache_init(void) + if (nfs4_xattr_cache_cachep == NULL) + return -ENOMEM; + +- ret = list_lru_init_memcg(&nfs4_xattr_large_entry_lru, +- &nfs4_xattr_large_entry_shrinker); +- if (ret) +- goto out4; +- +- ret = list_lru_init_memcg(&nfs4_xattr_entry_lru, +- &nfs4_xattr_entry_shrinker); +- if (ret) +- goto out3; +- +- ret = list_lru_init_memcg(&nfs4_xattr_cache_lru, +- &nfs4_xattr_cache_shrinker); +- if (ret) +- goto out2; +- +- ret = register_shrinker(&nfs4_xattr_cache_shrinker, "nfs-xattr_cache"); ++ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_cache_shrinker, ++ &nfs4_xattr_cache_lru, ++ "nfs-xattr_cache"); + if (ret) + goto out1; + +- ret = register_shrinker(&nfs4_xattr_entry_shrinker, "nfs-xattr_entry"); ++ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_entry_shrinker, ++ &nfs4_xattr_entry_lru, ++ "nfs-xattr_entry"); + if (ret) +- goto out; ++ goto out2; + +- ret = register_shrinker(&nfs4_xattr_large_entry_shrinker, +- "nfs-xattr_large_entry"); ++ ret = nfs4_xattr_shrinker_init(&nfs4_xattr_large_entry_shrinker, ++ &nfs4_xattr_large_entry_lru, ++ "nfs-xattr_large_entry"); + if (!ret) + return 0; + +- unregister_shrinker(&nfs4_xattr_entry_shrinker); +-out: +- unregister_shrinker(&nfs4_xattr_cache_shrinker); +-out1: +- list_lru_destroy(&nfs4_xattr_cache_lru); ++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_entry_shrinker, ++ &nfs4_xattr_entry_lru); + out2: +- list_lru_destroy(&nfs4_xattr_entry_lru); +-out3: +- list_lru_destroy(&nfs4_xattr_large_entry_lru); +-out4: ++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_cache_shrinker, ++ &nfs4_xattr_cache_lru); ++out1: + kmem_cache_destroy(nfs4_xattr_cache_cachep); + + return ret; +@@ -1047,11 +1056,11 @@ int __init nfs4_xattr_cache_init(void) + + void nfs4_xattr_cache_exit(void) + { +- unregister_shrinker(&nfs4_xattr_large_entry_shrinker); +- unregister_shrinker(&nfs4_xattr_entry_shrinker); +- unregister_shrinker(&nfs4_xattr_cache_shrinker); +- list_lru_destroy(&nfs4_xattr_large_entry_lru); +- list_lru_destroy(&nfs4_xattr_entry_lru); +- list_lru_destroy(&nfs4_xattr_cache_lru); ++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_large_entry_shrinker, ++ &nfs4_xattr_large_entry_lru); ++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_entry_shrinker, ++ &nfs4_xattr_entry_lru); ++ nfs4_xattr_shrinker_destroy(&nfs4_xattr_cache_shrinker, ++ &nfs4_xattr_cache_lru); + kmem_cache_destroy(nfs4_xattr_cache_cachep); + } +-- +2.39.2 + diff --git a/queue-6.1/nvme-auth-don-t-ignore-key-generation-failures-when-.patch b/queue-6.1/nvme-auth-don-t-ignore-key-generation-failures-when-.patch new file mode 100644 index 00000000000..1937e2a5f6e --- /dev/null +++ b/queue-6.1/nvme-auth-don-t-ignore-key-generation-failures-when-.patch @@ -0,0 +1,104 @@ +From 80ec0b884de193931cf4c9e1f0aaa7bb715b4de1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 13:24:10 +0200 +Subject: nvme-auth: don't ignore key generation failures when initializing + ctrl keys + +From: Sagi Grimberg + +[ Upstream commit 193a8c7e5f1a8481841636cec9c185543ec5c759 ] + +nvme_auth_generate_key can fail, don't ignore it upon initialization. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Stable-dep-of: 7ed5cf8e6d9b ("nvme-core: fix dev_pm_qos memleak") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 19 +++++++++++++++---- + drivers/nvme/host/core.c | 6 +++++- + drivers/nvme/host/nvme.h | 7 +++++-- + 3 files changed, 25 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index 1a27d7fb4fa91..9dfd3d0293054 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -956,15 +956,26 @@ static void nvme_ctrl_auth_work(struct work_struct *work) + */ + } + +-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) ++int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) + { ++ int ret; ++ + INIT_LIST_HEAD(&ctrl->dhchap_auth_list); + INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work); + mutex_init(&ctrl->dhchap_auth_mutex); + if (!ctrl->opts) +- return; +- nvme_auth_generate_key(ctrl->opts->dhchap_secret, &ctrl->host_key); +- nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, &ctrl->ctrl_key); ++ return 0; ++ ret = nvme_auth_generate_key(ctrl->opts->dhchap_secret, ++ &ctrl->host_key); ++ if (ret) ++ return ret; ++ ret = nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, ++ &ctrl->ctrl_key); ++ if (ret) { ++ nvme_auth_free_key(ctrl->host_key); ++ ctrl->host_key = NULL; ++ } ++ return ret; + } + EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl); + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 2b07a67958b46..09ff0d75aaf38 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -5171,9 +5171,13 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + + nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device)); + nvme_mpath_init_ctrl(ctrl); +- nvme_auth_init_ctrl(ctrl); ++ ret = nvme_auth_init_ctrl(ctrl); ++ if (ret) ++ goto out_free_cdev; + + return 0; ++out_free_cdev: ++ cdev_device_del(&ctrl->cdev, ctrl->device); + out_free_name: + nvme_put_ctrl(ctrl); + kfree_const(ctrl->device->kobj.name); +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 5ed771d576c6d..69f9e69208f68 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -1028,13 +1028,16 @@ static inline bool nvme_ctrl_sgl_supported(struct nvme_ctrl *ctrl) + } + + #ifdef CONFIG_NVME_AUTH +-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl); ++int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_auth_stop(struct nvme_ctrl *ctrl); + int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid); + int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid); + void nvme_auth_free(struct nvme_ctrl *ctrl); + #else +-static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {}; ++static inline int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) ++{ ++ return 0; ++} + static inline void nvme_auth_stop(struct nvme_ctrl *ctrl) {}; + static inline int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid) + { +-- +2.39.2 + diff --git a/queue-6.1/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch b/queue-6.1/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch new file mode 100644 index 00000000000..ac222caa7b5 --- /dev/null +++ b/queue-6.1/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch @@ -0,0 +1,85 @@ +From 84b34a1452af19b91a032d9d4e996a51a95d2475 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 13:24:17 +0200 +Subject: nvme-auth: no need to reset chap contexts on re-authentication + +From: Sagi Grimberg + +[ Upstream commit e8a420efb637f52c586596283d6fd96f2a7ecb5c ] + +Now that the chap context is reset upon completion, this is no longer +needed. Also remove nvme_auth_reset as no callers are left. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 13 ------------- + drivers/nvme/host/core.c | 4 ---- + drivers/nvme/host/nvme.h | 1 - + 3 files changed, 18 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index 2f823c6b84fd3..1a27d7fb4fa91 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -920,19 +920,6 @@ int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid) + } + EXPORT_SYMBOL_GPL(nvme_auth_wait); + +-void nvme_auth_reset(struct nvme_ctrl *ctrl) +-{ +- struct nvme_dhchap_queue_context *chap; +- +- mutex_lock(&ctrl->dhchap_auth_mutex); +- list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) { +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- flush_work(&chap->auth_work); +- nvme_auth_reset_dhchap(chap); +- } +- mutex_unlock(&ctrl->dhchap_auth_mutex); +-} +- + static void nvme_ctrl_auth_work(struct work_struct *work) + { + struct nvme_ctrl *ctrl = +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index a7d9b5b42b388..b63511f481a7f 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3832,8 +3832,6 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev, + host_key = ctrl->host_key; + ctrl->host_key = key; + nvme_auth_free_key(host_key); +- /* Key has changed; re-authentication with new key */ +- nvme_auth_reset(ctrl); + } + /* Start re-authentication */ + dev_info(ctrl->device, "re-authenticating controller\n"); +@@ -3886,8 +3884,6 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev, + ctrl_key = ctrl->ctrl_key; + ctrl->ctrl_key = key; + nvme_auth_free_key(ctrl_key); +- /* Key has changed; re-authentication with new key */ +- nvme_auth_reset(ctrl); + } + /* Start re-authentication */ + dev_info(ctrl->device, "re-authenticating controller\n"); +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 2aa514c3dfa17..5ed771d576c6d 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -1032,7 +1032,6 @@ void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_auth_stop(struct nvme_ctrl *ctrl); + int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid); + int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid); +-void nvme_auth_reset(struct nvme_ctrl *ctrl); + void nvme_auth_free(struct nvme_ctrl *ctrl); + #else + static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {}; +-- +2.39.2 + diff --git a/queue-6.1/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch b/queue-6.1/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch new file mode 100644 index 00000000000..d87b2358deb --- /dev/null +++ b/queue-6.1/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch @@ -0,0 +1,36 @@ +From 1ed286ae7d2f20036c4af08f280ba9d7cc776103 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 13:24:07 +0200 +Subject: nvme-auth: remove symbol export from nvme_auth_reset + +From: Sagi Grimberg + +[ Upstream commit 100b555bc204fc754108351676297805f5affa49 ] + +Only the nvme module calls it. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index e3e801e2b78d5..2f823c6b84fd3 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -932,7 +932,6 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl) + } + mutex_unlock(&ctrl->dhchap_auth_mutex); + } +-EXPORT_SYMBOL_GPL(nvme_auth_reset); + + static void nvme_ctrl_auth_work(struct work_struct *work) + { +-- +2.39.2 + diff --git a/queue-6.1/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch b/queue-6.1/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch new file mode 100644 index 00000000000..f4b497082e6 --- /dev/null +++ b/queue-6.1/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch @@ -0,0 +1,79 @@ +From 7723b221c425cae31f6a2749dddde25d82f43e53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 13:24:05 +0200 +Subject: nvme-auth: rename __nvme_auth_[reset|free] to + nvme_auth[reset|free]_dhchap + +From: Sagi Grimberg + +[ Upstream commit 0a7ce375f83f4ade7c2a835444093b6870fb8257 ] + +nvme_auth_[reset|free] operate on the controller while +__nvme_auth_[reset|free] operate on a chap struct (which maps to a queue +context). Rename it for clarity. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index c8a6db7c44980..d45333268fcf6 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -654,7 +654,7 @@ static int nvme_auth_dhchap_exponential(struct nvme_ctrl *ctrl, + return 0; + } + +-static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap) ++static void nvme_auth_reset_dhchap(struct nvme_dhchap_queue_context *chap) + { + kfree_sensitive(chap->host_response); + chap->host_response = NULL; +@@ -676,9 +676,9 @@ static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap) + memset(chap->c2, 0, sizeof(chap->c2)); + } + +-static void __nvme_auth_free(struct nvme_dhchap_queue_context *chap) ++static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap) + { +- __nvme_auth_reset(chap); ++ nvme_auth_reset_dhchap(chap); + if (chap->shash_tfm) + crypto_free_shash(chap->shash_tfm); + if (chap->dh_tfm) +@@ -868,7 +868,7 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid) + dev_dbg(ctrl->device, "qid %d: re-using context\n", qid); + mutex_unlock(&ctrl->dhchap_auth_mutex); + flush_work(&chap->auth_work); +- __nvme_auth_reset(chap); ++ nvme_auth_reset_dhchap(chap); + queue_work(nvme_wq, &chap->auth_work); + return 0; + } +@@ -928,7 +928,7 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl) + list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) { + mutex_unlock(&ctrl->dhchap_auth_mutex); + flush_work(&chap->auth_work); +- __nvme_auth_reset(chap); ++ nvme_auth_reset_dhchap(chap); + } + mutex_unlock(&ctrl->dhchap_auth_mutex); + } +@@ -1002,7 +1002,7 @@ void nvme_auth_free(struct nvme_ctrl *ctrl) + list_for_each_entry_safe(chap, tmp, &ctrl->dhchap_auth_list, entry) { + list_del_init(&chap->entry); + flush_work(&chap->auth_work); +- __nvme_auth_free(chap); ++ nvme_auth_free_dhchap(chap); + } + mutex_unlock(&ctrl->dhchap_auth_mutex); + if (ctrl->host_key) { +-- +2.39.2 + diff --git a/queue-6.1/nvme-auth-rename-authentication-work-elements.patch b/queue-6.1/nvme-auth-rename-authentication-work-elements.patch new file mode 100644 index 00000000000..2f8526c6a25 --- /dev/null +++ b/queue-6.1/nvme-auth-rename-authentication-work-elements.patch @@ -0,0 +1,65 @@ +From b031b14d062a69d0c4126fb3206cf141f153a02b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 13:24:06 +0200 +Subject: nvme-auth: rename authentication work elements + +From: Sagi Grimberg + +[ Upstream commit 0c999e69c40a87285f910c400b550fad866e99d0 ] + +Use nvme_ctrl_auth_work and nvme_queue_auth_work for better +readability. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Stable-dep-of: a836ca33c5b0 ("nvme-core: fix memory leak in dhchap_secret_store") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/auth.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index d45333268fcf6..e3e801e2b78d5 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -691,7 +691,7 @@ static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap) + kfree(chap); + } + +-static void __nvme_auth_work(struct work_struct *work) ++static void nvme_queue_auth_work(struct work_struct *work) + { + struct nvme_dhchap_queue_context *chap = + container_of(work, struct nvme_dhchap_queue_context, auth_work); +@@ -893,7 +893,7 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid) + return -ENOMEM; + } + +- INIT_WORK(&chap->auth_work, __nvme_auth_work); ++ INIT_WORK(&chap->auth_work, nvme_queue_auth_work); + list_add(&chap->entry, &ctrl->dhchap_auth_list); + mutex_unlock(&ctrl->dhchap_auth_mutex); + queue_work(nvme_wq, &chap->auth_work); +@@ -934,7 +934,7 @@ void nvme_auth_reset(struct nvme_ctrl *ctrl) + } + EXPORT_SYMBOL_GPL(nvme_auth_reset); + +-static void nvme_dhchap_auth_work(struct work_struct *work) ++static void nvme_ctrl_auth_work(struct work_struct *work) + { + struct nvme_ctrl *ctrl = + container_of(work, struct nvme_ctrl, dhchap_auth_work); +@@ -973,7 +973,7 @@ static void nvme_dhchap_auth_work(struct work_struct *work) + void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) + { + INIT_LIST_HEAD(&ctrl->dhchap_auth_list); +- INIT_WORK(&ctrl->dhchap_auth_work, nvme_dhchap_auth_work); ++ INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work); + mutex_init(&ctrl->dhchap_auth_mutex); + if (!ctrl->opts) + return; +-- +2.39.2 + diff --git a/queue-6.1/nvme-core-add-missing-fault-injection-cleanup.patch b/queue-6.1/nvme-core-add-missing-fault-injection-cleanup.patch new file mode 100644 index 00000000000..e57a8ac7a26 --- /dev/null +++ b/queue-6.1/nvme-core-add-missing-fault-injection-cleanup.patch @@ -0,0 +1,48 @@ +From ea806312217dc01c9b06c3752743b9a8792cae2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 00:31:14 -0700 +Subject: nvme-core: add missing fault-injection cleanup + +From: Chaitanya Kulkarni + +[ Upstream commit 3a12a0b868a512fcada564699d00f5e652c0998c ] + +Add missing fault-injection cleanup in nvme_init_ctrl() in the error +unwind path that also fixes following message for blktests:- + +linux-block (for-next) # grep debugfs debugfs-err.log +[ 147.853464] debugfs: Directory 'nvme1' with parent '/' already present! +[ 147.853973] nvme1: failed to create debugfs attr +[ 148.802490] debugfs: Directory 'nvme1' with parent '/' already present! +[ 148.803244] nvme1: failed to create debugfs attr +[ 148.877304] debugfs: Directory 'nvme1' with parent '/' already present! +[ 148.877775] nvme1: failed to create debugfs attr +[ 149.816652] debugfs: Directory 'nvme1' with parent '/' already present! +[ 149.818011] nvme1: failed to create debugfs attr + +Signed-off-by: Chaitanya Kulkarni +Tested-by: Yi Zhang +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Stable-dep-of: 7ed5cf8e6d9b ("nvme-core: fix dev_pm_qos memleak") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 09ff0d75aaf38..8414e1a036464 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -5177,6 +5177,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + + return 0; + out_free_cdev: ++ nvme_fault_inject_fini(&ctrl->fault_inject); + cdev_device_del(&ctrl->cdev, ctrl->device); + out_free_name: + nvme_put_ctrl(ctrl); +-- +2.39.2 + diff --git a/queue-6.1/nvme-core-fix-dev_pm_qos-memleak.patch b/queue-6.1/nvme-core-fix-dev_pm_qos-memleak.patch new file mode 100644 index 00000000000..d323506ecd6 --- /dev/null +++ b/queue-6.1/nvme-core-fix-dev_pm_qos-memleak.patch @@ -0,0 +1,59 @@ +From a7f4beb7f878b5d3e4efdf9220c2ea93fca8b9e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 00:31:15 -0700 +Subject: nvme-core: fix dev_pm_qos memleak + +From: Chaitanya Kulkarni + +[ Upstream commit 7ed5cf8e6d9bfb6a78d0471317edff14f0f2b4dd ] + +Call dev_pm_qos_hide_latency_tolerance() in the error unwind patch to +avoid following kmemleak:- + +blktests (master) # kmemleak-clear; ./check nvme/044; +blktests (master) # kmemleak-scan ; kmemleak-show +nvme/044 (Test bi-directional authentication) [passed] + runtime 2.111s ... 2.124s +unreferenced object 0xffff888110c46240 (size 96): + comm "nvme", pid 33461, jiffies 4345365353 (age 75.586s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000069ac2cec>] kmalloc_trace+0x25/0x90 + [<000000006acc66d5>] dev_pm_qos_update_user_latency_tolerance+0x6f/0x100 + [<00000000cc376ea7>] nvme_init_ctrl+0x38e/0x410 [nvme_core] + [<000000007df61b4b>] 0xffffffffc05e88b3 + [<00000000d152b985>] 0xffffffffc05744cb + [<00000000f04a4041>] vfs_write+0xc5/0x3c0 + [<00000000f9491baf>] ksys_write+0x5f/0xe0 + [<000000001c46513d>] do_syscall_64+0x3b/0x90 + [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Link: https://lore.kernel.org/linux-nvme/CAHj4cs-nDaKzMx2txO4dbE+Mz9ePwLtU0e3egz+StmzOUgWUrA@mail.gmail.com/ +Fixes: f50fff73d620 ("nvme: implement In-Band authentication") +Signed-off-by: Chaitanya Kulkarni +Tested-by: Yi Zhang +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 8414e1a036464..560ce2f05a96d 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -5178,6 +5178,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + return 0; + out_free_cdev: + nvme_fault_inject_fini(&ctrl->fault_inject); ++ dev_pm_qos_hide_latency_tolerance(ctrl->device); + cdev_device_del(&ctrl->cdev, ctrl->device); + out_free_name: + nvme_put_ctrl(ctrl); +-- +2.39.2 + diff --git a/queue-6.1/nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch b/queue-6.1/nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch new file mode 100644 index 00000000000..3e5f5b366f4 --- /dev/null +++ b/queue-6.1/nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch @@ -0,0 +1,49 @@ +From 516bf6424106f02351c6f78b0edf5b9de2dd4c97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 00:31:13 -0700 +Subject: nvme-core: fix memory leak in dhchap_ctrl_secret + +From: Chaitanya Kulkarni + +[ Upstream commit 99c2dcc8ffc24e210a3aa05c204d92f3ef460b05 ] + +Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we +return when nvme_auth_generate_key() returns error. + +Fixes: f50fff73d620 ("nvme: implement In-Band authentication") +Signed-off-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 3956164272253..2b07a67958b46 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3880,14 +3880,17 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev, + int ret; + + ret = nvme_auth_generate_key(dhchap_secret, &key); +- if (ret) ++ if (ret) { ++ kfree(dhchap_secret); + return ret; ++ } + kfree(opts->dhchap_ctrl_secret); + opts->dhchap_ctrl_secret = dhchap_secret; + ctrl_key = ctrl->ctrl_key; + ctrl->ctrl_key = key; + nvme_auth_free_key(ctrl_key); +- } ++ } else ++ kfree(dhchap_secret); + /* Start re-authentication */ + dev_info(ctrl->device, "re-authenticating controller\n"); + queue_work(nvme_wq, &ctrl->dhchap_auth_work); +-- +2.39.2 + diff --git a/queue-6.1/nvme-core-fix-memory-leak-in-dhchap_secret_store.patch b/queue-6.1/nvme-core-fix-memory-leak-in-dhchap_secret_store.patch new file mode 100644 index 00000000000..427f3da6b28 --- /dev/null +++ b/queue-6.1/nvme-core-fix-memory-leak-in-dhchap_secret_store.patch @@ -0,0 +1,77 @@ +From a91b43cd5d0403e9fa080b236f1d4f60a3f80a6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 00:31:12 -0700 +Subject: nvme-core: fix memory leak in dhchap_secret_store + +From: Chaitanya Kulkarni + +[ Upstream commit a836ca33c5b07d34dd5347af9f64d25651d12674 ] + +Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return +fix following kmemleack:- + +unreferenced object 0xffff8886376ea800 (size 64): + comm "check", pid 22048, jiffies 4344316705 (age 92.199s) + hex dump (first 32 bytes): + 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg + 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL + backtrace: + [<0000000030ce5d4b>] __kmalloc+0x4b/0x130 + [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core] + [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0 + [<00000000437e7ced>] vfs_write+0x2ba/0x3c0 + [<00000000f9491baf>] ksys_write+0x5f/0xe0 + [<000000001c46513d>] do_syscall_64+0x3b/0x90 + [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc +unreferenced object 0xffff8886376eaf00 (size 64): + comm "check", pid 22048, jiffies 4344316736 (age 92.168s) + hex dump (first 32 bytes): + 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg + 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL + backtrace: + [<0000000030ce5d4b>] __kmalloc+0x4b/0x130 + [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core] + [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0 + [<00000000437e7ced>] vfs_write+0x2ba/0x3c0 + [<00000000f9491baf>] ksys_write+0x5f/0xe0 + [<000000001c46513d>] do_syscall_64+0x3b/0x90 + [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Fixes: f50fff73d620 ("nvme: implement In-Band authentication") +Signed-off-by: Chaitanya Kulkarni +Tested-by: Yi Zhang +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index b63511f481a7f..3956164272253 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3825,14 +3825,17 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev, + int ret; + + ret = nvme_auth_generate_key(dhchap_secret, &key); +- if (ret) ++ if (ret) { ++ kfree(dhchap_secret); + return ret; ++ } + kfree(opts->dhchap_secret); + opts->dhchap_secret = dhchap_secret; + host_key = ctrl->host_key; + ctrl->host_key = key; + nvme_auth_free_key(host_key); +- } ++ } else ++ kfree(dhchap_secret); + /* Start re-authentication */ + dev_info(ctrl->device, "re-authenticating controller\n"); + queue_work(nvme_wq, &ctrl->dhchap_auth_work); +-- +2.39.2 + diff --git a/queue-6.1/ocfs2-fix-use-of-slab-data-with-sendpage.patch b/queue-6.1/ocfs2-fix-use-of-slab-data-with-sendpage.patch new file mode 100644 index 00000000000..cd8b98335e4 --- /dev/null +++ b/queue-6.1/ocfs2-fix-use-of-slab-data-with-sendpage.patch @@ -0,0 +1,89 @@ +From 21f73dfa2db4bc8bd0e2c905e6d25a126ed61506 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 23:55:10 +0100 +Subject: ocfs2: Fix use of slab data with sendpage + +From: David Howells + +[ Upstream commit 86d7bd6e66e9925f0f04a7bcf3c92c05fdfefb5a ] + +ocfs2 uses kzalloc() to allocate buffers for o2net_hand, o2net_keep_req and +o2net_keep_resp and then passes these to sendpage. This isn't really +allowed as the lifetime of slab objects is not controlled by page ref - +though in this case it will probably work. sendmsg() with MSG_SPLICE_PAGES +will, however, print a warning and give an error. + +Fix it to use folio_alloc() instead to allocate a buffer for the handshake +message, keepalive request and reply messages. + +Fixes: 98211489d414 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem") +Signed-off-by: David Howells +cc: Mark Fasheh +cc: Kurt Hackel +cc: Joel Becker +cc: Joseph Qi +cc: ocfs2-devel@oss.oracle.com +Link: https://lore.kernel.org/r/20230623225513.2732256-14-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + fs/ocfs2/cluster/tcp.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c +index 785cabd71d670..4e083e25d0e7d 100644 +--- a/fs/ocfs2/cluster/tcp.c ++++ b/fs/ocfs2/cluster/tcp.c +@@ -2083,18 +2083,24 @@ void o2net_stop_listening(struct o2nm_node *node) + + int o2net_init(void) + { ++ struct folio *folio; ++ void *p; + unsigned long i; + + o2quo_init(); +- + o2net_debugfs_init(); + +- o2net_hand = kzalloc(sizeof(struct o2net_handshake), GFP_KERNEL); +- o2net_keep_req = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL); +- o2net_keep_resp = kzalloc(sizeof(struct o2net_msg), GFP_KERNEL); +- if (!o2net_hand || !o2net_keep_req || !o2net_keep_resp) ++ folio = folio_alloc(GFP_KERNEL | __GFP_ZERO, 0); ++ if (!folio) + goto out; + ++ p = folio_address(folio); ++ o2net_hand = p; ++ p += sizeof(struct o2net_handshake); ++ o2net_keep_req = p; ++ p += sizeof(struct o2net_msg); ++ o2net_keep_resp = p; ++ + o2net_hand->protocol_version = cpu_to_be64(O2NET_PROTOCOL_VERSION); + o2net_hand->connector_id = cpu_to_be64(1); + +@@ -2120,9 +2126,6 @@ int o2net_init(void) + return 0; + + out: +- kfree(o2net_hand); +- kfree(o2net_keep_req); +- kfree(o2net_keep_resp); + o2net_debugfs_exit(); + o2quo_exit(); + return -ENOMEM; +@@ -2131,8 +2134,6 @@ int o2net_init(void) + void o2net_exit(void) + { + o2quo_exit(); +- kfree(o2net_hand); +- kfree(o2net_keep_req); +- kfree(o2net_keep_resp); + o2net_debugfs_exit(); ++ folio_put(virt_to_folio(o2net_hand)); + } +-- +2.39.2 + diff --git a/queue-6.1/ovl-update-of-dentry-revalidate-flags-after-copy-up.patch b/queue-6.1/ovl-update-of-dentry-revalidate-flags-after-copy-up.patch new file mode 100644 index 00000000000..612af33976c --- /dev/null +++ b/queue-6.1/ovl-update-of-dentry-revalidate-flags-after-copy-up.patch @@ -0,0 +1,163 @@ +From 8799048dc96af937b7e3018aa174f6c27bdd0b51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 11:29:59 +0300 +Subject: ovl: update of dentry revalidate flags after copy up + +From: Amir Goldstein + +[ Upstream commit b07d5cc93e1b28df47a72c519d09d0a836043613 ] + +After copy up, we may need to update d_flags if upper dentry is on a +remote fs and lower dentries are not. + +Add helpers to allow incremental update of the revalidate flags. + +Fixes: bccece1ead36 ("ovl: allow remote upper") +Reviewed-by: Gao Xiang +Signed-off-by: Amir Goldstein +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/copy_up.c | 2 ++ + fs/overlayfs/dir.c | 3 +-- + fs/overlayfs/export.c | 3 +-- + fs/overlayfs/namei.c | 3 +-- + fs/overlayfs/overlayfs.h | 6 ++++-- + fs/overlayfs/super.c | 2 +- + fs/overlayfs/util.c | 24 ++++++++++++++++++++---- + 7 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 91a95bfad0d1c..edc1ebff33f5a 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -538,6 +538,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) + /* Restore timestamps on parent (best effort) */ + ovl_set_timestamps(ofs, upperdir, &c->pstat); + ovl_dentry_set_upper_alias(c->dentry); ++ ovl_dentry_update_reval(c->dentry, upper); + } + } + inode_unlock(udir); +@@ -857,6 +858,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) + inode_unlock(udir); + + ovl_dentry_set_upper_alias(c->dentry); ++ ovl_dentry_update_reval(c->dentry, ovl_dentry_upper(c->dentry)); + } + + out: +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index c3032cef391ef..5339ff08bd0f4 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -269,8 +269,7 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode, + + ovl_dir_modified(dentry->d_parent, false); + ovl_dentry_set_upper_alias(dentry); +- ovl_dentry_update_reval(dentry, newdentry, +- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_reval(dentry, newdentry); + + if (!hardlink) { + /* +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index ac9c3ad04016e..e55363d343dc6 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -326,8 +326,7 @@ static struct dentry *ovl_obtain_alias(struct super_block *sb, + if (upper_alias) + ovl_dentry_set_upper_alias(dentry); + +- ovl_dentry_update_reval(dentry, upper, +- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_reval(dentry, upper); + + return d_instantiate_anon(dentry, inode); + +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index 0fd1d5fdfc728..655d08d6f3f17 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -1116,8 +1116,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, + ovl_set_flag(OVL_UPPERDATA, inode); + } + +- ovl_dentry_update_reval(dentry, upperdentry, +- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_reval(dentry, upperdentry); + + revert_creds(old_cred); + if (origin_path) { +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index e74a610a117ec..052226aa7de09 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -360,8 +360,10 @@ bool ovl_index_all(struct super_block *sb); + bool ovl_verify_lower(struct super_block *sb); + struct ovl_entry *ovl_alloc_entry(unsigned int numlower); + bool ovl_dentry_remote(struct dentry *dentry); +-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry, +- unsigned int mask); ++void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry); ++void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry); ++void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry, ++ unsigned int mask); + bool ovl_dentry_weird(struct dentry *dentry); + enum ovl_path_type ovl_path_type(struct dentry *dentry); + void ovl_path_upper(struct dentry *dentry, struct path *path); +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 3d14a3f1465d1..51eec4a8e82b2 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -1980,7 +1980,7 @@ static struct dentry *ovl_get_root(struct super_block *sb, + ovl_dentry_set_flag(OVL_E_CONNECTED, root); + ovl_set_upperdata(d_inode(root)); + ovl_inode_init(d_inode(root), &oip, ino, fsid); +- ovl_dentry_update_reval(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_flags(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE); + + return root; + } +diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c +index 81a57a8d80d9a..850e8d1bf8296 100644 +--- a/fs/overlayfs/util.c ++++ b/fs/overlayfs/util.c +@@ -94,14 +94,30 @@ struct ovl_entry *ovl_alloc_entry(unsigned int numlower) + return oe; + } + ++#define OVL_D_REVALIDATE (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE) ++ + bool ovl_dentry_remote(struct dentry *dentry) + { +- return dentry->d_flags & +- (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ return dentry->d_flags & OVL_D_REVALIDATE; ++} ++ ++void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry) ++{ ++ if (!ovl_dentry_remote(realdentry)) ++ return; ++ ++ spin_lock(&dentry->d_lock); ++ dentry->d_flags |= realdentry->d_flags & OVL_D_REVALIDATE; ++ spin_unlock(&dentry->d_lock); ++} ++ ++void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry) ++{ ++ return ovl_dentry_init_flags(dentry, upperdentry, OVL_D_REVALIDATE); + } + +-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry, +- unsigned int mask) ++void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry, ++ unsigned int mask) + { + struct ovl_entry *oe = OVL_E(dentry); + unsigned int i, flags = 0; +-- +2.39.2 + diff --git a/queue-6.1/pci-add-pci_clear_master-stub-for-non-config_pci.patch b/queue-6.1/pci-add-pci_clear_master-stub-for-non-config_pci.patch new file mode 100644 index 00000000000..e2dd8103b03 --- /dev/null +++ b/queue-6.1/pci-add-pci_clear_master-stub-for-non-config_pci.patch @@ -0,0 +1,39 @@ +From 06433eb4181aa5fce24fb9a5baa1bc0df11bcf11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 18:27:44 +0800 +Subject: PCI: Add pci_clear_master() stub for non-CONFIG_PCI + +From: Sui Jingfeng + +[ Upstream commit 2aa5ac633259843f656eb6ecff4cf01e8e810c5e ] + +Add a pci_clear_master() stub when CONFIG_PCI is not set so drivers that +support both PCI and platform devices don't need #ifdefs or extra Kconfig +symbols for the PCI parts. + +[bhelgaas: commit log] +Fixes: 6a479079c072 ("PCI: Add pci_clear_master() as opposite of pci_set_master()") +Link: https://lore.kernel.org/r/20230531102744.2354313-1-suijingfeng@loongson.cn +Signed-off-by: Sui Jingfeng +Signed-off-by: Bjorn Helgaas +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + include/linux/pci.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index d20695184e0b9..9f617ffdb863f 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1809,6 +1809,7 @@ static inline int pci_dev_present(const struct pci_device_id *ids) + #define pci_dev_put(dev) do { } while (0) + + static inline void pci_set_master(struct pci_dev *dev) { } ++static inline void pci_clear_master(struct pci_dev *dev) { } + static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; } + static inline void pci_disable_device(struct pci_dev *dev) { } + static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; } +-- +2.39.2 + diff --git a/queue-6.1/pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch b/queue-6.1/pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch new file mode 100644 index 00000000000..cebdb6c28f6 --- /dev/null +++ b/queue-6.1/pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch @@ -0,0 +1,94 @@ +From b732c107b42619455e4bf0b61eec1dbe2b964b59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 11:40:57 +0800 +Subject: PCI/ASPM: Disable ASPM on MFD function removal to avoid + use-after-free + +From: Ding Hui + +[ Upstream commit 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 ] + +Struct pcie_link_state->downstream is a pointer to the pci_dev of function +0. Previously we retained that pointer when removing function 0, and +subsequent ASPM policy changes dereferenced it, resulting in a +use-after-free warning from KASAN, e.g.: + + # echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove + # echo powersave > /sys/module/pcie_aspm/parameters/policy + + BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500 + Call Trace: + kasan_report+0xae/0xe0 + pcie_config_aspm_link+0x42d/0x500 + pcie_aspm_set_policy+0x8e/0x1a0 + param_attr_store+0x162/0x2c0 + module_attr_store+0x3e/0x80 + +PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM +Control value in all functions of multi-function devices. + +Disable ASPM and free the pcie_link_state when any child function is +removed so we can discard the dangling pcie_link_state->downstream pointer +and maintain the same ASPM Control configuration for all functions. + +[bhelgaas: commit log and comment] +Debugged-by: Zongquan Qin +Suggested-by: Bjorn Helgaas +Fixes: b5a0a9b59c81 ("PCI/ASPM: Read and set up L1 substate capabilities") +Link: https://lore.kernel.org/r/20230507034057.20970-1-dinghui@sangfor.com.cn +Signed-off-by: Ding Hui +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aspm.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 4b4184563a927..74b8183c305df 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -1010,21 +1010,24 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) + + down_read(&pci_bus_sem); + mutex_lock(&aspm_lock); +- /* +- * All PCIe functions are in one slot, remove one function will remove +- * the whole slot, so just wait until we are the last function left. +- */ +- if (!list_empty(&parent->subordinate->devices)) +- goto out; + + link = parent->link_state; + root = link->root; + parent_link = link->parent; + +- /* All functions are removed, so just disable ASPM for the link */ ++ /* ++ * link->downstream is a pointer to the pci_dev of function 0. If ++ * we remove that function, the pci_dev is about to be deallocated, ++ * so we can't use link->downstream again. Free the link state to ++ * avoid this. ++ * ++ * If we're removing a non-0 function, it's possible we could ++ * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends ++ * programming the same ASPM Control value for all functions of ++ * multi-function devices, so disable ASPM for all of them. ++ */ + pcie_config_aspm_link(link, 0); + list_del(&link->sibling); +- /* Clock PM is for endpoint device */ + free_link_state(link); + + /* Recheck latencies and configure upstream links */ +@@ -1032,7 +1035,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) + pcie_update_aspm_capable(root); + pcie_config_aspm_path(parent_link); + } +-out: ++ + mutex_unlock(&aspm_lock); + up_read(&pci_bus_sem); + } +-- +2.39.2 + diff --git a/queue-6.1/pci-cadence-fix-gen2-link-retraining-process.patch b/queue-6.1/pci-cadence-fix-gen2-link-retraining-process.patch new file mode 100644 index 00000000000..921119f9fe4 --- /dev/null +++ b/queue-6.1/pci-cadence-fix-gen2-link-retraining-process.patch @@ -0,0 +1,88 @@ +From e9853bb636341df0522995e1c70819a3727d8284 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 12:38:00 +0530 +Subject: PCI: cadence: Fix Gen2 Link Retraining process + +From: Siddharth Vadapalli + +[ Upstream commit 0e12f830236928b6fadf40d917a7527f0a048d2f ] + +The Link Retraining process is initiated to account for the Gen2 defect in +the Cadence PCIe controller in J721E SoC. The errata corresponding to this +is i2085, documented at: +https://www.ti.com/lit/er/sprz455c/sprz455c.pdf + +The existing workaround implemented for the errata waits for the Data Link +initialization to complete and assumes that the link retraining process +at the Physical Layer has completed. However, it is possible that the +Physical Layer training might be ongoing as indicated by the +PCI_EXP_LNKSTA_LT bit in the PCI_EXP_LNKSTA register. + +Fix the existing workaround, to ensure that the Physical Layer training +has also completed, in addition to the Data Link initialization. + +Link: https://lore.kernel.org/r/20230315070800.1615527-1-s-vadapalli@ti.com +Fixes: 4740b969aaf5 ("PCI: cadence: Retrain Link to work around Gen2 training defect") +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + .../controller/cadence/pcie-cadence-host.c | 27 +++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c +index 940c7dd701d68..5b14f7ee3c798 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-host.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c +@@ -12,6 +12,8 @@ + + #include "pcie-cadence.h" + ++#define LINK_RETRAIN_TIMEOUT HZ ++ + static u64 bar_max_size[] = { + [RP_BAR0] = _ULL(128 * SZ_2G), + [RP_BAR1] = SZ_2G, +@@ -77,6 +79,27 @@ static struct pci_ops cdns_pcie_host_ops = { + .write = pci_generic_config_write, + }; + ++static int cdns_pcie_host_training_complete(struct cdns_pcie *pcie) ++{ ++ u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET; ++ unsigned long end_jiffies; ++ u16 lnk_stat; ++ ++ /* Wait for link training to complete. Exit after timeout. */ ++ end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT; ++ do { ++ lnk_stat = cdns_pcie_rp_readw(pcie, pcie_cap_off + PCI_EXP_LNKSTA); ++ if (!(lnk_stat & PCI_EXP_LNKSTA_LT)) ++ break; ++ usleep_range(0, 1000); ++ } while (time_before(jiffies, end_jiffies)); ++ ++ if (!(lnk_stat & PCI_EXP_LNKSTA_LT)) ++ return 0; ++ ++ return -ETIMEDOUT; ++} ++ + static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie) + { + struct device *dev = pcie->dev; +@@ -118,6 +141,10 @@ static int cdns_pcie_retrain(struct cdns_pcie *pcie) + cdns_pcie_rp_writew(pcie, pcie_cap_off + PCI_EXP_LNKCTL, + lnk_ctl); + ++ ret = cdns_pcie_host_training_complete(pcie); ++ if (ret) ++ return ret; ++ + ret = cdns_pcie_host_wait_for_link(pcie); + } + return ret; +-- +2.39.2 + diff --git a/queue-6.1/pci-endpoint-fix-a-kconfig-prompt-of-vntb-driver.patch b/queue-6.1/pci-endpoint-fix-a-kconfig-prompt-of-vntb-driver.patch new file mode 100644 index 00000000000..bc540f4d99d --- /dev/null +++ b/queue-6.1/pci-endpoint-fix-a-kconfig-prompt-of-vntb-driver.patch @@ -0,0 +1,39 @@ +From 6c4b1f8e548f994f4503c701a1ecf50299c43d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 19:38:32 +0900 +Subject: PCI: endpoint: Fix a Kconfig prompt of vNTB driver + +From: Shunsuke Mie + +[ Upstream commit 37587673cda963ec950e4983db5023802f9b5ff2 ] + +vNTB driver and NTB driver have same Kconfig prompt. Changed to make it +distinguishable. + +Link: https://lore.kernel.org/r/20230202103832.2038286-1-mie@igel.co.jp +Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") +Signed-off-by: Shunsuke Mie +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig +index 9fd5608868718..8efb6a869e7ce 100644 +--- a/drivers/pci/endpoint/functions/Kconfig ++++ b/drivers/pci/endpoint/functions/Kconfig +@@ -27,7 +27,7 @@ config PCI_EPF_NTB + If in doubt, say "N" to disable Endpoint NTB driver. + + config PCI_EPF_VNTB +- tristate "PCI Endpoint NTB driver" ++ tristate "PCI Endpoint Virtual NTB driver" + depends on PCI_ENDPOINT + depends on NTB + select CONFIGFS_FS +-- +2.39.2 + diff --git a/queue-6.1/pci-endpoint-fix-kconfig-indent-style.patch b/queue-6.1/pci-endpoint-fix-kconfig-indent-style.patch new file mode 100644 index 00000000000..d09de502b09 --- /dev/null +++ b/queue-6.1/pci-endpoint-fix-kconfig-indent-style.patch @@ -0,0 +1,53 @@ +From dbd6d99d576c2985f19481cc5beb8415de4ac128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 11:50:06 +0900 +Subject: PCI: endpoint: Fix Kconfig indent style + +From: Shunsuke Mie + +[ Upstream commit 2759ddf7535d63381f9b9b1412e4c46e13ed773a ] + +Change to follow the Kconfig style guide. This patch fixes to use tab +rather than space to indent, while help text is indented an additional +two spaces. + +Link: https://lore.kernel.org/r/20220815025006.48167-1-mie@igel.co.jp +Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") +Signed-off-by: Shunsuke Mie +Signed-off-by: Lorenzo Pieralisi +Stable-dep-of: 37587673cda9 ("PCI: endpoint: Fix a Kconfig prompt of vNTB driver") +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/Kconfig | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig +index 295a033ee9a27..9fd5608868718 100644 +--- a/drivers/pci/endpoint/functions/Kconfig ++++ b/drivers/pci/endpoint/functions/Kconfig +@@ -27,13 +27,13 @@ config PCI_EPF_NTB + If in doubt, say "N" to disable Endpoint NTB driver. + + config PCI_EPF_VNTB +- tristate "PCI Endpoint NTB driver" +- depends on PCI_ENDPOINT +- depends on NTB +- select CONFIGFS_FS +- help +- Select this configuration option to enable the Non-Transparent +- Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB +- between PCI Root Port and PCIe Endpoint. ++ tristate "PCI Endpoint NTB driver" ++ depends on PCI_ENDPOINT ++ depends on NTB ++ select CONFIGFS_FS ++ help ++ Select this configuration option to enable the Non-Transparent ++ Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB ++ between PCI Root Port and PCIe Endpoint. + +- If in doubt, say "N" to disable Endpoint NTB driver. ++ If in doubt, say "N" to disable Endpoint NTB driver. +-- +2.39.2 + diff --git a/queue-6.1/pci-endpoint-functions-pci-epf-test-fix-dma_chan-dir.patch b/queue-6.1/pci-endpoint-functions-pci-epf-test-fix-dma_chan-dir.patch new file mode 100644 index 00000000000..127eb1b19e6 --- /dev/null +++ b/queue-6.1/pci-endpoint-functions-pci-epf-test-fix-dma_chan-dir.patch @@ -0,0 +1,46 @@ +From 71ff456d75d2639b827e3777365dcd6703cb2db7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 15:34:47 +0900 +Subject: PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction + +From: Yoshihiro Shimoda + +[ Upstream commit 880d51c729a3fa944794feb19f605eefe55916fc ] + +In pci_epf_test_init_dma_chan() epf_test->dma_chan_rx is assigned from +dma_request_channel() with DMA_DEV_TO_MEM as filter.dma_mask. + +However, in pci_epf_test_data_transfer() if the dir is DMA_DEV_TO_MEM, +epf->dma_chan_rx should be used but instead we are using +epf_test->dma_chan_tx. + +Fix it. + +Link: https://lore.kernel.org/r/20230412063447.2841177-1-yoshihiro.shimoda.uh@renesas.com +Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") +Tested-by: Kunihiko Hayashi +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Frank Li +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index 55283d2379a6a..f0c4d0f77453a 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -112,7 +112,7 @@ static int pci_epf_test_data_transfer(struct pci_epf_test *epf_test, + size_t len, dma_addr_t dma_remote, + enum dma_transfer_direction dir) + { +- struct dma_chan *chan = (dir == DMA_DEV_TO_MEM) ? ++ struct dma_chan *chan = (dir == DMA_MEM_TO_DEV) ? + epf_test->dma_chan_tx : epf_test->dma_chan_rx; + dma_addr_t dma_local = (dir == DMA_MEM_TO_DEV) ? dma_src : dma_dst; + enum dma_ctrl_flags flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; +-- +2.39.2 + diff --git a/queue-6.1/pci-ftpci100-release-the-clock-resources.patch b/queue-6.1/pci-ftpci100-release-the-clock-resources.patch new file mode 100644 index 00000000000..43d51f6f319 --- /dev/null +++ b/queue-6.1/pci-ftpci100-release-the-clock-resources.patch @@ -0,0 +1,75 @@ +From d7d2a2b884d6cec8faef4b54fe64b23b079b01c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 12:36:41 +0800 +Subject: PCI: ftpci100: Release the clock resources + +From: Junyan Ye + +[ Upstream commit c60738de85f40b0b9f5cb23c21f9246e5a47908c ] + +Smatch reported: +1. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn: +'clk' from clk_prepare_enable() not released on lines: 442,451,462,478,512,517. +2. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn: +'p->bus_clk' from clk_prepare_enable() not released on lines: 451,462,478,512,517. + +The clock resource is obtained by devm_clk_get(), and then +clk_prepare_enable() makes the clock resource ready for use. After that, +clk_disable_unprepare() should be called to release the clock resource +when it is no longer needed. However, while doing some error handling +in faraday_pci_probe(), clk_disable_unprepare() is not called to release +clk and p->bus_clk before returning. These return lines are exactly 442, +451, 462, 478, 512, 517. + +Fix this warning by replacing devm_clk_get() with devm_clk_get_enabled(), +which is equivalent to devm_clk_get() + clk_prepare_enable(). And with +devm_clk_get_enabled(), the clock will automatically be disabled, +unprepared and freed when the device is unbound from the bus. + +Link: https://lore.kernel.org/r/20230508043641.23807-1-yejunyan@hust.edu.cn +Fixes: b3c433efb8a3 ("PCI: faraday: Fix wrong pointer passed to PTR_ERR()") +Fixes: 2eeb02b28579 ("PCI: faraday: Add clock handling") +Fixes: 783a862563f7 ("PCI: faraday: Use pci_parse_request_of_pci_ranges()") +Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver") +Fixes: f1e8bd21e39e ("PCI: faraday: Convert IRQ masking to raw PCI config accessors") +Signed-off-by: Junyan Ye +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Dongliang Mu +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-ftpci100.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c +index 0cfd9d5a497c9..f7e61e169d838 100644 +--- a/drivers/pci/controller/pci-ftpci100.c ++++ b/drivers/pci/controller/pci-ftpci100.c +@@ -429,22 +429,12 @@ static int faraday_pci_probe(struct platform_device *pdev) + p->dev = dev; + + /* Retrieve and enable optional clocks */ +- clk = devm_clk_get(dev, "PCLK"); ++ clk = devm_clk_get_enabled(dev, "PCLK"); + if (IS_ERR(clk)) + return PTR_ERR(clk); +- ret = clk_prepare_enable(clk); +- if (ret) { +- dev_err(dev, "could not prepare PCLK\n"); +- return ret; +- } +- p->bus_clk = devm_clk_get(dev, "PCICLK"); ++ p->bus_clk = devm_clk_get_enabled(dev, "PCICLK"); + if (IS_ERR(p->bus_clk)) + return PTR_ERR(p->bus_clk); +- ret = clk_prepare_enable(p->bus_clk); +- if (ret) { +- dev_err(dev, "could not prepare PCICLK\n"); +- return ret; +- } + + p->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(p->base)) +-- +2.39.2 + diff --git a/queue-6.1/pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch b/queue-6.1/pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch new file mode 100644 index 00000000000..33a3b8276b4 --- /dev/null +++ b/queue-6.1/pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch @@ -0,0 +1,74 @@ +From a25de0ac4f3dc7900132200fa176805e74fb04ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 10:15:18 +0800 +Subject: PCI: pciehp: Cancel bringup sequence if card is not present + +From: Rongguang Wei + +[ Upstream commit e8afd0d9fccc27c8ad263db5cf5952cfcf72d6fe ] + +If a PCIe hotplug slot has an Attention Button, the normal hot-add flow is: + + - Slot is empty and slot power is off + - User inserts card in slot and presses Attention Button + - OS blinks Power Indicator for 5 seconds + - After 5 seconds, OS turns on Power Indicator, turns on slot power, and + enumerates the device + +Previously, if a user pressed the Attention Button on an *empty* slot, +pciehp logged the following messages and blinked the Power Indicator +until a second button press: + + [0.000] pciehp: Button press: will power on in 5 sec + [0.001] # Power Indicator starts blinking + [5.001] # 5 second timeout; slot is empty, so we should cancel the + request to power on and turn off Power Indicator + + [7.000] # Power Indicator still blinking + [8.000] # possible card insertion + [9.000] pciehp: Button press: canceling request to power on + +The first button press incorrectly left the slot in BLINKINGON_STATE, so +the second was interpreted as a "cancel power on" event regardless of +whether a card was present. + +If the slot is empty, turn off the Power Indicator and return from +BLINKINGON_STATE to OFF_STATE after 5 seconds, effectively canceling the +request to power on. Putting the slot in OFF_STATE also means the second +button press will correctly request a slot power on if the slot is +occupied. + +[bhelgaas: commit log] +Link: https://lore.kernel.org/r/20230512021518.336460-1-clementwei90@163.com +Fixes: d331710ea78f ("PCI: pciehp: Become resilient to missed events") +Suggested-by: Lukas Wunner +Signed-off-by: Rongguang Wei +Signed-off-by: Bjorn Helgaas +Reviewed-by: Lukas Wunner +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/pciehp_ctrl.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c +index 529c348084401..32baba1b7f131 100644 +--- a/drivers/pci/hotplug/pciehp_ctrl.c ++++ b/drivers/pci/hotplug/pciehp_ctrl.c +@@ -256,6 +256,14 @@ void pciehp_handle_presence_or_link_change(struct controller *ctrl, u32 events) + present = pciehp_card_present(ctrl); + link_active = pciehp_check_link_active(ctrl); + if (present <= 0 && link_active <= 0) { ++ if (ctrl->state == BLINKINGON_STATE) { ++ ctrl->state = OFF_STATE; ++ cancel_delayed_work(&ctrl->button_work); ++ pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, ++ INDICATOR_NOOP); ++ ctrl_info(ctrl, "Slot(%s): Card not present\n", ++ slot_name(ctrl)); ++ } + mutex_unlock(&ctrl->state_lock); + return; + } +-- +2.39.2 + diff --git a/queue-6.1/pci-qcom-disable-write-access-to-read-only-registers.patch b/queue-6.1/pci-qcom-disable-write-access-to-read-only-registers.patch new file mode 100644 index 00000000000..35d06644e20 --- /dev/null +++ b/queue-6.1/pci-qcom-disable-write-access-to-read-only-registers.patch @@ -0,0 +1,50 @@ +From d66399529e60a2928b360e32e63f0a721150de08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 20:34:02 +0530 +Subject: PCI: qcom: Disable write access to read only registers for IP v2.9.0 + +From: Manivannan Sadhasivam + +[ Upstream commit 200b8f85f2021362adcc8efb575652a2aa44c099 ] + +In the post init sequence of v2.9.0, write access to read only registers +are not disabled after updating the registers. Fix it by disabling the +access after register update. + +While at it, let's also add a newline after existing dw_pcie_dbi_ro_wr_en() +guard function to align with rest of the driver. + +Link: https://lore.kernel.org/r/20230619150408.8468-4-manivannan.sadhasivam@linaro.org +Fixes: 0cf7c2efe8ac ("PCI: qcom: Add IPQ60xx support") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 77f4dc244b3f7..49905b2a99607 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -1403,6 +1403,7 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie) + writel(0, pcie->parf + PARF_Q2A_FLUSH); + + dw_pcie_dbi_ro_wr_en(pci); ++ + writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP); + + val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP); +@@ -1412,6 +1413,8 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie) + writel(PCI_EXP_DEVCTL2_COMP_TMOUT_DIS, pci->dbi_base + offset + + PCI_EXP_DEVCTL2); + ++ dw_pcie_dbi_ro_wr_dis(pci); ++ + for (i = 0; i < 256; i++) + writel(0, pcie->parf + PARF_BDF_TO_SID_TABLE_N + (4 * i)); + +-- +2.39.2 + diff --git a/queue-6.1/pci-qcom-remove-pcie20_-prefix-from-register-definit.patch b/queue-6.1/pci-qcom-remove-pcie20_-prefix-from-register-definit.patch new file mode 100644 index 00000000000..7b926d65c23 --- /dev/null +++ b/queue-6.1/pci-qcom-remove-pcie20_-prefix-from-register-definit.patch @@ -0,0 +1,448 @@ +From 5814c1b67d411695463ec2eff151caee8a0a10e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 13:41:00 +0530 +Subject: PCI: qcom: Remove PCIE20_ prefix from register definitions + +From: Manivannan Sadhasivam + +[ Upstream commit 39171b33f6523f28c1c1256427e5f50c74b69639 ] + +The PCIE part is redundant and 20 doesn't represent anything across the +SoCs supported now. So let's get rid of the prefix. + +This involves adding the IP version suffix to one definition of +PARF_SLV_ADDR_SPACE_SIZE that defines offset specific to that version. +The other definition is generic for the rest of the versions. + +Also, the register PCIE20_LNK_CONTROL2_LINK_STATUS2 is not used anywhere, +hence removed. + +Link: https://lore.kernel.org/r/20230316081117.14288-3-manivannan.sadhasivam@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Lorenzo Pieralisi +Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers") +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 184 ++++++++++++------------- + 1 file changed, 91 insertions(+), 93 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index dbe6df0cb6118..b587957211c3f 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -31,7 +31,7 @@ + #include "../../pci.h" + #include "pcie-designware.h" + +-#define PCIE20_PARF_SYS_CTRL 0x00 ++#define PARF_SYS_CTRL 0x00 + #define MST_WAKEUP_EN BIT(13) + #define SLV_WAKEUP_EN BIT(12) + #define MSTR_ACLK_CGC_DIS BIT(10) +@@ -41,39 +41,39 @@ + #define L23_CLK_RMV_DIS BIT(2) + #define L1_CLK_RMV_DIS BIT(1) + +-#define PCIE20_PARF_PM_CTRL 0x20 ++#define PARF_PM_CTRL 0x20 + #define REQ_NOT_ENTR_L1 BIT(5) + +-#define PCIE20_PARF_PHY_CTRL 0x40 ++#define PARF_PHY_CTRL 0x40 + #define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16) + #define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16) + +-#define PCIE20_PARF_PHY_REFCLK 0x4C ++#define PARF_PHY_REFCLK 0x4C + #define PHY_REFCLK_SSP_EN BIT(16) + #define PHY_REFCLK_USE_PAD BIT(12) + +-#define PCIE20_PARF_DBI_BASE_ADDR 0x168 +-#define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C +-#define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174 ++#define PARF_DBI_BASE_ADDR 0x168 ++#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP rev 2.3.3 */ ++#define PARF_MHI_CLOCK_RESET_CTRL 0x174 + #define AHB_CLK_EN BIT(0) + #define MSTR_AXI_CLK_EN BIT(1) + #define BYPASS BIT(4) + +-#define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT 0x178 +-#define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8 +-#define PCIE20_PARF_LTSSM 0x1B0 +-#define PCIE20_PARF_SID_OFFSET 0x234 +-#define PCIE20_PARF_BDF_TRANSLATE_CFG 0x24C +-#define PCIE20_PARF_DEVICE_TYPE 0x1000 +-#define PCIE20_PARF_BDF_TO_SID_TABLE_N 0x2000 ++#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178 ++#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8 ++#define PARF_LTSSM 0x1B0 ++#define PARF_SID_OFFSET 0x234 ++#define PARF_BDF_TRANSLATE_CFG 0x24C ++#define PARF_DEVICE_TYPE 0x1000 ++#define PARF_BDF_TO_SID_TABLE_N 0x2000 + +-#define PCIE20_ELBI_SYS_CTRL 0x04 +-#define PCIE20_ELBI_SYS_CTRL_LT_ENABLE BIT(0) ++#define ELBI_SYS_CTRL 0x04 ++#define ELBI_SYS_CTRL_LT_ENABLE BIT(0) + +-#define PCIE20_AXI_MSTR_RESP_COMP_CTRL0 0x818 ++#define AXI_MSTR_RESP_COMP_CTRL0 0x818 + #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K 0x4 + #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_4K 0x5 +-#define PCIE20_AXI_MSTR_RESP_COMP_CTRL1 0x81c ++#define AXI_MSTR_RESP_COMP_CTRL1 0x81c + #define CFG_BRIDGE_SB_INIT BIT(0) + + #define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, \ +@@ -91,30 +91,28 @@ + PCIE_CAP_SLOT_POWER_LIMIT_VAL | \ + PCIE_CAP_SLOT_POWER_LIMIT_SCALE) + +-#define PCIE20_PARF_Q2A_FLUSH 0x1AC ++#define PARF_Q2A_FLUSH 0x1AC + +-#define PCIE20_MISC_CONTROL_1_REG 0x8BC ++#define MISC_CONTROL_1_REG 0x8BC + #define DBI_RO_WR_EN 1 + + #define PERST_DELAY_US 1000 + /* PARF registers */ +-#define PCIE20_PARF_PCS_DEEMPH 0x34 ++#define PARF_PCS_DEEMPH 0x34 + #define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16) + #define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8) + #define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0) + +-#define PCIE20_PARF_PCS_SWING 0x38 ++#define PARF_PCS_SWING 0x38 + #define PCS_SWING_TX_SWING_FULL(x) ((x) << 8) + #define PCS_SWING_TX_SWING_LOW(x) ((x) << 0) + +-#define PCIE20_PARF_CONFIG_BITS 0x50 ++#define PARF_CONFIG_BITS 0x50 + #define PHY_RX0_EQ(x) ((x) << 24) + +-#define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358 ++#define PARF_SLV_ADDR_SPACE_SIZE 0x358 + #define SLV_ADDR_SPACE_SZ 0x10000000 + +-#define PCIE20_LNK_CONTROL2_LINK_STATUS2 0xa0 +- + #define DEVICE_TYPE_RC 0x4 + + #define QCOM_PCIE_2_1_0_MAX_SUPPLY 3 +@@ -258,9 +256,9 @@ static void qcom_pcie_2_1_0_ltssm_enable(struct qcom_pcie *pcie) + u32 val; + + /* enable link training */ +- val = readl(pcie->elbi + PCIE20_ELBI_SYS_CTRL); +- val |= PCIE20_ELBI_SYS_CTRL_LT_ENABLE; +- writel(val, pcie->elbi + PCIE20_ELBI_SYS_CTRL); ++ val = readl(pcie->elbi + ELBI_SYS_CTRL); ++ val |= ELBI_SYS_CTRL_LT_ENABLE; ++ writel(val, pcie->elbi + ELBI_SYS_CTRL); + } + + static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie) +@@ -330,7 +328,7 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie) + reset_control_assert(res->ext_reset); + reset_control_assert(res->phy_reset); + +- writel(1, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(1, pcie->parf + PARF_PHY_CTRL); + + regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies); + } +@@ -420,9 +418,9 @@ static int qcom_pcie_post_init_2_1_0(struct qcom_pcie *pcie) + int ret; + + /* enable PCIe clocks and resets */ +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~BIT(0); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + + ret = clk_bulk_prepare_enable(ARRAY_SIZE(res->clks), res->clks); + if (ret) +@@ -433,37 +431,37 @@ static int qcom_pcie_post_init_2_1_0(struct qcom_pcie *pcie) + writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) | + PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) | + PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34), +- pcie->parf + PCIE20_PARF_PCS_DEEMPH); ++ pcie->parf + PARF_PCS_DEEMPH); + writel(PCS_SWING_TX_SWING_FULL(120) | + PCS_SWING_TX_SWING_LOW(120), +- pcie->parf + PCIE20_PARF_PCS_SWING); +- writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS); ++ pcie->parf + PARF_PCS_SWING); ++ writel(PHY_RX0_EQ(4), pcie->parf + PARF_CONFIG_BITS); + } + + if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) { + /* set TX termination offset */ +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK; + val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + } + + /* enable external reference clock */ +- val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK); ++ val = readl(pcie->parf + PARF_PHY_REFCLK); + /* USE_PAD is required only for ipq806x */ + if (!of_device_is_compatible(node, "qcom,pcie-apq8064")) + val &= ~PHY_REFCLK_USE_PAD; + val |= PHY_REFCLK_SSP_EN; +- writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK); ++ writel(val, pcie->parf + PARF_PHY_REFCLK); + + /* wait for clock acquisition */ + usleep_range(1000, 1500); + + /* Set the Max TLP size to 2K, instead of using default of 4K */ + writel(CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K, +- pci->dbi_base + PCIE20_AXI_MSTR_RESP_COMP_CTRL0); ++ pci->dbi_base + AXI_MSTR_RESP_COMP_CTRL0); + writel(CFG_BRIDGE_SB_INIT, +- pci->dbi_base + PCIE20_AXI_MSTR_RESP_COMP_CTRL1); ++ pci->dbi_base + AXI_MSTR_RESP_COMP_CTRL1); + + return 0; + } +@@ -571,13 +569,13 @@ static int qcom_pcie_init_1_0_0(struct qcom_pcie *pcie) + static int qcom_pcie_post_init_1_0_0(struct qcom_pcie *pcie) + { + /* change DBI base address */ +- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR); ++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR); + + if (IS_ENABLED(CONFIG_PCI_MSI)) { +- u32 val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT); ++ u32 val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT); + + val |= BIT(31); +- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT); ++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT); + } + + return 0; +@@ -588,9 +586,9 @@ static void qcom_pcie_2_3_2_ltssm_enable(struct qcom_pcie *pcie) + u32 val; + + /* enable link training */ +- val = readl(pcie->parf + PCIE20_PARF_LTSSM); ++ val = readl(pcie->parf + PARF_LTSSM); + val |= BIT(8); +- writel(val, pcie->parf + PCIE20_PARF_LTSSM); ++ writel(val, pcie->parf + PARF_LTSSM); + } + + static int qcom_pcie_get_resources_2_3_2(struct qcom_pcie *pcie) +@@ -695,25 +693,25 @@ static int qcom_pcie_post_init_2_3_2(struct qcom_pcie *pcie) + u32 val; + + /* enable PCIe clocks and resets */ +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~BIT(0); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + + /* change DBI base address */ +- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR); ++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR); + + /* MAC PHY_POWERDOWN MUX DISABLE */ +- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL); ++ val = readl(pcie->parf + PARF_SYS_CTRL); + val &= ~BIT(29); +- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL); ++ writel(val, pcie->parf + PARF_SYS_CTRL); + +- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + val |= BIT(4); +- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + +- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2); ++ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2); + val |= BIT(31); +- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2); ++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2); + + return 0; + } +@@ -974,25 +972,25 @@ static int qcom_pcie_post_init_2_4_0(struct qcom_pcie *pcie) + u32 val; + + /* enable PCIe clocks and resets */ +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~BIT(0); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + + /* change DBI base address */ +- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR); ++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR); + + /* MAC PHY_POWERDOWN MUX DISABLE */ +- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL); ++ val = readl(pcie->parf + PARF_SYS_CTRL); + val &= ~BIT(29); +- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL); ++ writel(val, pcie->parf + PARF_SYS_CTRL); + +- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + val |= BIT(4); +- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + +- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2); ++ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2); + val |= BIT(31); +- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2); ++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2); + + return 0; + } +@@ -1137,22 +1135,22 @@ static int qcom_pcie_post_init_2_3_3(struct qcom_pcie *pcie) + u32 val; + + writel(SLV_ADDR_SPACE_SZ, +- pcie->parf + PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE); ++ pcie->parf + PARF_SLV_ADDR_SPACE_SIZE_2_3_3); + +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~BIT(0); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + +- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR); ++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR); + + writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS + | SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS | + AUX_PWR_DET | L23_CLK_RMV_DIS | L1_CLK_RMV_DIS, +- pcie->parf + PCIE20_PARF_SYS_CTRL); +- writel(0, pcie->parf + PCIE20_PARF_Q2A_FLUSH); ++ pcie->parf + PARF_SYS_CTRL); ++ writel(0, pcie->parf + PARF_Q2A_FLUSH); + + writel(PCI_COMMAND_MASTER, pci->dbi_base + PCI_COMMAND); +- writel(DBI_RO_WR_EN, pci->dbi_base + PCIE20_MISC_CONTROL_1_REG); ++ writel(DBI_RO_WR_EN, pci->dbi_base + MISC_CONTROL_1_REG); + writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP); + + val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP); +@@ -1252,33 +1250,33 @@ static int qcom_pcie_init_2_7_0(struct qcom_pcie *pcie) + usleep_range(1000, 1500); + + /* configure PCIe to RC mode */ +- writel(DEVICE_TYPE_RC, pcie->parf + PCIE20_PARF_DEVICE_TYPE); ++ writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE); + + /* enable PCIe clocks and resets */ +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~BIT(0); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + + /* change DBI base address */ +- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR); ++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR); + + /* MAC PHY_POWERDOWN MUX DISABLE */ +- val = readl(pcie->parf + PCIE20_PARF_SYS_CTRL); ++ val = readl(pcie->parf + PARF_SYS_CTRL); + val &= ~BIT(29); +- writel(val, pcie->parf + PCIE20_PARF_SYS_CTRL); ++ writel(val, pcie->parf + PARF_SYS_CTRL); + +- val = readl(pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ val = readl(pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + val |= BIT(4); +- writel(val, pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ writel(val, pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + + /* Enable L1 and L1SS */ +- val = readl(pcie->parf + PCIE20_PARF_PM_CTRL); ++ val = readl(pcie->parf + PARF_PM_CTRL); + val &= ~REQ_NOT_ENTR_L1; +- writel(val, pcie->parf + PCIE20_PARF_PM_CTRL); ++ writel(val, pcie->parf + PARF_PM_CTRL); + +- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2); ++ val = readl(pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2); + val |= BIT(31); +- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2); ++ writel(val, pcie->parf + PARF_AXI_MSTR_WR_ADDR_HALT_V2); + + return 0; + err_disable_clocks: +@@ -1366,17 +1364,17 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie) + int i; + + writel(SLV_ADDR_SPACE_SZ, +- pcie->parf + PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE); ++ pcie->parf + PARF_SLV_ADDR_SPACE_SIZE); + +- val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val = readl(pcie->parf + PARF_PHY_CTRL); + val &= ~BIT(0); +- writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ writel(val, pcie->parf + PARF_PHY_CTRL); + +- writel(0, pcie->parf + PCIE20_PARF_DBI_BASE_ADDR); ++ writel(0, pcie->parf + PARF_DBI_BASE_ADDR); + +- writel(DEVICE_TYPE_RC, pcie->parf + PCIE20_PARF_DEVICE_TYPE); ++ writel(DEVICE_TYPE_RC, pcie->parf + PARF_DEVICE_TYPE); + writel(BYPASS | MSTR_AXI_CLK_EN | AHB_CLK_EN, +- pcie->parf + PCIE20_PARF_MHI_CLOCK_RESET_CTRL); ++ pcie->parf + PARF_MHI_CLOCK_RESET_CTRL); + writel(GEN3_RELATED_OFF_RXEQ_RGRDLESS_RXTS | + GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL, + pci->dbi_base + GEN3_RELATED_OFF); +@@ -1384,9 +1382,9 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie) + writel(MST_WAKEUP_EN | SLV_WAKEUP_EN | MSTR_ACLK_CGC_DIS | + SLV_ACLK_CGC_DIS | CORE_CLK_CGC_DIS | + AUX_PWR_DET | L23_CLK_RMV_DIS | L1_CLK_RMV_DIS, +- pcie->parf + PCIE20_PARF_SYS_CTRL); ++ pcie->parf + PARF_SYS_CTRL); + +- writel(0, pcie->parf + PCIE20_PARF_Q2A_FLUSH); ++ writel(0, pcie->parf + PARF_Q2A_FLUSH); + + dw_pcie_dbi_ro_wr_en(pci); + writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP); +@@ -1399,7 +1397,7 @@ static int qcom_pcie_post_init_2_9_0(struct qcom_pcie *pcie) + PCI_EXP_DEVCTL2); + + for (i = 0; i < 256; i++) +- writel(0, pcie->parf + PCIE20_PARF_BDF_TO_SID_TABLE_N + (4 * i)); ++ writel(0, pcie->parf + PARF_BDF_TO_SID_TABLE_N + (4 * i)); + + return 0; + } +@@ -1421,7 +1419,7 @@ static int qcom_pcie_config_sid_sm8250(struct qcom_pcie *pcie) + u32 smmu_sid; + u32 smmu_sid_len; + } *map; +- void __iomem *bdf_to_sid_base = pcie->parf + PCIE20_PARF_BDF_TO_SID_TABLE_N; ++ void __iomem *bdf_to_sid_base = pcie->parf + PARF_BDF_TO_SID_TABLE_N; + struct device *dev = pcie->pci->dev; + u8 qcom_pcie_crc8_table[CRC8_TABLE_SIZE]; + int i, nr_map, size = 0; +-- +2.39.2 + diff --git a/queue-6.1/pci-qcom-sort-and-group-registers-and-bitfield-defin.patch b/queue-6.1/pci-qcom-sort-and-group-registers-and-bitfield-defin.patch new file mode 100644 index 00000000000..bfaa479e800 --- /dev/null +++ b/queue-6.1/pci-qcom-sort-and-group-registers-and-bitfield-defin.patch @@ -0,0 +1,183 @@ +From 138ee40773d23a1227aeb487e9d1f0daeee3d236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 13:41:01 +0530 +Subject: PCI: qcom: Sort and group registers and bitfield definitions + +From: Manivannan Sadhasivam + +[ Upstream commit 769e49d87b15c302c9aadd87c7d114cfe7052320 ] + +Sorting the registers and their bit definitions will make it easier to add +more definitions in the future and it also helps in maintenance. + +While at it, let's also group the registers and bit definitions separately +as done in the pcie-qcom-ep driver. + +Link: https://lore.kernel.org/r/20230316081117.14288-4-manivannan.sadhasivam@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Lorenzo Pieralisi +Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers") +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 108 ++++++++++++++----------- + 1 file changed, 63 insertions(+), 45 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index b587957211c3f..1c8200656aef9 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -31,7 +31,36 @@ + #include "../../pci.h" + #include "pcie-designware.h" + ++/* PARF registers */ + #define PARF_SYS_CTRL 0x00 ++#define PARF_PM_CTRL 0x20 ++#define PARF_PCS_DEEMPH 0x34 ++#define PARF_PCS_SWING 0x38 ++#define PARF_PHY_CTRL 0x40 ++#define PARF_PHY_REFCLK 0x4C ++#define PARF_CONFIG_BITS 0x50 ++#define PARF_DBI_BASE_ADDR 0x168 ++#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP ver 2.3.3 */ ++#define PARF_MHI_CLOCK_RESET_CTRL 0x174 ++#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178 ++#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8 ++#define PARF_Q2A_FLUSH 0x1AC ++#define PARF_LTSSM 0x1B0 ++#define PARF_SID_OFFSET 0x234 ++#define PARF_BDF_TRANSLATE_CFG 0x24C ++#define PARF_SLV_ADDR_SPACE_SIZE 0x358 ++#define PARF_DEVICE_TYPE 0x1000 ++#define PARF_BDF_TO_SID_TABLE_N 0x2000 ++ ++/* ELBI registers */ ++#define ELBI_SYS_CTRL 0x04 ++ ++/* DBI registers */ ++#define AXI_MSTR_RESP_COMP_CTRL0 0x818 ++#define AXI_MSTR_RESP_COMP_CTRL1 0x81c ++#define MISC_CONTROL_1_REG 0x8BC ++ ++/* PARF_SYS_CTRL register fields */ + #define MST_WAKEUP_EN BIT(13) + #define SLV_WAKEUP_EN BIT(12) + #define MSTR_ACLK_CGC_DIS BIT(10) +@@ -41,45 +70,56 @@ + #define L23_CLK_RMV_DIS BIT(2) + #define L1_CLK_RMV_DIS BIT(1) + +-#define PARF_PM_CTRL 0x20 ++/* PARF_PM_CTRL register fields */ + #define REQ_NOT_ENTR_L1 BIT(5) + +-#define PARF_PHY_CTRL 0x40 ++/* PARF_PCS_DEEMPH register fields */ ++#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16) ++#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8) ++#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0) ++ ++/* PARF_PCS_SWING register fields */ ++#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8) ++#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0) ++ ++/* PARF_PHY_CTRL register fields */ + #define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16) + #define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16) + +-#define PARF_PHY_REFCLK 0x4C ++/* PARF_PHY_REFCLK register fields */ + #define PHY_REFCLK_SSP_EN BIT(16) + #define PHY_REFCLK_USE_PAD BIT(12) + +-#define PARF_DBI_BASE_ADDR 0x168 +-#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP rev 2.3.3 */ +-#define PARF_MHI_CLOCK_RESET_CTRL 0x174 ++/* PARF_CONFIG_BITS register fields */ ++#define PHY_RX0_EQ(x) ((x) << 24) ++ ++/* PARF_SLV_ADDR_SPACE_SIZE register value */ ++#define SLV_ADDR_SPACE_SZ 0x10000000 ++ ++/* PARF_MHI_CLOCK_RESET_CTRL register fields */ + #define AHB_CLK_EN BIT(0) + #define MSTR_AXI_CLK_EN BIT(1) + #define BYPASS BIT(4) + +-#define PARF_AXI_MSTR_WR_ADDR_HALT 0x178 +-#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8 +-#define PARF_LTSSM 0x1B0 +-#define PARF_SID_OFFSET 0x234 +-#define PARF_BDF_TRANSLATE_CFG 0x24C +-#define PARF_DEVICE_TYPE 0x1000 +-#define PARF_BDF_TO_SID_TABLE_N 0x2000 ++/* PARF_DEVICE_TYPE register fields */ ++#define DEVICE_TYPE_RC 0x4 + +-#define ELBI_SYS_CTRL 0x04 ++/* ELBI_SYS_CTRL register fields */ + #define ELBI_SYS_CTRL_LT_ENABLE BIT(0) + +-#define AXI_MSTR_RESP_COMP_CTRL0 0x818 ++/* AXI_MSTR_RESP_COMP_CTRL0 register fields */ + #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_2K 0x4 + #define CFG_REMOTE_RD_REQ_BRIDGE_SIZE_4K 0x5 +-#define AXI_MSTR_RESP_COMP_CTRL1 0x81c ++ ++/* AXI_MSTR_RESP_COMP_CTRL1 register fields */ + #define CFG_BRIDGE_SB_INIT BIT(0) + +-#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, \ +- 250) +-#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, \ +- 1) ++/* MISC_CONTROL_1_REG register fields */ ++#define DBI_RO_WR_EN 1 ++ ++/* PCI_EXP_SLTCAP register fields */ ++#define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, 250) ++#define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, 1) + #define PCIE_CAP_SLOT_VAL (PCI_EXP_SLTCAP_ABP | \ + PCI_EXP_SLTCAP_PCP | \ + PCI_EXP_SLTCAP_MRLSP | \ +@@ -91,34 +131,12 @@ + PCIE_CAP_SLOT_POWER_LIMIT_VAL | \ + PCIE_CAP_SLOT_POWER_LIMIT_SCALE) + +-#define PARF_Q2A_FLUSH 0x1AC +- +-#define MISC_CONTROL_1_REG 0x8BC +-#define DBI_RO_WR_EN 1 +- + #define PERST_DELAY_US 1000 +-/* PARF registers */ +-#define PARF_PCS_DEEMPH 0x34 +-#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16) +-#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8) +-#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0) +- +-#define PARF_PCS_SWING 0x38 +-#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8) +-#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0) +- +-#define PARF_CONFIG_BITS 0x50 +-#define PHY_RX0_EQ(x) ((x) << 24) +- +-#define PARF_SLV_ADDR_SPACE_SIZE 0x358 +-#define SLV_ADDR_SPACE_SZ 0x10000000 +- +-#define DEVICE_TYPE_RC 0x4 + +-#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3 +-#define QCOM_PCIE_2_1_0_MAX_CLOCKS 5 ++#define QCOM_PCIE_2_1_0_MAX_SUPPLY 3 ++#define QCOM_PCIE_2_1_0_MAX_CLOCKS 5 + +-#define QCOM_PCIE_CRC8_POLYNOMIAL (BIT(2) | BIT(1) | BIT(0)) ++#define QCOM_PCIE_CRC8_POLYNOMIAL (BIT(2) | BIT(1) | BIT(0)) + + struct qcom_pcie_resources_2_1_0 { + struct clk_bulk_data clks[QCOM_PCIE_2_1_0_MAX_CLOCKS]; +-- +2.39.2 + diff --git a/queue-6.1/pci-qcom-use-dwc-helpers-for-modifying-the-read-only.patch b/queue-6.1/pci-qcom-use-dwc-helpers-for-modifying-the-read-only.patch new file mode 100644 index 00000000000..0ed712df1c3 --- /dev/null +++ b/queue-6.1/pci-qcom-use-dwc-helpers-for-modifying-the-read-only.patch @@ -0,0 +1,62 @@ +From d7f298f6536154fd1f73bafec9c1aee7bc40b478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 20:34:01 +0530 +Subject: PCI: qcom: Use DWC helpers for modifying the read-only DBI registers + +From: Manivannan Sadhasivam + +[ Upstream commit 60f0072d7fb7996b9a524ef0d152e21205473192 ] + +DWC core already exposes dw_pcie_dbi_ro_wr_{en/dis} helper APIs for +enabling and disabling the write access to read only DBI registers. So +let's use them instead of doing it manually. + +Also, the existing code doesn't disable the write access when it's done. +This is also fixed now. + +Link: https://lore.kernel.org/r/20230619150408.8468-3-manivannan.sadhasivam@linaro.org +Fixes: 5d76117f070d ("PCI: qcom: Add support for IPQ8074 PCIe controller") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index e65f4bf50f928..77f4dc244b3f7 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -58,7 +58,6 @@ + /* DBI registers */ + #define AXI_MSTR_RESP_COMP_CTRL0 0x818 + #define AXI_MSTR_RESP_COMP_CTRL1 0x81c +-#define MISC_CONTROL_1_REG 0x8bc + + /* PARF_SYS_CTRL register fields */ + #define MST_WAKEUP_EN BIT(13) +@@ -114,9 +113,6 @@ + /* AXI_MSTR_RESP_COMP_CTRL1 register fields */ + #define CFG_BRIDGE_SB_INIT BIT(0) + +-/* MISC_CONTROL_1_REG register fields */ +-#define DBI_RO_WR_EN 1 +- + /* PCI_EXP_SLTCAP register fields */ + #define PCIE_CAP_SLOT_POWER_LIMIT_VAL FIELD_PREP(PCI_EXP_SLTCAP_SPLV, 250) + #define PCIE_CAP_SLOT_POWER_LIMIT_SCALE FIELD_PREP(PCI_EXP_SLTCAP_SPLS, 1) +@@ -1168,7 +1164,9 @@ static int qcom_pcie_post_init_2_3_3(struct qcom_pcie *pcie) + writel(0, pcie->parf + PARF_Q2A_FLUSH); + + writel(PCI_COMMAND_MASTER, pci->dbi_base + PCI_COMMAND); +- writel(DBI_RO_WR_EN, pci->dbi_base + MISC_CONTROL_1_REG); ++ ++ dw_pcie_dbi_ro_wr_en(pci); ++ + writel(PCIE_CAP_SLOT_VAL, pci->dbi_base + offset + PCI_EXP_SLTCAP); + + val = readl(pci->dbi_base + offset + PCI_EXP_LNKCAP); +-- +2.39.2 + diff --git a/queue-6.1/pci-qcom-use-lower-case-for-hex.patch b/queue-6.1/pci-qcom-use-lower-case-for-hex.patch new file mode 100644 index 00000000000..e15412ce684 --- /dev/null +++ b/queue-6.1/pci-qcom-use-lower-case-for-hex.patch @@ -0,0 +1,61 @@ +From e13a26d0f745afc49a4e0195362ec1f50f01c4c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 13:41:04 +0530 +Subject: PCI: qcom: Use lower case for hex + +From: Manivannan Sadhasivam + +[ Upstream commit 94ebd232dbc84dfdfbf0c406137a8b2aa8b37a01 ] + +To maintain uniformity, let's use lower case for representing hexadecimal +numbers. + +Link: https://lore.kernel.org/r/20230316081117.14288-7-manivannan.sadhasivam@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Lorenzo Pieralisi +Stable-dep-of: 60f0072d7fb7 ("PCI: qcom: Use DWC helpers for modifying the read-only DBI registers") +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 1c8200656aef9..e65f4bf50f928 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -37,17 +37,17 @@ + #define PARF_PCS_DEEMPH 0x34 + #define PARF_PCS_SWING 0x38 + #define PARF_PHY_CTRL 0x40 +-#define PARF_PHY_REFCLK 0x4C ++#define PARF_PHY_REFCLK 0x4c + #define PARF_CONFIG_BITS 0x50 + #define PARF_DBI_BASE_ADDR 0x168 +-#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16C /* Register offset specific to IP ver 2.3.3 */ ++#define PARF_SLV_ADDR_SPACE_SIZE_2_3_3 0x16c /* Register offset specific to IP ver 2.3.3 */ + #define PARF_MHI_CLOCK_RESET_CTRL 0x174 + #define PARF_AXI_MSTR_WR_ADDR_HALT 0x178 +-#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1A8 +-#define PARF_Q2A_FLUSH 0x1AC +-#define PARF_LTSSM 0x1B0 ++#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1a8 ++#define PARF_Q2A_FLUSH 0x1ac ++#define PARF_LTSSM 0x1b0 + #define PARF_SID_OFFSET 0x234 +-#define PARF_BDF_TRANSLATE_CFG 0x24C ++#define PARF_BDF_TRANSLATE_CFG 0x24c + #define PARF_SLV_ADDR_SPACE_SIZE 0x358 + #define PARF_DEVICE_TYPE 0x1000 + #define PARF_BDF_TO_SID_TABLE_N 0x2000 +@@ -58,7 +58,7 @@ + /* DBI registers */ + #define AXI_MSTR_RESP_COMP_CTRL0 0x818 + #define AXI_MSTR_RESP_COMP_CTRL1 0x81c +-#define MISC_CONTROL_1_REG 0x8BC ++#define MISC_CONTROL_1_REG 0x8bc + + /* PARF_SYS_CTRL register fields */ + #define MST_WAKEUP_EN BIT(13) +-- +2.39.2 + diff --git a/queue-6.1/pci-vmd-fix-uninitialized-variable-usage-in-vmd_enab.patch b/queue-6.1/pci-vmd-fix-uninitialized-variable-usage-in-vmd_enab.patch new file mode 100644 index 00000000000..adc77ae3b79 --- /dev/null +++ b/queue-6.1/pci-vmd-fix-uninitialized-variable-usage-in-vmd_enab.patch @@ -0,0 +1,55 @@ +From 5c6558c14834683fb942d24036c94ce7554c99d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 17:43:31 +0800 +Subject: PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xinghui Li + +[ Upstream commit 0c0206dc4f5ba2d18b15e24d2047487d6f73916b ] + +The ret variable in the vmd_enable_domain() function was used +uninitialized when printing a warning message upon failure of +the pci_reset_bus() function. + +Thus, fix the issue by assigning ret with the value returned from +pci_reset_bus() before referencing it in the warning message. + +This was detected by Smatch: + + drivers/pci/controller/vmd.c:931 vmd_enable_domain() error: uninitialized symbol 'ret'. + +[kwilczynski: drop the second patch from the series, add missing reported +by tag, commit log] +Fixes: 0a584655ef89 ("PCI: vmd: Fix secondary bus reset for Intel bridges") +Link: https://lore.kernel.org/all/202305270219.B96IiIfv-lkp@intel.com +Link: https://lore.kernel.org/linux-pci/20230420094332.1507900-2-korantwork@gmail.com +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Xinghui Li +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Nirmal Patel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/vmd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index 50a187a29a1d8..d1eb17e3f1474 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -872,7 +872,8 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) + if (!list_empty(&child->devices)) { + dev = list_first_entry(&child->devices, + struct pci_dev, bus_list); +- if (pci_reset_bus(dev)) ++ ret = pci_reset_bus(dev); ++ if (ret) + pci_warn(dev, "can't reset device: %d\n", ret); + + break; +-- +2.39.2 + diff --git a/queue-6.1/pci-vmd-reset-vmd-config-register-between-soft-reboo.patch b/queue-6.1/pci-vmd-reset-vmd-config-register-between-soft-reboo.patch new file mode 100644 index 00000000000..117710869a4 --- /dev/null +++ b/queue-6.1/pci-vmd-reset-vmd-config-register-between-soft-reboo.patch @@ -0,0 +1,57 @@ +From eebe94c6b2eb93e56a6df928e8b5d2a4b4628435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 13:28:11 -0700 +Subject: PCI: vmd: Reset VMD config register between soft reboots + +From: Nirmal Patel + +[ Upstream commit b61cf04c49c3dfa70a0d6725d3eb40bf9b35cf71 ] + +VMD driver can disable or enable MSI remapping by changing +VMCONFIG_MSI_REMAP register. This register needs to be set to the +default value during soft reboots. Drives failed to enumerate +when Windows boots after performing a soft reboot from Linux. +Windows doesn't support MSI remapping disable feature and stale +register value hinders Windows VMD driver initialization process. +Adding vmd_shutdown function to make sure to set the VMCONFIG +register to the default value. + +Link: https://lore.kernel.org/r/20230224202811.644370-1-nirmal.patel@linux.intel.com +Fixes: ee81ee84f873 ("PCI: vmd: Disable MSI-X remapping when possible") +Signed-off-by: Nirmal Patel +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Jon Derrick +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/vmd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index 769eedeb8802a..50a187a29a1d8 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -979,6 +979,13 @@ static void vmd_remove(struct pci_dev *dev) + ida_simple_remove(&vmd_instance_ida, vmd->instance); + } + ++static void vmd_shutdown(struct pci_dev *dev) ++{ ++ struct vmd_dev *vmd = pci_get_drvdata(dev); ++ ++ vmd_remove_irq_domain(vmd); ++} ++ + #ifdef CONFIG_PM_SLEEP + static int vmd_suspend(struct device *dev) + { +@@ -1056,6 +1063,7 @@ static struct pci_driver vmd_drv = { + .id_table = vmd_ids, + .probe = vmd_probe, + .remove = vmd_remove, ++ .shutdown = vmd_shutdown, + .driver = { + .pm = &vmd_dev_pm_ops, + }, +-- +2.39.2 + diff --git a/queue-6.1/perf-arm-cmn-fix-dtc-reset.patch b/queue-6.1/perf-arm-cmn-fix-dtc-reset.patch new file mode 100644 index 00000000000..f3f02fd3936 --- /dev/null +++ b/queue-6.1/perf-arm-cmn-fix-dtc-reset.patch @@ -0,0 +1,58 @@ +From 1ab3f0019077b5d1e2d5e2633be644b2cb86e839 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 17:44:32 +0100 +Subject: perf/arm-cmn: Fix DTC reset + +From: Robin Murphy + +[ Upstream commit 71746c995cac92fcf6a65661b51211cf2009d7f0 ] + +It turns out that my naive DTC reset logic fails to work as intended, +since, after checking with the hardware designers, the PMU actually +needs to be fully enabled in order to correctly clear any pending +overflows. Therefore, invert the sequence to start with turning on both +enables so that we can reliably get the DTCs into a known state, then +moving to our normal counters-stopped state from there. Since all the +DTM counters have already been unpaired during the initial discovery +pass, we just need to additionally reset the cycle counters to ensure +that no other unexpected overflows occur during this period. + +Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver") +Reported-by: Geoff Blake +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/0ea4559261ea394f827c9aee5168c77a60aaee03.1684946389.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index ff86075edca48..90008e24d1cc7 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -1898,9 +1898,10 @@ static int arm_cmn_init_dtc(struct arm_cmn *cmn, struct arm_cmn_node *dn, int id + if (dtc->irq < 0) + return dtc->irq; + +- writel_relaxed(0, dtc->base + CMN_DT_PMCR); ++ writel_relaxed(CMN_DT_DTC_CTL_DT_EN, dtc->base + CMN_DT_DTC_CTL); ++ writel_relaxed(CMN_DT_PMCR_PMU_EN | CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR); ++ writeq_relaxed(0, dtc->base + CMN_DT_PMCCNTR); + writel_relaxed(0x1ff, dtc->base + CMN_DT_PMOVSR_CLR); +- writel_relaxed(CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR); + + return 0; + } +@@ -1960,7 +1961,7 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) + dn->type = CMN_TYPE_CCLA; + } + +- writel_relaxed(CMN_DT_DTC_CTL_DT_EN, cmn->dtc[0].base + CMN_DT_DTC_CTL); ++ arm_cmn_set_state(cmn, CMN_STATE_DISABLED); + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/perf-bench-add-missing-setlocale-call-to-allow-usage.patch b/queue-6.1/perf-bench-add-missing-setlocale-call-to-allow-usage.patch new file mode 100644 index 00000000000..2a94b3ce5ee --- /dev/null +++ b/queue-6.1/perf-bench-add-missing-setlocale-call-to-allow-usage.patch @@ -0,0 +1,79 @@ +From b045daf2a886c217f5edf9f7f74e947883ad93e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 15:38:25 -0300 +Subject: perf bench: Add missing setlocale() call to allow usage of %'d style + formatting + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 16203e9cd01896b4244100a8e3fb9f6e612ab2b1 ] + +Without this we were not getting the thousands separator for big +numbers. + +Noticed while developing 'perf bench uprobe', but the use of %' predates +that, for instance 'perf bench syscall' uses it. + +Before: + + # perf bench uprobe all + # Running uprobe/baseline benchmark... + # Executed 1000 usleep(1000) calls + Total time: 1054082243ns + + 1054082.243000 nsecs/op + + # + +After: + + # perf bench uprobe all + # Running uprobe/baseline benchmark... + # Executed 1,000 usleep(1000) calls + Total time: 1,053,715,144ns + + 1,053,715.144000 nsecs/op + + # + +Fixes: c2a08203052f8975 ("perf bench: Add basic syscall benchmark") +Cc: Adrian Hunter +Cc: Andre Fredette +Cc: Clark Williams +Cc: Dave Tucker +Cc: Davidlohr Bueso +Cc: Derek Barbosa +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Tiezhu Yang +Link: https://lore.kernel.org/lkml/ZH3lcepZ4tBYr1jv@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-bench.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c +index 334ab897aae3b..a5c2a6938b4e4 100644 +--- a/tools/perf/builtin-bench.c ++++ b/tools/perf/builtin-bench.c +@@ -21,6 +21,7 @@ + #include "builtin.h" + #include "bench/bench.h" + ++#include + #include + #include + #include +@@ -256,6 +257,7 @@ int cmd_bench(int argc, const char **argv) + + /* Unbuffered output */ + setvbuf(stdout, NULL, _IONBF, 0); ++ setlocale(LC_ALL, ""); + + if (argc < 2) { + /* No collection specified. */ +-- +2.39.2 + diff --git a/queue-6.1/perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch b/queue-6.1/perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch new file mode 100644 index 00000000000..2a0c3954e7f --- /dev/null +++ b/queue-6.1/perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch @@ -0,0 +1,45 @@ +From bd9edc4521d6556d019c333d22705fc010973887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 16:41:01 -0700 +Subject: perf dwarf-aux: Fix off-by-one in die_get_varname() + +From: Namhyung Kim + +[ Upstream commit 3abfcfd847717d232e36963f31a361747c388fe7 ] + +The die_get_varname() returns "(unknown_type)" string if it failed to +find a type for the variable. But it had a space before the opening +parenthesis and it made the closing parenthesis cut off due to the +off-by-one in the string length (14). + +Signed-off-by: Namhyung Kim +Fixes: 88fd633cdfa19060 ("perf probe: No need to use formatting strbuf method") +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20230612234102.3909116-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 623527edeac1e..b125eaadcec4d 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -1081,7 +1081,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf) + ret = die_get_typename(vr_die, buf); + if (ret < 0) { + pr_debug("Failed to get type, make it unknown.\n"); +- ret = strbuf_add(buf, " (unknown_type)", 14); ++ ret = strbuf_add(buf, "(unknown_type)", 14); + } + + return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die)); +-- +2.39.2 + diff --git a/queue-6.1/perf-ibs-fix-interface-via-core-pmu-events.patch b/queue-6.1/perf-ibs-fix-interface-via-core-pmu-events.patch new file mode 100644 index 00000000000..d71b21eca5c --- /dev/null +++ b/queue-6.1/perf-ibs-fix-interface-via-core-pmu-events.patch @@ -0,0 +1,164 @@ +From ce11cae1cef6869c3076673d6f2c8019a9f2e7e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 16:30:01 +0530 +Subject: perf/ibs: Fix interface via core pmu events + +From: Ravi Bangoria + +[ Upstream commit 2fad201fe38ff9a692acedb1990ece2c52a29f95 ] + +Although, IBS pmus can be invoked via their own interface, indirect +IBS invocation via core pmu events is also supported with fixed set +of events: cpu-cycles:p, r076:p (same as cpu-cycles:p) and r0C1:p +(micro-ops) for user convenience. + +This indirect IBS invocation is broken since commit 66d258c5b048 +("perf/core: Optimize perf_init_event()"), which added RAW pmu under +'pmu_idr' list and thus if event_init() fails with RAW pmu, it started +returning error instead of trying other pmus. + +Forward precise events from core pmu to IBS by overwriting 'type' and +'config' in the kernel copy of perf_event_attr. Overwriting will cause +perf_init_event() to retry with updated 'type' and 'config', which will +automatically forward event to IBS pmu. + +Without patch: + $ sudo ./perf record -C 0 -e r076:p -- sleep 1 + Error: + The r076:p event is not supported. + +With patch: + $ sudo ./perf record -C 0 -e r076:p -- sleep 1 + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.341 MB perf.data (37 samples) ] + +Fixes: 66d258c5b048 ("perf/core: Optimize perf_init_event()") +Reported-by: Stephane Eranian +Signed-off-by: Ravi Bangoria +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230504110003.2548-3-ravi.bangoria@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/core.c | 2 +- + arch/x86/events/amd/ibs.c | 53 +++++++++++++++---------------- + arch/x86/include/asm/perf_event.h | 2 ++ + 3 files changed, 29 insertions(+), 28 deletions(-) + +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index 8ca5e827f30b2..6672a3f05fc68 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -374,7 +374,7 @@ static int amd_pmu_hw_config(struct perf_event *event) + + /* pass precise event sampling to ibs: */ + if (event->attr.precise_ip && get_ibs_caps()) +- return -ENOENT; ++ return forward_event_to_ibs(event); + + if (has_branch_stack(event) && !x86_pmu.lbr_nr) + return -EOPNOTSUPP; +diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c +index 4cb710efbdd9a..37cbbc5c659a5 100644 +--- a/arch/x86/events/amd/ibs.c ++++ b/arch/x86/events/amd/ibs.c +@@ -190,7 +190,7 @@ static struct perf_ibs *get_ibs_pmu(int type) + } + + /* +- * Use IBS for precise event sampling: ++ * core pmu config -> IBS config + * + * perf record -a -e cpu-cycles:p ... # use ibs op counting cycle count + * perf record -a -e r076:p ... # same as -e cpu-cycles:p +@@ -199,25 +199,9 @@ static struct perf_ibs *get_ibs_pmu(int type) + * IbsOpCntCtl (bit 19) of IBS Execution Control Register (IbsOpCtl, + * MSRC001_1033) is used to select either cycle or micro-ops counting + * mode. +- * +- * The rip of IBS samples has skid 0. Thus, IBS supports precise +- * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the +- * rip is invalid when IBS was not able to record the rip correctly. +- * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then. +- * + */ +-static int perf_ibs_precise_event(struct perf_event *event, u64 *config) ++static int core_pmu_ibs_config(struct perf_event *event, u64 *config) + { +- switch (event->attr.precise_ip) { +- case 0: +- return -ENOENT; +- case 1: +- case 2: +- break; +- default: +- return -EOPNOTSUPP; +- } +- + switch (event->attr.type) { + case PERF_TYPE_HARDWARE: + switch (event->attr.config) { +@@ -243,22 +227,37 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config) + return -EOPNOTSUPP; + } + ++/* ++ * The rip of IBS samples has skid 0. Thus, IBS supports precise ++ * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the ++ * rip is invalid when IBS was not able to record the rip correctly. ++ * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then. ++ */ ++int forward_event_to_ibs(struct perf_event *event) ++{ ++ u64 config = 0; ++ ++ if (!event->attr.precise_ip || event->attr.precise_ip > 2) ++ return -EOPNOTSUPP; ++ ++ if (!core_pmu_ibs_config(event, &config)) { ++ event->attr.type = perf_ibs_op.pmu.type; ++ event->attr.config = config; ++ } ++ return -ENOENT; ++} ++ + static int perf_ibs_init(struct perf_event *event) + { + struct hw_perf_event *hwc = &event->hw; + struct perf_ibs *perf_ibs; + u64 max_cnt, config; +- int ret; + + perf_ibs = get_ibs_pmu(event->attr.type); +- if (perf_ibs) { +- config = event->attr.config; +- } else { +- perf_ibs = &perf_ibs_op; +- ret = perf_ibs_precise_event(event, &config); +- if (ret) +- return ret; +- } ++ if (!perf_ibs) ++ return -ENOENT; ++ ++ config = event->attr.config; + + if (event->pmu != &perf_ibs->pmu) + return -ENOENT; +diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h +index 5d0f6891ae611..4d810b9478a43 100644 +--- a/arch/x86/include/asm/perf_event.h ++++ b/arch/x86/include/asm/perf_event.h +@@ -467,8 +467,10 @@ struct pebs_xmm { + + #ifdef CONFIG_X86_LOCAL_APIC + extern u32 get_ibs_caps(void); ++extern int forward_event_to_ibs(struct perf_event *event); + #else + static inline u32 get_ibs_caps(void) { return 0; } ++static inline int forward_event_to_ibs(struct perf_event *event) { return -ENOENT; } + #endif + + #ifdef CONFIG_PERF_EVENTS +-- +2.39.2 + diff --git a/queue-6.1/perf-script-fix-allocation-of-evsel-priv-related-to-.patch b/queue-6.1/perf-script-fix-allocation-of-evsel-priv-related-to-.patch new file mode 100644 index 00000000000..e067c373734 --- /dev/null +++ b/queue-6.1/perf-script-fix-allocation-of-evsel-priv-related-to-.patch @@ -0,0 +1,100 @@ +From 79587d9cffb4e7a6ae7c1aadcf483b66455760f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 16:11:10 -0300 +Subject: perf script: Fix allocation of evsel->priv related to per-event dump + files + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 36d3e4138e1b6cc9ab179f3f397b5548f8b1eaae ] + +When printing output we may want to generate per event files, where the +--per-event-dump option should be used, creating perf.data.EVENT.dump +files instead of printing to stdout. + +The callback thar processes event thus expects that evsel->priv->fp +should point to either the per-event FILE descriptor or to stdout. + +The a3af66f51bd0bca7 ("perf script: Fix crash because of missing +evsel->priv") changeset fixed a case where evsel->priv wasn't setup, +thus set to NULL, causing a segfault when trying to access +evsel->priv->fp. + +But it did it for the non --per-event-dump case by allocating a 'struct +perf_evsel_script' just to set its ->fp to stdout. + +Since evsel->priv is only freed when --per-event-dump is used, we ended +up with a memory leak, detected using ASAN. + +Fix it by using the same method as perf_script__setup_per_event_dump(), +and reuse that static 'struct perf_evsel_script'. + +Also check if evsel_script__new() failed. + +Fixes: a3af66f51bd0bca7 ("perf script: Fix crash because of missing evsel->priv") +Reported-by: Ian Rogers +Tested-by: Ian Rogers +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Ravi Bangoria +Link: https://lore.kernel.org/lkml/ZH+F0wGAWV14zvMP@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-script.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 7ca238277d835..a794a3d2e47b7 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -2390,6 +2390,9 @@ static int process_sample_event(struct perf_tool *tool, + return ret; + } + ++// Used when scr->per_event_dump is not set ++static struct evsel_script es_stdout; ++ + static int process_attr(struct perf_tool *tool, union perf_event *event, + struct evlist **pevlist) + { +@@ -2398,7 +2401,6 @@ static int process_attr(struct perf_tool *tool, union perf_event *event, + struct evsel *evsel, *pos; + u64 sample_type; + int err; +- static struct evsel_script *es; + + err = perf_event__process_attr(tool, event, pevlist); + if (err) +@@ -2408,14 +2410,13 @@ static int process_attr(struct perf_tool *tool, union perf_event *event, + evsel = evlist__last(*pevlist); + + if (!evsel->priv) { +- if (scr->per_event_dump) { ++ if (scr->per_event_dump) { + evsel->priv = evsel_script__new(evsel, scr->session->data); +- } else { +- es = zalloc(sizeof(*es)); +- if (!es) ++ if (!evsel->priv) + return -ENOMEM; +- es->fp = stdout; +- evsel->priv = es; ++ } else { // Replicate what is done in perf_script__setup_per_event_dump() ++ es_stdout.fp = stdout; ++ evsel->priv = &es_stdout; + } + } + +@@ -2721,7 +2722,6 @@ static int perf_script__fopen_per_event_dump(struct perf_script *script) + static int perf_script__setup_per_event_dump(struct perf_script *script) + { + struct evsel *evsel; +- static struct evsel_script es_stdout; + + if (script->per_event_dump) + return perf_script__fopen_per_event_dump(script); +-- +2.39.2 + diff --git a/queue-6.1/perf-tool-x86-consolidate-is_amd-check-into-single-f.patch b/queue-6.1/perf-tool-x86-consolidate-is_amd-check-into-single-f.patch new file mode 100644 index 00000000000..d9797565727 --- /dev/null +++ b/queue-6.1/perf-tool-x86-consolidate-is_amd-check-into-single-f.patch @@ -0,0 +1,174 @@ +From 6298c4349f822819a6b2cff7f96ae68a0354a99d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 15:25:04 +0530 +Subject: perf tool x86: Consolidate is_amd check into single function + +From: Ravi Bangoria + +[ Upstream commit 0cd1ca4650c9cf5f318110f67d39cbebae3693b3 ] + +There are multiple places where x86 specific code determines AMD vs +Intel arch and acts based on that. Consolidate those checks into a +single function. + +Signed-off-by: Ravi Bangoria +Acked-by: Ian Rogers +Cc: Adrian Hunter +Cc: Ali Saidi +Cc: Ananth Narayan +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Leo Yan +Cc: Madhavan Srinivasan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sandipan Das +Cc: Santosh Shukla +Link: https://lore.kernel.org/r/20230613095506.547-3-ravi.bangoria@amd.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 99d4850062a8 ("perf tool x86: Fix perf_env memory leak") +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/Build | 1 + + tools/perf/arch/x86/util/env.c | 19 +++++++++++++++++++ + tools/perf/arch/x86/util/env.h | 7 +++++++ + tools/perf/arch/x86/util/evsel.c | 16 ++-------------- + tools/perf/arch/x86/util/mem-events.c | 19 ++----------------- + 5 files changed, 31 insertions(+), 31 deletions(-) + create mode 100644 tools/perf/arch/x86/util/env.c + create mode 100644 tools/perf/arch/x86/util/env.h + +diff --git a/tools/perf/arch/x86/util/Build b/tools/perf/arch/x86/util/Build +index dbeb04cb336e0..93c3ee5f95430 100644 +--- a/tools/perf/arch/x86/util/Build ++++ b/tools/perf/arch/x86/util/Build +@@ -10,6 +10,7 @@ perf-y += evlist.o + perf-y += mem-events.o + perf-y += evsel.o + perf-y += iostat.o ++perf-y += env.o + + perf-$(CONFIG_DWARF) += dwarf-regs.o + perf-$(CONFIG_BPF_PROLOGUE) += dwarf-regs.o +diff --git a/tools/perf/arch/x86/util/env.c b/tools/perf/arch/x86/util/env.c +new file mode 100644 +index 0000000000000..33b87f8ac1cc1 +--- /dev/null ++++ b/tools/perf/arch/x86/util/env.c +@@ -0,0 +1,19 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include "linux/string.h" ++#include "util/env.h" ++#include "env.h" ++ ++bool x86__is_amd_cpu(void) ++{ ++ struct perf_env env = { .total_mem = 0, }; ++ static int is_amd; /* 0: Uninitialized, 1: Yes, -1: No */ ++ ++ if (is_amd) ++ goto ret; ++ ++ perf_env__cpuid(&env); ++ is_amd = env.cpuid && strstarts(env.cpuid, "AuthenticAMD") ? 1 : -1; ++ ++ret: ++ return is_amd >= 1 ? true : false; ++} +diff --git a/tools/perf/arch/x86/util/env.h b/tools/perf/arch/x86/util/env.h +new file mode 100644 +index 0000000000000..d78f080b6b3f8 +--- /dev/null ++++ b/tools/perf/arch/x86/util/env.h +@@ -0,0 +1,7 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _X86_ENV_H ++#define _X86_ENV_H ++ ++bool x86__is_amd_cpu(void); ++ ++#endif /* _X86_ENV_H */ +diff --git a/tools/perf/arch/x86/util/evsel.c b/tools/perf/arch/x86/util/evsel.c +index ea3972d785d10..d72390cdf391d 100644 +--- a/tools/perf/arch/x86/util/evsel.c ++++ b/tools/perf/arch/x86/util/evsel.c +@@ -7,6 +7,7 @@ + #include "linux/string.h" + #include "evsel.h" + #include "util/debug.h" ++#include "env.h" + + #define IBS_FETCH_L3MISSONLY (1ULL << 59) + #define IBS_OP_L3MISSONLY (1ULL << 16) +@@ -97,23 +98,10 @@ void arch__post_evsel_config(struct evsel *evsel, struct perf_event_attr *attr) + { + struct perf_pmu *evsel_pmu, *ibs_fetch_pmu, *ibs_op_pmu; + static int warned_once; +- /* 0: Uninitialized, 1: Yes, -1: No */ +- static int is_amd; + +- if (warned_once || is_amd == -1) ++ if (warned_once || !x86__is_amd_cpu()) + return; + +- if (!is_amd) { +- struct perf_env *env = evsel__env(evsel); +- +- if (!perf_env__cpuid(env) || !env->cpuid || +- !strstarts(env->cpuid, "AuthenticAMD")) { +- is_amd = -1; +- return; +- } +- is_amd = 1; +- } +- + evsel_pmu = evsel__find_pmu(evsel); + if (!evsel_pmu) + return; +diff --git a/tools/perf/arch/x86/util/mem-events.c b/tools/perf/arch/x86/util/mem-events.c +index f683ac702247c..efc0fae9ed0a7 100644 +--- a/tools/perf/arch/x86/util/mem-events.c ++++ b/tools/perf/arch/x86/util/mem-events.c +@@ -4,6 +4,7 @@ + #include "map_symbol.h" + #include "mem-events.h" + #include "linux/string.h" ++#include "env.h" + + static char mem_loads_name[100]; + static bool mem_loads_name__init; +@@ -26,28 +27,12 @@ static struct perf_mem_event perf_mem_events_amd[PERF_MEM_EVENTS__MAX] = { + E("mem-ldst", "ibs_op//", "ibs_op"), + }; + +-static int perf_mem_is_amd_cpu(void) +-{ +- struct perf_env env = { .total_mem = 0, }; +- +- perf_env__cpuid(&env); +- if (env.cpuid && strstarts(env.cpuid, "AuthenticAMD")) +- return 1; +- return -1; +-} +- + struct perf_mem_event *perf_mem_events__ptr(int i) + { +- /* 0: Uninitialized, 1: Yes, -1: No */ +- static int is_amd; +- + if (i >= PERF_MEM_EVENTS__MAX) + return NULL; + +- if (!is_amd) +- is_amd = perf_mem_is_amd_cpu(); +- +- if (is_amd == 1) ++ if (x86__is_amd_cpu()) + return &perf_mem_events_amd[i]; + + return &perf_mem_events_intel[i]; +-- +2.39.2 + diff --git a/queue-6.1/perf-tool-x86-fix-perf_env-memory-leak.patch b/queue-6.1/perf-tool-x86-fix-perf_env-memory-leak.patch new file mode 100644 index 00000000000..60ea4303698 --- /dev/null +++ b/queue-6.1/perf-tool-x86-fix-perf_env-memory-leak.patch @@ -0,0 +1,70 @@ +From 8595990458f218317eca9268a0936ddcaa3bb012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 16:54:16 -0700 +Subject: perf tool x86: Fix perf_env memory leak + +From: Ian Rogers + +[ Upstream commit 99d4850062a84564f36923764bb93935ef2ed108 ] + +Found by leak sanitizer: +``` +==1632594==ERROR: LeakSanitizer: detected memory leaks + +Direct leak of 21 byte(s) in 1 object(s) allocated from: + #0 0x7f2953a7077b in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:439 + #1 0x556701d6fbbf in perf_env__read_cpuid util/env.c:369 + #2 0x556701d70589 in perf_env__cpuid util/env.c:465 + #3 0x55670204bba2 in x86__is_amd_cpu arch/x86/util/env.c:14 + #4 0x5567020487a2 in arch__post_evsel_config arch/x86/util/evsel.c:83 + #5 0x556701d8f78b in evsel__config util/evsel.c:1366 + #6 0x556701ef5872 in evlist__config util/record.c:108 + #7 0x556701cd6bcd in test__PERF_RECORD tests/perf-record.c:112 + #8 0x556701cacd07 in run_test tests/builtin-test.c:236 + #9 0x556701cacfac in test_and_print tests/builtin-test.c:265 + #10 0x556701cadddb in __cmd_test tests/builtin-test.c:402 + #11 0x556701caf2aa in cmd_test tests/builtin-test.c:559 + #12 0x556701d3b557 in run_builtin tools/perf/perf.c:323 + #13 0x556701d3bac8 in handle_internal_command tools/perf/perf.c:377 + #14 0x556701d3be90 in run_argv tools/perf/perf.c:421 + #15 0x556701d3c3f8 in main tools/perf/perf.c:537 + #16 0x7f2952a46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + +SUMMARY: AddressSanitizer: 21 byte(s) leaked in 1 allocation(s). +``` + +Fixes: f7b58cbdb3ff36eb ("perf mem/c2c: Add load store event mappings for AMD") +Signed-off-by: Ian Rogers +Acked-by: Ravi Bangoria +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Link: https://lore.kernel.org/r/20230613235416.1650755-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/env.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/arch/x86/util/env.c b/tools/perf/arch/x86/util/env.c +index 33b87f8ac1cc1..3e537ffb1353a 100644 +--- a/tools/perf/arch/x86/util/env.c ++++ b/tools/perf/arch/x86/util/env.c +@@ -13,7 +13,7 @@ bool x86__is_amd_cpu(void) + + perf_env__cpuid(&env); + is_amd = env.cpuid && strstarts(env.cpuid, "AuthenticAMD") ? 1 : -1; +- ++ perf_env__exit(&env); + ret: + return is_amd >= 1 ? true : false; + } +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch b/queue-6.1/pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch new file mode 100644 index 00000000000..597b8a98877 --- /dev/null +++ b/queue-6.1/pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch @@ -0,0 +1,41 @@ +From 491fe189006dadbfd02f6ca96798b4d7f5d7dcb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 13:53:33 +0300 +Subject: pinctrl: at91-pio4: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit f6fd5d4ff8ca0b24cee1af4130bcb1fa96b61aa0 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller") +Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks") +Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int") +Signed-off-by: Claudiu Beznea +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230615105333.585304-4-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 0b7cc6f063e00..f71c6457e3509 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1122,6 +1122,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) + /* Pin naming convention: P(bank_name)(bank_pin_number). */ + pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d", + bank + 'A', line); ++ if (!pin_desc[i].name) ++ return -ENOMEM; + + group->name = group_names[i] = pin_desc[i].name; + group->pin = pin_desc[i].number; +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch b/queue-6.1/pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch new file mode 100644 index 00000000000..cac544dcc4d --- /dev/null +++ b/queue-6.1/pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch @@ -0,0 +1,41 @@ +From 19ebd7ba46792c44d49228a0b6a157237ac17a28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 23:43:41 +0200 +Subject: pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors + +From: Christophe JAILLET + +[ Upstream commit cdf7e616120065007687fe1df0412154f259daec ] + +gpiochip_add_pin_range() can fail, so better return its error code than +a hard coded '0'. + +Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/98c3b5890bb72415145c9fe4e1d974711edae376.1681681402.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index 0f1ab0829ffe6..fe8da3ccb0b5a 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -376,10 +376,8 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc, + if (!pctldev) + return 0; + +- gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0, +- gc->ngpio); +- +- return 0; ++ return gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0, ++ gc->ngpio); + } + + static const struct gpio_chip bcm2835_gpio_chip = { +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch b/queue-6.1/pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch new file mode 100644 index 00000000000..c5326e316a4 --- /dev/null +++ b/queue-6.1/pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch @@ -0,0 +1,57 @@ +From 690d4b25b2f96060fae903264708fcbbfb9d95ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 17:37:34 +0300 +Subject: pinctrl: cherryview: Return correct value if pin in push-pull mode + +From: Andy Shevchenko + +[ Upstream commit 5835196a17be5cfdcad0b617f90cf4abe16951a4 ] + +Currently the getter returns ENOTSUPP on pin configured in +the push-pull mode. Fix this by adding the missed switch case. + +Fixes: ccdf81d08dbe ("pinctrl: cherryview: add option to set open-drain pin config") +Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support") +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index 5c4fd16e5b010..0d6b5fab2f7e4 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -947,11 +947,6 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin, + + break; + +- case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- if (!(ctrl1 & CHV_PADCTRL1_ODEN)) +- return -EINVAL; +- break; +- + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: { + u32 cfg; + +@@ -961,6 +956,16 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin, + return -EINVAL; + + break; ++ ++ case PIN_CONFIG_DRIVE_PUSH_PULL: ++ if (ctrl1 & CHV_PADCTRL1_ODEN) ++ return -EINVAL; ++ break; ++ ++ case PIN_CONFIG_DRIVE_OPEN_DRAIN: ++ if (!(ctrl1 & CHV_PADCTRL1_ODEN)) ++ return -EINVAL; ++ break; + } + + default: +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch b/queue-6.1/pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch new file mode 100644 index 00000000000..36a43a5d83f --- /dev/null +++ b/queue-6.1/pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch @@ -0,0 +1,40 @@ +From 507e99cd0b76193ad38e44b485b44bac8e9be79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 13:53:32 +0300 +Subject: pinctrl: microchip-sgpio: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 310cd4c206cd04696ccbfd1927b5ab6973e8cc8e ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 7e5ea974e61c ("pinctrl: pinctrl-microchip-sgpio: Add pinctrl driver for Microsemi Serial GPIO") +Signed-off-by: Claudiu Beznea +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230615105333.585304-3-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-microchip-sgpio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-microchip-sgpio.c b/drivers/pinctrl/pinctrl-microchip-sgpio.c +index af27b72c89586..96a20ce94f5e9 100644 +--- a/drivers/pinctrl/pinctrl-microchip-sgpio.c ++++ b/drivers/pinctrl/pinctrl-microchip-sgpio.c +@@ -816,6 +816,9 @@ static int microchip_sgpio_register_bank(struct device *dev, + pctl_desc->name = devm_kasprintf(dev, GFP_KERNEL, "%s-%sput", + dev_name(dev), + bank->is_input ? "in" : "out"); ++ if (!pctl_desc->name) ++ return -ENOMEM; ++ + pctl_desc->pctlops = &sgpio_pctl_ops; + pctl_desc->pmxops = &sgpio_pmx_ops; + pctl_desc->confops = &sgpio_confops; +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-npcm7xx-add-missing-check-for-ioremap.patch b/queue-6.1/pinctrl-npcm7xx-add-missing-check-for-ioremap.patch new file mode 100644 index 00000000000..b0394505892 --- /dev/null +++ b/queue-6.1/pinctrl-npcm7xx-add-missing-check-for-ioremap.patch @@ -0,0 +1,38 @@ +From b64b104469463ab4faf3bdb73a9615821d3d85b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 17:58:29 +0800 +Subject: pinctrl: npcm7xx: Add missing check for ioremap + +From: Jiasheng Jiang + +[ Upstream commit ad64639417161e90b30dda00486570eb150aeee5 ] + +Add check for ioremap() and return the error if it fails in order to +guarantee the success of ioremap(). + +Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230607095829.1345-1-jiasheng@iscas.ac.cn +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +index 1c4e89b046de1..ac4c69132fa03 100644 +--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c ++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +@@ -1878,6 +1878,8 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl) + } + + pctrl->gpio_bank[id].base = ioremap(res.start, resource_size(&res)); ++ if (!pctrl->gpio_bank[id].base) ++ return -EINVAL; + + ret = bgpio_init(&pctrl->gpio_bank[id].gc, dev, 4, + pctrl->gpio_bank[id].base + NPCM7XX_GP_N_DIN, +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-sunplus-add-check-for-kmalloc.patch b/queue-6.1/pinctrl-sunplus-add-check-for-kmalloc.patch new file mode 100644 index 00000000000..e899d5a43b0 --- /dev/null +++ b/queue-6.1/pinctrl-sunplus-add-check-for-kmalloc.patch @@ -0,0 +1,91 @@ +From c5b9c7a05e6c4c6bdac4c2f219a4c92c1283e7ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 20:34:37 +0800 +Subject: pinctrl: sunplus: Add check for kmalloc + +From: Wells Lu + +[ Upstream commit a5961bed5429cf1134d7f539b4ed60317012f84d ] + +Fix Smatch static checker warning: +potential null dereference 'configs'. (kmalloc returns null) + +Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021") +Signed-off-by: Wells Lu +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/1685277277-12209-1-git-send-email-wellslutw@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sunplus/sppctl.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/sunplus/sppctl.c b/drivers/pinctrl/sunplus/sppctl.c +index 2b3335ab56c66..0449595b943cf 100644 +--- a/drivers/pinctrl/sunplus/sppctl.c ++++ b/drivers/pinctrl/sunplus/sppctl.c +@@ -838,11 +838,6 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node + int i, size = 0; + + list = of_get_property(np_config, "sunplus,pins", &size); +- +- if (nmG <= 0) +- nmG = 0; +- +- parent = of_get_parent(np_config); + *num_maps = size / sizeof(*list); + + /* +@@ -870,10 +865,14 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node + } + } + ++ if (nmG <= 0) ++ nmG = 0; ++ + *map = kcalloc(*num_maps + nmG, sizeof(**map), GFP_KERNEL); +- if (*map == NULL) ++ if (!(*map)) + return -ENOMEM; + ++ parent = of_get_parent(np_config); + for (i = 0; i < (*num_maps); i++) { + dt_pin = be32_to_cpu(list[i]); + pin_num = FIELD_GET(GENMASK(31, 24), dt_pin); +@@ -887,6 +886,8 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node + (*map)[i].data.configs.num_configs = 1; + (*map)[i].data.configs.group_or_pin = pin_get_name(pctldev, pin_num); + configs = kmalloc(sizeof(*configs), GFP_KERNEL); ++ if (!configs) ++ goto sppctl_map_err; + *configs = FIELD_GET(GENMASK(7, 0), dt_pin); + (*map)[i].data.configs.configs = configs; + +@@ -900,6 +901,8 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node + (*map)[i].data.configs.num_configs = 1; + (*map)[i].data.configs.group_or_pin = pin_get_name(pctldev, pin_num); + configs = kmalloc(sizeof(*configs), GFP_KERNEL); ++ if (!configs) ++ goto sppctl_map_err; + *configs = SPPCTL_IOP_CONFIGS; + (*map)[i].data.configs.configs = configs; + +@@ -969,6 +972,15 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node + of_node_put(parent); + dev_dbg(pctldev->dev, "%d pins mapped\n", *num_maps); + return 0; ++ ++sppctl_map_err: ++ for (i = 0; i < (*num_maps); i++) ++ if (((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) && ++ (*map)[i].data.configs.configs) ++ kfree((*map)[i].data.configs.configs); ++ kfree(*map); ++ of_node_put(parent); ++ return -ENOMEM; + } + + static const struct pinctrl_ops sppctl_pctl_ops = { +-- +2.39.2 + diff --git a/queue-6.1/pinctrl-sunplus-add-check-for-kmalloc.patch-1604 b/queue-6.1/pinctrl-sunplus-add-check-for-kmalloc.patch-1604 new file mode 100644 index 00000000000..cfdbd156714 --- /dev/null +++ b/queue-6.1/pinctrl-sunplus-add-check-for-kmalloc.patch-1604 @@ -0,0 +1,44 @@ +From 1bab5342f61f9fa25e600d633e3dab8514c58205 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 20:34:37 +0800 +Subject: pinctrl:sunplus: Add check for kmalloc + +From: Wells Lu + +[ Upstream commit 73f8ce7f961afcb3be49352efeb7c26cc1c00cc4 ] + +Fix Smatch static checker warning: +potential null dereference 'configs'. (kmalloc returns null) + +Changes in v2: +1. Add free allocated memory before returned -ENOMEM. +2. Add call of_node_put() before returned -ENOMEM. + +Fixes: aa74c44be19c ("pinctrl: Add driver for Sunplus SP7021") +Signed-off-by: Wells Lu +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/1685277277-12209-1-git-send-email-wellslutw@gmail.com +[Rebased on the patch from Lu Hongfei] +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sunplus/sppctl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/sunplus/sppctl.c b/drivers/pinctrl/sunplus/sppctl.c +index 0449595b943cf..6b24fa0e63c0f 100644 +--- a/drivers/pinctrl/sunplus/sppctl.c ++++ b/drivers/pinctrl/sunplus/sppctl.c +@@ -975,8 +975,7 @@ static int sppctl_dt_node_to_map(struct pinctrl_dev *pctldev, struct device_node + + sppctl_map_err: + for (i = 0; i < (*num_maps); i++) +- if (((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) && +- (*map)[i].data.configs.configs) ++ if ((*map)[i].type == PIN_MAP_TYPE_CONFIGS_PIN) + kfree((*map)[i].data.configs.configs); + kfree(*map); + of_node_put(parent); +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-dell-dell-rbtn-fix-resources-leaking-on.patch b/queue-6.1/platform-x86-dell-dell-rbtn-fix-resources-leaking-on.patch new file mode 100644 index 00000000000..e3d3c1889be --- /dev/null +++ b/queue-6.1/platform-x86-dell-dell-rbtn-fix-resources-leaking-on.patch @@ -0,0 +1,83 @@ +From 9b1c8e877e552181d40f754053a01aa516a158e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 11:43:10 +0300 +Subject: platform/x86/dell/dell-rbtn: Fix resources leaking on error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Wilczynski + +[ Upstream commit 966cca72ab20289083521a385fa56035d85a222d ] + +Currently rbtn_add() in case of failure is leaking resources. Fix this +by adding a proper rollback. Move devm_kzalloc() before rbtn_acquire(), +so it doesn't require rollback in case of failure. While at it, remove +unnecessary assignment of NULL to device->driver_data and unnecessary +whitespace, plus add a break for the default case in a switch. + +Suggested-by: Ilpo Järvinen +Suggested-by: Pali Rohár +Fixes: 817a5cdb40c8 ("dell-rbtn: Dell Airplane Mode Switch driver") +Signed-off-by: Michal Wilczynski +Reviewed-by: Andy Shevchenko +Acked-by: Rafael J. Wysocki +Reviewed-by: Pali Rohár +Link: https://lore.kernel.org/r/20230613084310.2775896-1-michal.wilczynski@intel.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell-rbtn.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/platform/x86/dell/dell-rbtn.c b/drivers/platform/x86/dell/dell-rbtn.c +index aa0e6c9074942..c8fcb537fd65d 100644 +--- a/drivers/platform/x86/dell/dell-rbtn.c ++++ b/drivers/platform/x86/dell/dell-rbtn.c +@@ -395,16 +395,16 @@ static int rbtn_add(struct acpi_device *device) + return -EINVAL; + } + ++ rbtn_data = devm_kzalloc(&device->dev, sizeof(*rbtn_data), GFP_KERNEL); ++ if (!rbtn_data) ++ return -ENOMEM; ++ + ret = rbtn_acquire(device, true); + if (ret < 0) { + dev_err(&device->dev, "Cannot enable device\n"); + return ret; + } + +- rbtn_data = devm_kzalloc(&device->dev, sizeof(*rbtn_data), GFP_KERNEL); +- if (!rbtn_data) +- return -ENOMEM; +- + rbtn_data->type = type; + device->driver_data = rbtn_data; + +@@ -420,10 +420,12 @@ static int rbtn_add(struct acpi_device *device) + break; + default: + ret = -EINVAL; ++ break; + } ++ if (ret) ++ rbtn_acquire(device, false); + + return ret; +- + } + + static void rbtn_remove(struct acpi_device *device) +@@ -442,7 +444,6 @@ static void rbtn_remove(struct acpi_device *device) + } + + rbtn_acquire(device, false); +- device->driver_data = NULL; + } + + static void rbtn_notify(struct acpi_device *device, u32 event) +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-lenovo-yogabook-fix-work-race-on-remove.patch b/queue-6.1/platform-x86-lenovo-yogabook-fix-work-race-on-remove.patch new file mode 100644 index 00000000000..ae83d464257 --- /dev/null +++ b/queue-6.1/platform-x86-lenovo-yogabook-fix-work-race-on-remove.patch @@ -0,0 +1,93 @@ +From cfd81409c8430d96e9597c2f5390135c51b36530 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Apr 2023 18:57:50 +0200 +Subject: platform/x86: lenovo-yogabook: Fix work race on remove() + +From: Hans de Goede + +[ Upstream commit 9148cd2eb4450a8e9c49c8a14201fb82f651128f ] + +When yogabook_wmi_remove() runs yogabook_wmi_work might still be running +and using the devices which yogabook_wmi_remove() puts. + +To avoid this move to explicitly cancelling the work rather then using +devm_work_autocancel(). + +This requires also making the yogabook_backside_hall_irq handler non +devm managed, so that it cannot re-queue the work while +yogabook_wmi_remove() runs. + +Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230430165807.472798-3-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lenovo-yogabook-wmi.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c +index 5f4bd1eec38a9..3a6de4ab74a41 100644 +--- a/drivers/platform/x86/lenovo-yogabook-wmi.c ++++ b/drivers/platform/x86/lenovo-yogabook-wmi.c +@@ -2,7 +2,6 @@ + /* WMI driver for Lenovo Yoga Book YB1-X90* / -X91* tablets */ + + #include +-#include + #include + #include + #include +@@ -248,10 +247,7 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context) + data->brightness = YB_KBD_BL_DEFAULT; + set_bit(YB_KBD_IS_ON, &data->flags); + set_bit(YB_DIGITIZER_IS_ON, &data->flags); +- +- r = devm_work_autocancel(&wdev->dev, &data->work, yogabook_wmi_work); +- if (r) +- return r; ++ INIT_WORK(&data->work, yogabook_wmi_work); + + data->kbd_adev = acpi_dev_get_first_match_dev("GDIX1001", NULL, -1); + if (!data->kbd_adev) { +@@ -299,10 +295,9 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context) + } + data->backside_hall_irq = r; + +- r = devm_request_irq(&wdev->dev, data->backside_hall_irq, +- yogabook_backside_hall_irq, +- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING, +- "backside_hall_sw", data); ++ r = request_irq(data->backside_hall_irq, yogabook_backside_hall_irq, ++ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING, ++ "backside_hall_sw", data); + if (r) { + dev_err_probe(&wdev->dev, r, "Requesting backside_hall_sw IRQ\n"); + goto error_put_devs; +@@ -318,11 +313,14 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context) + r = devm_led_classdev_register(&wdev->dev, &data->kbd_bl_led); + if (r < 0) { + dev_err_probe(&wdev->dev, r, "Registering backlight LED device\n"); +- goto error_put_devs; ++ goto error_free_irq; + } + + return 0; + ++error_free_irq: ++ free_irq(data->backside_hall_irq, data); ++ cancel_work_sync(&data->work); + error_put_devs: + put_device(data->dig_dev); + put_device(data->kbd_dev); +@@ -335,6 +333,8 @@ static void yogabook_wmi_remove(struct wmi_device *wdev) + { + struct yogabook_wmi *data = dev_get_drvdata(&wdev->dev); + ++ free_irq(data->backside_hall_irq, data); ++ cancel_work_sync(&data->work); + put_device(data->dig_dev); + put_device(data->kbd_dev); + acpi_dev_put(data->dig_adev); +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-lenovo-yogabook-reprobe-devices-on-remo.patch b/queue-6.1/platform-x86-lenovo-yogabook-reprobe-devices-on-remo.patch new file mode 100644 index 00000000000..286ec19821b --- /dev/null +++ b/queue-6.1/platform-x86-lenovo-yogabook-reprobe-devices-on-remo.patch @@ -0,0 +1,50 @@ +From 8f6f3fbddc7b099053d0b1a6465c0dc873d50908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Apr 2023 18:57:51 +0200 +Subject: platform/x86: lenovo-yogabook: Reprobe devices on remove() + +From: Hans de Goede + +[ Upstream commit 711bcc0cb34e96a60e88d7b0260862781de3e530 ] + +Ensure that both the keyboard touchscreen and the digitizer have their +driver bound after remove(). Without this modprobing lenovo-yogabook-wmi +after a rmmod fails because lenovo-yogabook-wmi defers probing until +both devices have their driver bound. + +Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230430165807.472798-4-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lenovo-yogabook-wmi.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c +index 3a6de4ab74a41..5948ffa74acd5 100644 +--- a/drivers/platform/x86/lenovo-yogabook-wmi.c ++++ b/drivers/platform/x86/lenovo-yogabook-wmi.c +@@ -332,9 +332,20 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context) + static void yogabook_wmi_remove(struct wmi_device *wdev) + { + struct yogabook_wmi *data = dev_get_drvdata(&wdev->dev); ++ int r = 0; + + free_irq(data->backside_hall_irq, data); + cancel_work_sync(&data->work); ++ ++ if (!test_bit(YB_KBD_IS_ON, &data->flags)) ++ r |= device_reprobe(data->kbd_dev); ++ ++ if (!test_bit(YB_DIGITIZER_IS_ON, &data->flags)) ++ r |= device_reprobe(data->dig_dev); ++ ++ if (r) ++ dev_warn(&wdev->dev, "Reprobe of devices failed\n"); ++ + put_device(data->dig_dev); + put_device(data->kbd_dev); + acpi_dev_put(data->dig_adev); +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-lenovo-yogabook-set-default-keyboard-ba.patch b/queue-6.1/platform-x86-lenovo-yogabook-set-default-keyboard-ba.patch new file mode 100644 index 00000000000..3312f4b2a48 --- /dev/null +++ b/queue-6.1/platform-x86-lenovo-yogabook-set-default-keyboard-ba.patch @@ -0,0 +1,38 @@ +From a1881f5c2d3df3a52ae14d7712338ca247a26602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Apr 2023 18:57:52 +0200 +Subject: platform/x86: lenovo-yogabook: Set default keyboard backligh + brightness on probe() + +From: Hans de Goede + +[ Upstream commit 9e6380d6573181c555ca1b5019b08d19a9ee581c ] + +Set default keyboard backlight brightness on probe(), this fixes +the backlight being off after a rmmod + modprobe. + +Fixes: c0549b72d99d ("platform/x86: lenovo-yogabook-wmi: Add driver for Lenovo Yoga Book") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230430165807.472798-5-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lenovo-yogabook-wmi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/platform/x86/lenovo-yogabook-wmi.c b/drivers/platform/x86/lenovo-yogabook-wmi.c +index 5948ffa74acd5..d57fcc8388519 100644 +--- a/drivers/platform/x86/lenovo-yogabook-wmi.c ++++ b/drivers/platform/x86/lenovo-yogabook-wmi.c +@@ -295,6 +295,9 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context) + } + data->backside_hall_irq = r; + ++ /* Set default brightness before enabling the IRQ */ ++ yogabook_wmi_set_kbd_backlight(data->wdev, YB_KBD_BL_DEFAULT); ++ + r = request_irq(data->backside_hall_irq, yogabook_backside_hall_irq, + IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING, + "backside_hall_sw", data); +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-correct-nvme-password-handlin.patch b/queue-6.1/platform-x86-think-lmi-correct-nvme-password-handlin.patch new file mode 100644 index 00000000000..dcf0add8f40 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-correct-nvme-password-handlin.patch @@ -0,0 +1,48 @@ +From db47337a8f043bedef4022bc095cb172cf67d47f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 16:05:50 -0400 +Subject: platform/x86: think-lmi: Correct NVME password handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit 4cebb42412248d28df6de01420cfac5654428d41 ] + +NVME passwords identifier have been standardised across the Lenovo +systems and now use udrp and adrp (user and admin level) instead of +unvp and mnvp. + +This should apparently be backwards compatible. + +Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support") +Signed-off-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230601200552.4396-6-mpearson-lenovo@squebb.ca +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 3a511c0f13e45..3cbb92b6c5215 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -461,9 +461,9 @@ static ssize_t new_password_store(struct kobject *kobj, + sprintf(pwd_type, "mhdp%d", setting->index); + } else if (setting == tlmi_priv.pwd_nvme) { + if (setting->level == TLMI_LEVEL_USER) +- sprintf(pwd_type, "unvp%d", setting->index); ++ sprintf(pwd_type, "udrp%d", setting->index); + else +- sprintf(pwd_type, "mnvp%d", setting->index); ++ sprintf(pwd_type, "adrp%d", setting->index); + } else { + sprintf(pwd_type, "%s", setting->pwd_type); + } +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-correct-system-password-inter.patch b/queue-6.1/platform-x86-think-lmi-correct-system-password-inter.patch new file mode 100644 index 00000000000..9d8c802b2c7 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-correct-system-password-inter.patch @@ -0,0 +1,59 @@ +From 4309f5df54e3af3fdf0937a2b67b8c2a6abdd55d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 16:05:47 -0400 +Subject: platform/x86: think-lmi: Correct System password interface +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit 97eef5983372d7aee6549d644d788fd0c10d2b6e ] + +The system password identification was incorrect. This means that if +the password was enabled it wouldn't be detected correctly; and setting +it would not work. +Also updated code to use TLMI_SMP_PWD instead of TLMI_SYS_PWD to be in +sync with Lenovo documentation. + +Fixes: 640a5fa50a42 ("platform/x86: think-lmi: Opcode support") +Signed-off-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230601200552.4396-3-mpearson-lenovo@squebb.ca +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 4e6040c0a2201..3a511c0f13e45 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -172,7 +172,7 @@ MODULE_PARM_DESC(debug_support, "Enable debug command support"); + #define TLMI_POP_PWD (1 << 0) + #define TLMI_PAP_PWD (1 << 1) + #define TLMI_HDD_PWD (1 << 2) +-#define TLMI_SYS_PWD (1 << 3) ++#define TLMI_SMP_PWD (1 << 6) /* System Management */ + #define TLMI_CERT (1 << 7) + + #define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj) +@@ -1522,11 +1522,11 @@ static int tlmi_analyze(void) + tlmi_priv.pwd_power->valid = true; + + if (tlmi_priv.opcode_support) { +- tlmi_priv.pwd_system = tlmi_create_auth("sys", "system"); ++ tlmi_priv.pwd_system = tlmi_create_auth("smp", "system"); + if (!tlmi_priv.pwd_system) + goto fail_clear_attr; + +- if (tlmi_priv.pwdcfg.core.password_state & TLMI_SYS_PWD) ++ if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD) + tlmi_priv.pwd_system->valid = true; + + tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd"); +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-mutex-protection-around-multi.patch b/queue-6.1/platform-x86-think-lmi-mutex-protection-around-multi.patch new file mode 100644 index 00000000000..8af9841f599 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-mutex-protection-around-multi.patch @@ -0,0 +1,86 @@ +From 7c4e5ffd0759e1b42ca8c4f63b5494b1505a3222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 16:05:45 -0400 +Subject: platform/x86: think-lmi: mutex protection around multiple WMI calls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit c41e0121a1221894a1a9c4666156db9e1def4d6c ] + +When an attribute is being changed if the Admin account is enabled, or if +a password is being updated then multiple WMI calls are needed. +Add mutex protection to ensure no race conditions are introduced. + +Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate authentication support") +Signed-off-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230601200552.4396-1-mpearson-lenovo@squebb.ca +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 336b9029d1515..4e6040c0a2201 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -195,6 +196,7 @@ static const char * const level_options[] = { + }; + static struct think_lmi tlmi_priv; + static struct class *fw_attr_class; ++static DEFINE_MUTEX(tlmi_mutex); + + /* ------ Utility functions ------------*/ + /* Strip out CR if one is present */ +@@ -437,6 +439,9 @@ static ssize_t new_password_store(struct kobject *kobj, + /* Strip out CR if one is present, setting password won't work if it is present */ + strip_cr(new_pwd); + ++ /* Use lock in case multiple WMI operations needed */ ++ mutex_lock(&tlmi_mutex); ++ + pwdlen = strlen(new_pwd); + /* pwdlen == 0 is allowed to clear the password */ + if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) { +@@ -493,6 +498,7 @@ static ssize_t new_password_store(struct kobject *kobj, + kfree(auth_str); + } + out: ++ mutex_unlock(&tlmi_mutex); + kfree(new_pwd); + return ret ?: count; + } +@@ -982,6 +988,9 @@ static ssize_t current_value_store(struct kobject *kobj, + /* Strip out CR if one is present */ + strip_cr(new_setting); + ++ /* Use lock in case multiple WMI operations needed */ ++ mutex_lock(&tlmi_mutex); ++ + /* Check if certificate authentication is enabled and active */ + if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) { + if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) { +@@ -1040,6 +1049,7 @@ static ssize_t current_value_store(struct kobject *kobj, + kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); + } + out: ++ mutex_unlock(&tlmi_mutex); + kfree(auth_str); + kfree(set_str); + kfree(new_setting); +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-thinkpad_acpi-fix-lkp-tests-warnings-fo.patch b/queue-6.1/platform-x86-thinkpad_acpi-fix-lkp-tests-warnings-fo.patch new file mode 100644 index 00000000000..2aad76f138f --- /dev/null +++ b/queue-6.1/platform-x86-thinkpad_acpi-fix-lkp-tests-warnings-fo.patch @@ -0,0 +1,63 @@ +From d3c39f5be3d9ea820fed76cb862f4fcd26f3c448 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 11:18:04 -0400 +Subject: platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform + profiles + +From: Mark Pearson + +[ Upstream commit f999e23ce66c1555d7b653fba171a88ecee53704 ] + +Fix issues identified in dytc_profile_refresh identified by lkp-tests. +drivers/platform/x86/thinkpad_acpi.c:10538 + dytc_profile_refresh() error: uninitialized symbol 'funcmode'. +drivers/platform/x86/thinkpad_acpi.c:10531 + dytc_profile_refresh() error: uninitialized symbol 'output'. +drivers/platform/x86/thinkpad_acpi.c:10537 + dytc_profile_refresh() error: uninitialized symbol 'output'. + +These issues should not lead to real problems in the field as the refresh +function should only be called if MMC or PSC mode enabled. But good to fix. + +Thanks to Dan Carpenter and the lkp-tests project for flagging these. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202306011202.1hbgLRD4-lkp@intel.com/ +Fixes: 1bc5d819f0b9 ("platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230606151804.8819-1-mpearson-lenovo@squebb.ca +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 5b2c8dd2861b7..e7ece2738de94 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -10528,8 +10528,8 @@ static int dytc_profile_set(struct platform_profile_handler *pprof, + static void dytc_profile_refresh(void) + { + enum platform_profile_option profile; +- int output, err = 0; +- int perfmode, funcmode; ++ int output = 0, err = 0; ++ int perfmode, funcmode = 0; + + mutex_lock(&dytc_mutex); + if (dytc_capabilities & BIT(DYTC_FC_MMC)) { +@@ -10542,6 +10542,8 @@ static void dytc_profile_refresh(void) + err = dytc_command(DYTC_CMD_GET, &output); + /* Check if we are PSC mode, or have AMT enabled */ + funcmode = (output >> DYTC_GET_FUNCTION_BIT) & 0xF; ++ } else { /* Unknown profile mode */ ++ err = -ENODEV; + } + mutex_unlock(&dytc_mutex); + if (err) +-- +2.39.2 + diff --git a/queue-6.1/pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch b/queue-6.1/pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch new file mode 100644 index 00000000000..c561c53dbca --- /dev/null +++ b/queue-6.1/pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch @@ -0,0 +1,48 @@ +From 6b35663bca50f7cf75527bce3c2b98a4ce0ba1ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 06:07:43 -0700 +Subject: PM: domains: fix integer overflow issues in genpd_parse_state() + +From: Nikita Zhandarovich + +[ Upstream commit e5d1c8722083f0332dcd3c85fa1273d85fb6bed8 ] + +Currently, while calculating residency and latency values, right +operands may overflow if resulting values are big enough. + +To prevent this, albeit unlikely case, play it safe and convert +right operands to left ones' type s64. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT") +Signed-off-by: Nikita Zhandarovich +Acked-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index b411201f75bfb..b33fc322e0928 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2923,10 +2923,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, + + err = of_property_read_u32(state_node, "min-residency-us", &residency); + if (!err) +- genpd_state->residency_ns = 1000 * residency; ++ genpd_state->residency_ns = 1000LL * residency; + +- genpd_state->power_on_latency_ns = 1000 * exit_latency; +- genpd_state->power_off_latency_ns = 1000 * entry_latency; ++ genpd_state->power_on_latency_ns = 1000LL * exit_latency; ++ genpd_state->power_off_latency_ns = 1000LL * entry_latency; + genpd_state->fwnode = &state_node->fwnode; + + return 0; +-- +2.39.2 + diff --git a/queue-6.1/pm-domains-move-the-verification-of-in-params-from-g.patch b/queue-6.1/pm-domains-move-the-verification-of-in-params-from-g.patch new file mode 100644 index 00000000000..82705ccb5af --- /dev/null +++ b/queue-6.1/pm-domains-move-the-verification-of-in-params-from-g.patch @@ -0,0 +1,65 @@ +From df0457f3c7f97694a995e734d682785b6b8d3df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 11:55:36 +0200 +Subject: PM: domains: Move the verification of in-params from + genpd_add_device() + +From: Ulf Hansson + +[ Upstream commit 4384a70c8813e8573d1841fd94eee873f80a7e1a ] + +Commit f38d1a6d0025 ("PM: domains: Allocate governor data dynamically +based on a genpd governor") started to use the in-parameters in +genpd_add_device(), without first doing a verification of them. + +This isn't really a big problem, as most callers do a verification already. + +Therefore, let's drop the verification from genpd_add_device() and make +sure all the callers take care of it instead. + +Reported-by: Dan Carpenter +Fixes: f38d1a6d0025 ("PM: domains: Allocate governor data dynamically based on a genpd governor") +Signed-off-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index b33fc322e0928..56ceba4698024 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -1624,9 +1624,6 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev, + + dev_dbg(dev, "%s()\n", __func__); + +- if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(dev)) +- return -EINVAL; +- + gpd_data = genpd_alloc_dev_data(dev, gd); + if (IS_ERR(gpd_data)) + return PTR_ERR(gpd_data); +@@ -1668,6 +1665,9 @@ int pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev) + { + int ret; + ++ if (!genpd || !dev) ++ return -EINVAL; ++ + mutex_lock(&gpd_list_lock); + ret = genpd_add_device(genpd, dev, dev); + mutex_unlock(&gpd_list_lock); +@@ -2514,6 +2514,9 @@ int of_genpd_add_device(struct of_phandle_args *genpdspec, struct device *dev) + struct generic_pm_domain *genpd; + int ret; + ++ if (!dev) ++ return -EINVAL; ++ + mutex_lock(&gpd_list_lock); + + genpd = genpd_get_from_provider(genpdspec); +-- +2.39.2 + diff --git a/queue-6.1/posix-timers-prevent-rt-livelock-in-itimer_delete.patch b/queue-6.1/posix-timers-prevent-rt-livelock-in-itimer_delete.patch new file mode 100644 index 00000000000..cc68294e9a8 --- /dev/null +++ b/queue-6.1/posix-timers-prevent-rt-livelock-in-itimer_delete.patch @@ -0,0 +1,110 @@ +From 41e228a03f6ba30cc96842e308f3f33441d5fd0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 22:16:34 +0200 +Subject: posix-timers: Prevent RT livelock in itimer_delete() + +From: Thomas Gleixner + +[ Upstream commit 9d9e522010eb5685d8b53e8a24320653d9d4cbbf ] + +itimer_delete() has a retry loop when the timer is concurrently expired. On +non-RT kernels this just spin-waits until the timer callback has completed, +except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK +enabled. + +In that case and on RT kernels the existing task could live lock when +preempting the task which does the timer delivery. + +Replace spin_unlock() with an invocation of timer_wait_running() to handle +it the same way as the other retry loops in the posix timer code. + +Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT") +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Link: https://lore.kernel.org/r/87v8g7c50d.ffs@tglx +Signed-off-by: Sasha Levin +--- + kernel/time/posix-timers.c | 43 +++++++++++++++++++++++++++++++------- + 1 file changed, 35 insertions(+), 8 deletions(-) + +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index 808a247205a9a..ed3c4a9543982 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -1037,27 +1037,52 @@ SYSCALL_DEFINE1(timer_delete, timer_t, timer_id) + } + + /* +- * return timer owned by the process, used by exit_itimers ++ * Delete a timer if it is armed, remove it from the hash and schedule it ++ * for RCU freeing. + */ + static void itimer_delete(struct k_itimer *timer) + { +-retry_delete: +- spin_lock_irq(&timer->it_lock); ++ unsigned long flags; ++ ++ /* ++ * irqsave is required to make timer_wait_running() work. ++ */ ++ spin_lock_irqsave(&timer->it_lock, flags); + ++retry_delete: ++ /* ++ * Even if the timer is not longer accessible from other tasks ++ * it still might be armed and queued in the underlying timer ++ * mechanism. Worse, that timer mechanism might run the expiry ++ * function concurrently. ++ */ + if (timer_delete_hook(timer) == TIMER_RETRY) { +- spin_unlock_irq(&timer->it_lock); ++ /* ++ * Timer is expired concurrently, prevent livelocks ++ * and pointless spinning on RT. ++ * ++ * timer_wait_running() drops timer::it_lock, which opens ++ * the possibility for another task to delete the timer. ++ * ++ * That's not possible here because this is invoked from ++ * do_exit() only for the last thread of the thread group. ++ * So no other task can access and delete that timer. ++ */ ++ if (WARN_ON_ONCE(timer_wait_running(timer, &flags) != timer)) ++ return; ++ + goto retry_delete; + } + list_del(&timer->list); + +- spin_unlock_irq(&timer->it_lock); ++ spin_unlock_irqrestore(&timer->it_lock, flags); + release_posix_timer(timer, IT_ID_SET); + } + + /* +- * This is called by do_exit or de_thread, only when nobody else can +- * modify the signal->posix_timers list. Yet we need sighand->siglock +- * to prevent the race with /proc/pid/timers. ++ * Invoked from do_exit() when the last thread of a thread group exits. ++ * At that point no other task can access the timers of the dying ++ * task anymore. + */ + void exit_itimers(struct task_struct *tsk) + { +@@ -1067,10 +1092,12 @@ void exit_itimers(struct task_struct *tsk) + if (list_empty(&tsk->signal->posix_timers)) + return; + ++ /* Protect against concurrent read via /proc/$PID/timers */ + spin_lock_irq(&tsk->sighand->siglock); + list_replace_init(&tsk->signal->posix_timers, &timers); + spin_unlock_irq(&tsk->sighand->siglock); + ++ /* The timers are not longer accessible via tsk::signal */ + while (!list_empty(&timers)) { + tmr = list_first_entry(&timers, struct k_itimer, list); + itimer_delete(tmr); +-- +2.39.2 + diff --git a/queue-6.1/powercap-rapl-fix-config_iosf_mbi-dependency.patch b/queue-6.1/powercap-rapl-fix-config_iosf_mbi-dependency.patch new file mode 100644 index 00000000000..7f37f07f105 --- /dev/null +++ b/queue-6.1/powercap-rapl-fix-config_iosf_mbi-dependency.patch @@ -0,0 +1,73 @@ +From 1b2dd04440d1d4f553bacaf5b7cc796f78faec19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 22:00:00 +0800 +Subject: powercap: RAPL: Fix CONFIG_IOSF_MBI dependency + +From: Zhang Rui + +[ Upstream commit 4658fe81b3f8afe8adf37734ec5fe595d90415c6 ] + +After commit 3382388d7148 ("intel_rapl: abstract RAPL common code"), +accessing to IOSF_MBI interface is done in the RAPL common code. + +Thus it is the CONFIG_INTEL_RAPL_CORE that has dependency of +CONFIG_IOSF_MBI, while CONFIG_INTEL_RAPL_MSR does not. + +This problem was not exposed previously because all the previous RAPL +common code users, aka, the RAPL MSR and MMIO I/F drivers, have +CONFIG_IOSF_MBI selected. + +Fix the CONFIG_IOSF_MBI dependency in RAPL code. This also fixes a build +time failure when the RAPL TPMI I/F driver is introduced without +selecting CONFIG_IOSF_MBI. + +x86_64-linux-ld: vmlinux.o: in function `set_floor_freq_atom': +intel_rapl_common.c:(.text+0x2dac9b8): undefined reference to `iosf_mbi_write' +x86_64-linux-ld: intel_rapl_common.c:(.text+0x2daca66): undefined reference to `iosf_mbi_read' + +Reference to iosf_mbi.h is also removed from the RAPL MSR I/F driver. + +Fixes: 3382388d7148 ("intel_rapl: abstract RAPL common code") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/all/20230601213246.3271412-1-arnd@kernel.org +Signed-off-by: Zhang Rui +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/Kconfig | 4 +++- + drivers/powercap/intel_rapl_msr.c | 1 - + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/powercap/Kconfig b/drivers/powercap/Kconfig +index 515e3ceb3393a..863e240b37e01 100644 +--- a/drivers/powercap/Kconfig ++++ b/drivers/powercap/Kconfig +@@ -18,10 +18,12 @@ if POWERCAP + # Client driver configurations go here. + config INTEL_RAPL_CORE + tristate ++ depends on PCI ++ select IOSF_MBI + + config INTEL_RAPL + tristate "Intel RAPL Support via MSR Interface" +- depends on X86 && IOSF_MBI ++ depends on X86 && PCI + select INTEL_RAPL_CORE + help + This enables support for the Intel Running Average Power Limit (RAPL) +diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c +index bc6adda588835..65adb4cbaaf8e 100644 +--- a/drivers/powercap/intel_rapl_msr.c ++++ b/drivers/powercap/intel_rapl_msr.c +@@ -22,7 +22,6 @@ + #include + #include + +-#include + #include + #include + +-- +2.39.2 + diff --git a/queue-6.1/powerpc-64s-fix-vas-mm-use-after-free.patch b/queue-6.1/powerpc-64s-fix-vas-mm-use-after-free.patch new file mode 100644 index 00000000000..7097ded05f8 --- /dev/null +++ b/queue-6.1/powerpc-64s-fix-vas-mm-use-after-free.patch @@ -0,0 +1,55 @@ +From 0d429e143982340d48aed2902d74462ea072e730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 20:10:24 +1000 +Subject: powerpc/64s: Fix VAS mm use after free + +From: Nicholas Piggin + +[ Upstream commit b4bda59b47879cce38a6ec5a01cd3cac702b5331 ] + +The refcount on mm is dropped before the coprocessor is detached. + +Reported-by: Sachin Sant +Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct") +Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows") +Signed-off-by: Nicholas Piggin +Tested-by: Sachin Sant +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230607101024.14559-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/vas-window.c | 2 +- + arch/powerpc/platforms/pseries/vas.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c +index 0072682531d80..b664838008c12 100644 +--- a/arch/powerpc/platforms/powernv/vas-window.c ++++ b/arch/powerpc/platforms/powernv/vas-window.c +@@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin) + /* if send window, drop reference to matching receive window */ + if (window->tx_win) { + if (window->user_win) { +- put_vas_user_win_ref(&vwin->task_ref); + mm_context_remove_vas_window(vwin->task_ref.mm); ++ put_vas_user_win_ref(&vwin->task_ref); + } + put_rx_win(window->rxwin); + } +diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c +index 94c023bb13e05..880b962afc057 100644 +--- a/arch/powerpc/platforms/pseries/vas.c ++++ b/arch/powerpc/platforms/pseries/vas.c +@@ -507,8 +507,8 @@ static int vas_deallocate_window(struct vas_window *vwin) + vascaps[win->win_type].nr_open_windows--; + mutex_unlock(&vas_pseries_mutex); + +- put_vas_user_win_ref(&vwin->task_ref); + mm_context_remove_vas_window(vwin->task_ref.mm); ++ put_vas_user_win_ref(&vwin->task_ref); + + kfree(win); + return 0; +-- +2.39.2 + diff --git a/queue-6.1/powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch b/queue-6.1/powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch new file mode 100644 index 00000000000..270140b7e7c --- /dev/null +++ b/queue-6.1/powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch @@ -0,0 +1,158 @@ +From 0a4775b74ddb5ac35de9940d12e6b6c21038027d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 16:38:13 +0530 +Subject: powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo + +From: Aneesh Kumar K.V + +[ Upstream commit 0da90af431abc3f497a38ec9ef6e43b0d0dabe80 ] + +On memory unplug reduce DirectMap page count correctly. +root@ubuntu-guest:# grep Direct /proc/meminfo +DirectMap4k: 0 kB +DirectMap64k: 0 kB +DirectMap2M: 115343360 kB +DirectMap1G: 0 kB + +Before fix: +root@ubuntu-guest:# ndctl disable-namespace all +disabled 1 namespace +root@ubuntu-guest:# grep Direct /proc/meminfo +DirectMap4k: 0 kB +DirectMap64k: 0 kB +DirectMap2M: 115343360 kB +DirectMap1G: 0 kB + +After fix: +root@ubuntu-guest:# ndctl disable-namespace all +disabled 1 namespace +root@ubuntu-guest:# grep Direct /proc/meminfo +DirectMap4k: 0 kB +DirectMap64k: 0 kB +DirectMap2M: 104857600 kB +DirectMap1G: 0 kB + +Fixes: a2dc009afa9a ("powerpc/mm/book3s/radix: Add mapping statistics") +Signed-off-by: Aneesh Kumar K.V +Tested-by: Sachin Sant > +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230616110826.344417-4-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/radix_pgtable.c | 34 +++++++++++++++--------- + 1 file changed, 22 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index 2297aa764ecdb..e8db8c8efe359 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -745,9 +745,9 @@ static void free_pud_table(pud_t *pud_start, p4d_t *p4d) + } + + static void remove_pte_table(pte_t *pte_start, unsigned long addr, +- unsigned long end) ++ unsigned long end, bool direct) + { +- unsigned long next; ++ unsigned long next, pages = 0; + pte_t *pte; + + pte = pte_start + pte_index(addr); +@@ -769,13 +769,16 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr, + } + + pte_clear(&init_mm, addr, pte); ++ pages++; + } ++ if (direct) ++ update_page_count(mmu_virtual_psize, -pages); + } + + static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr, +- unsigned long end) ++ unsigned long end, bool direct) + { +- unsigned long next; ++ unsigned long next, pages = 0; + pte_t *pte_base; + pmd_t *pmd; + +@@ -793,19 +796,22 @@ static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr, + continue; + } + pte_clear(&init_mm, addr, (pte_t *)pmd); ++ pages++; + continue; + } + + pte_base = (pte_t *)pmd_page_vaddr(*pmd); +- remove_pte_table(pte_base, addr, next); ++ remove_pte_table(pte_base, addr, next, direct); + free_pte_table(pte_base, pmd); + } ++ if (direct) ++ update_page_count(MMU_PAGE_2M, -pages); + } + + static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr, +- unsigned long end) ++ unsigned long end, bool direct) + { +- unsigned long next; ++ unsigned long next, pages = 0; + pmd_t *pmd_base; + pud_t *pud; + +@@ -823,16 +829,20 @@ static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr, + continue; + } + pte_clear(&init_mm, addr, (pte_t *)pud); ++ pages++; + continue; + } + + pmd_base = pud_pgtable(*pud); +- remove_pmd_table(pmd_base, addr, next); ++ remove_pmd_table(pmd_base, addr, next, direct); + free_pmd_table(pmd_base, pud); + } ++ if (direct) ++ update_page_count(MMU_PAGE_1G, -pages); + } + +-static void __meminit remove_pagetable(unsigned long start, unsigned long end) ++static void __meminit remove_pagetable(unsigned long start, unsigned long end, ++ bool direct) + { + unsigned long addr, next; + pud_t *pud_base; +@@ -861,7 +871,7 @@ static void __meminit remove_pagetable(unsigned long start, unsigned long end) + } + + pud_base = p4d_pgtable(*p4d); +- remove_pud_table(pud_base, addr, next); ++ remove_pud_table(pud_base, addr, next, direct); + free_pud_table(pud_base, p4d); + } + +@@ -884,7 +894,7 @@ int __meminit radix__create_section_mapping(unsigned long start, + + int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end) + { +- remove_pagetable(start, end); ++ remove_pagetable(start, end, true); + return 0; + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +@@ -920,7 +930,7 @@ int __meminit radix__vmemmap_create_mapping(unsigned long start, + #ifdef CONFIG_MEMORY_HOTPLUG + void __meminit radix__vmemmap_remove_mapping(unsigned long start, unsigned long page_size) + { +- remove_pagetable(start, start + page_size); ++ remove_pagetable(start, start + page_size, false); + } + #endif + #endif +-- +2.39.2 + diff --git a/queue-6.1/powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch b/queue-6.1/powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch new file mode 100644 index 00000000000..fcd95d029b0 --- /dev/null +++ b/queue-6.1/powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch @@ -0,0 +1,58 @@ +From 427f0b213e1c7f336317a4cc44d8699d8f87bcc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 10:55:26 +0200 +Subject: powerpc/interrupt: Don't read MSR from + interrupt_exit_kernel_prepare() + +From: Christophe Leroy + +[ Upstream commit 0eb089a72fda3f7969e6277804bde75dc1474a14 ] + +A disassembly of interrupt_exit_kernel_prepare() shows a useless read +of MSR register. This is shown by r9 being re-used immediately without +doing anything with the value read. + + c000e0e0: 60 00 00 00 nop + c000e0e4: 7d 3a c2 a6 mfmd_ap r9 + c000e0e8: 7d 20 00 a6 mfmsr r9 + c000e0ec: 7c 51 13 a6 mtspr 81,r2 + c000e0f0: 81 3f 00 84 lwz r9,132(r31) + c000e0f4: 71 29 80 00 andi. r9,r9,32768 + +This is due to the use of local_irq_save(). The flags read by +local_irq_save() are never used, use local_irq_disable() instead. + +Fixes: 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt") +Signed-off-by: Christophe Leroy +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/df36c6205ab64326fb1b991993c82057e92ace2f.1685955214.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/interrupt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c +index 0ec1581619db5..cf770d86c03c6 100644 +--- a/arch/powerpc/kernel/interrupt.c ++++ b/arch/powerpc/kernel/interrupt.c +@@ -368,7 +368,6 @@ void preempt_schedule_irq(void); + + notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs) + { +- unsigned long flags; + unsigned long ret = 0; + unsigned long kuap; + bool stack_store = read_thread_flags() & _TIF_EMULATE_STACK_STORE; +@@ -392,7 +391,7 @@ notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs) + + kuap = kuap_get_and_assert_locked(); + +- local_irq_save(flags); ++ local_irq_disable(); + + if (!arch_irq_disabled_regs(regs)) { + /* Returning to a kernel context with local irqs enabled. */ +-- +2.39.2 + diff --git a/queue-6.1/powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch b/queue-6.1/powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch new file mode 100644 index 00000000000..33c7bba9409 --- /dev/null +++ b/queue-6.1/powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch @@ -0,0 +1,40 @@ +From d7e4aaa332c0af119aec12d0cd4d4115eeff6c85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 16:38:15 +0530 +Subject: powerpc/mm/dax: Fix the condition when checking if altmap vmemap can + cross-boundary + +From: Aneesh Kumar K.V + +[ Upstream commit c8eebc4a99f15280654f23e914e746c40a516e50 ] + +Without this fix, the last subsection vmemmap can end up in memory even if +the namespace is created with -M mem and has sufficient space in the altmap +area. + +Fixes: cf387d9644d8 ("libnvdimm/altmap: Track namespace boundaries in altmap") +Signed-off-by: Aneesh Kumar K.V +Tested-by: Sachin Sant > +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230616110826.344417-6-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/init_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c +index 05b0d584e50b8..fe1b83020e0df 100644 +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -189,7 +189,7 @@ static bool altmap_cross_boundary(struct vmem_altmap *altmap, unsigned long star + unsigned long nr_pfn = page_size / sizeof(struct page); + unsigned long start_pfn = page_to_pfn((struct page *)start); + +- if ((start_pfn + nr_pfn) > altmap->end_pfn) ++ if ((start_pfn + nr_pfn - 1) > altmap->end_pfn) + return true; + + if (start_pfn < altmap->base_pfn) +-- +2.39.2 + diff --git a/queue-6.1/powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch b/queue-6.1/powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch new file mode 100644 index 00000000000..89cba2b2bd2 --- /dev/null +++ b/queue-6.1/powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch @@ -0,0 +1,53 @@ +From 7071b655297d92c15da085286af7ede48d32bd01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 10:58:49 +0100 +Subject: powerpc/powernv/sriov: perform null check on iov before dereferencing + iov + +From: Colin Ian King + +[ Upstream commit f4f913c980bc6abe0ccfe88fe3909c125afe4a2d ] + +Currently pointer iov is being dereferenced before the null check of iov +which can lead to null pointer dereference errors. Fix this by moving the +iov null check before the dereferencing. + +Detected using cppcheck static analysis: +linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either +the condition '!iov' is redundant or there is possible null pointer +dereference: iov. [nullPointerRedundantCheck] + num_vfs = iov->num_vfs; + ^ + +Fixes: 052da31d45fc ("powerpc/powernv/sriov: De-indent setup and teardown") +Signed-off-by: Colin Ian King +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230608095849.1147969-1-colin.i.king@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/pci-sriov.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/pci-sriov.c b/arch/powerpc/platforms/powernv/pci-sriov.c +index 7195133b26bb9..59882da3e7425 100644 +--- a/arch/powerpc/platforms/powernv/pci-sriov.c ++++ b/arch/powerpc/platforms/powernv/pci-sriov.c +@@ -594,12 +594,12 @@ static void pnv_pci_sriov_disable(struct pci_dev *pdev) + struct pnv_iov_data *iov; + + iov = pnv_iov_get(pdev); +- num_vfs = iov->num_vfs; +- base_pe = iov->vf_pe_arr[0].pe_number; +- + if (WARN_ON(!iov)) + return; + ++ num_vfs = iov->num_vfs; ++ base_pe = iov->vf_pe_arr[0].pe_number; ++ + /* Release VF PEs */ + pnv_ioda_release_vf_PE(pdev); + +-- +2.39.2 + diff --git a/queue-6.1/powerpc-signal32-force-inlining-of-__unsafe_save_use.patch b/queue-6.1/powerpc-signal32-force-inlining-of-__unsafe_save_use.patch new file mode 100644 index 00000000000..838b36a6a6b --- /dev/null +++ b/queue-6.1/powerpc-signal32-force-inlining-of-__unsafe_save_use.patch @@ -0,0 +1,79 @@ +From cfe6707c3adb83df6000a4be9154386d92177094 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 10:58:35 +0200 +Subject: powerpc/signal32: Force inlining of __unsafe_save_user_regs() and + save_tm_user_regs_unsafe() + +From: Christophe Leroy + +[ Upstream commit a03b1a0b19398a47489fdcef02ec19c2ba05a15d ] + +Looking at generated code for handle_signal32() shows calls to a +function called __unsafe_save_user_regs.constprop.0 while user access +is open. + +And that __unsafe_save_user_regs.constprop.0 function has two nops at +the begining, allowing it to be traced, which is unexpected during +user access open window. + +The solution could be to mark __unsafe_save_user_regs() no trace, but +to be on the safe side the most efficient is to flag it __always_inline +as already done for function __unsafe_restore_general_regs(). The +function is relatively small and only called twice, so the size +increase will remain in the noise. + +Do the same with save_tm_user_regs_unsafe() as it may suffer the +same issue. + +Fixes: ef75e7318294 ("powerpc/signal32: Transform save_user_regs() and save_tm_user_regs() in 'unsafe' version") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/7e469c8f01860a69c1ada3ca6a5e2aa65f0f74b2.1685955220.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/signal_32.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c +index c114c7f25645c..7a718ed32b277 100644 +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -264,8 +264,9 @@ static void prepare_save_user_regs(int ctx_has_vsx_region) + #endif + } + +-static int __unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, +- struct mcontext __user *tm_frame, int ctx_has_vsx_region) ++static __always_inline int ++__unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, ++ struct mcontext __user *tm_frame, int ctx_has_vsx_region) + { + unsigned long msr = regs->msr; + +@@ -364,8 +365,9 @@ static void prepare_save_tm_user_regs(void) + current->thread.ckvrsave = mfspr(SPRN_VRSAVE); + } + +-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, +- struct mcontext __user *tm_frame, unsigned long msr) ++static __always_inline int ++save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, ++ struct mcontext __user *tm_frame, unsigned long msr) + { + /* Save both sets of general registers */ + unsafe_save_general_regs(¤t->thread.ckpt_regs, frame, failed); +@@ -444,8 +446,9 @@ static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user + #else + static void prepare_save_tm_user_regs(void) { } + +-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, +- struct mcontext __user *tm_frame, unsigned long msr) ++static __always_inline int ++save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, ++ struct mcontext __user *tm_frame, unsigned long msr) + { + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/powerpc-simplify-ppc_save_regs.patch b/queue-6.1/powerpc-simplify-ppc_save_regs.patch new file mode 100644 index 00000000000..eccacb29450 --- /dev/null +++ b/queue-6.1/powerpc-simplify-ppc_save_regs.patch @@ -0,0 +1,104 @@ +From 3eb67cb41563ec374a37c895e2704ab246712a7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Nov 2022 22:49:31 +1000 +Subject: powerpc: simplify ppc_save_regs + +From: Nicholas Piggin + +[ Upstream commit 37195b820d32c23bdefce3f460ed7de48a57e5e4 ] + +Adjust the pt_regs pointer so the interrupt frame offsets can be used +to save registers. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221127124942.1665522-7-npiggin@gmail.com +Stable-dep-of: b684c09f09e7 ("powerpc: update ppc_save_regs to save current r1 in pt_regs") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/ppc_save_regs.S | 57 ++++++++--------------------- + 1 file changed, 15 insertions(+), 42 deletions(-) + +diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S +index 2d4d21bb46a97..6e86f3bf46735 100644 +--- a/arch/powerpc/kernel/ppc_save_regs.S ++++ b/arch/powerpc/kernel/ppc_save_regs.S +@@ -21,60 +21,33 @@ + * different ABIs, though). + */ + _GLOBAL(ppc_save_regs) +- PPC_STL r0,0*SZL(r3) ++ /* This allows stack frame accessor macros and offsets to be used */ ++ subi r3,r3,STACK_FRAME_OVERHEAD ++ PPC_STL r0,GPR0(r3) + #ifdef CONFIG_PPC32 +- stmw r2, 2*SZL(r3) ++ stmw r2,GPR2(r3) + #else +- PPC_STL r2,2*SZL(r3) +- PPC_STL r3,3*SZL(r3) +- PPC_STL r4,4*SZL(r3) +- PPC_STL r5,5*SZL(r3) +- PPC_STL r6,6*SZL(r3) +- PPC_STL r7,7*SZL(r3) +- PPC_STL r8,8*SZL(r3) +- PPC_STL r9,9*SZL(r3) +- PPC_STL r10,10*SZL(r3) +- PPC_STL r11,11*SZL(r3) +- PPC_STL r12,12*SZL(r3) +- PPC_STL r13,13*SZL(r3) +- PPC_STL r14,14*SZL(r3) +- PPC_STL r15,15*SZL(r3) +- PPC_STL r16,16*SZL(r3) +- PPC_STL r17,17*SZL(r3) +- PPC_STL r18,18*SZL(r3) +- PPC_STL r19,19*SZL(r3) +- PPC_STL r20,20*SZL(r3) +- PPC_STL r21,21*SZL(r3) +- PPC_STL r22,22*SZL(r3) +- PPC_STL r23,23*SZL(r3) +- PPC_STL r24,24*SZL(r3) +- PPC_STL r25,25*SZL(r3) +- PPC_STL r26,26*SZL(r3) +- PPC_STL r27,27*SZL(r3) +- PPC_STL r28,28*SZL(r3) +- PPC_STL r29,29*SZL(r3) +- PPC_STL r30,30*SZL(r3) +- PPC_STL r31,31*SZL(r3) ++ SAVE_GPRS(2, 31, r3) + lbz r0,PACAIRQSOFTMASK(r13) +- PPC_STL r0,SOFTE-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,SOFTE(r3) + #endif + /* go up one stack frame for SP */ + PPC_LL r4,0(r1) +- PPC_STL r4,1*SZL(r3) ++ PPC_STL r4,GPR1(r3) + /* get caller's LR */ + PPC_LL r0,LRSAVE(r4) +- PPC_STL r0,_LINK-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_LINK(r3) + mflr r0 +- PPC_STL r0,_NIP-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_NIP(r3) + mfmsr r0 +- PPC_STL r0,_MSR-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_MSR(r3) + mfctr r0 +- PPC_STL r0,_CTR-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_CTR(r3) + mfxer r0 +- PPC_STL r0,_XER-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_XER(r3) + mfcr r0 +- PPC_STL r0,_CCR-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_CCR(r3) + li r0,0 +- PPC_STL r0,_TRAP-STACK_FRAME_OVERHEAD(r3) +- PPC_STL r0,ORIG_GPR3-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_TRAP(r3) ++ PPC_STL r0,ORIG_GPR3(r3) + blr +-- +2.39.2 + diff --git a/queue-6.1/powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch b/queue-6.1/powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch new file mode 100644 index 00000000000..7f94ddd506d --- /dev/null +++ b/queue-6.1/powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch @@ -0,0 +1,104 @@ +From fbedf5f57c6b22bf218d6ef0a5bcbc6bdd8c01b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 14:40:47 +0530 +Subject: powerpc: update ppc_save_regs to save current r1 in pt_regs + +From: Aditya Gupta + +[ Upstream commit b684c09f09e7a6af3794d4233ef785819e72db79 ] + +ppc_save_regs() skips one stack frame while saving the CPU register states. +Instead of saving current R1, it pulls the previous stack frame pointer. + +When vmcores caused by direct panic call (such as `echo c > +/proc/sysrq-trigger`), are debugged with gdb, gdb fails to show the +backtrace correctly. On further analysis, it was found that it was because +of mismatch between r1 and NIP. + +GDB uses NIP to get current function symbol and uses corresponding debug +info of that function to unwind previous frames, but due to the +mismatching r1 and NIP, the unwinding does not work, and it fails to +unwind to the 2nd frame and hence does not show the backtrace. + +GDB backtrace with vmcore of kernel without this patch: + +--------- +(gdb) bt + #0 0xc0000000002a53e8 in crash_setup_regs (oldregs=, + newregs=0xc000000004f8f8d8) at ./arch/powerpc/include/asm/kexec.h:69 + #1 __crash_kexec (regs=) at kernel/kexec_core.c:974 + #2 0x0000000000000063 in ?? () + #3 0xc000000003579320 in ?? () +--------- + +Further analysis revealed that the mismatch occurred because +"ppc_save_regs" was saving the previous stack's SP instead of the current +r1. This patch fixes this by storing current r1 in the saved pt_regs. + +GDB backtrace with vmcore of patched kernel: + +-------- +(gdb) bt + #0 0xc0000000002a53e8 in crash_setup_regs (oldregs=0x0, newregs=0xc00000000670b8d8) + at ./arch/powerpc/include/asm/kexec.h:69 + #1 __crash_kexec (regs=regs@entry=0x0) at kernel/kexec_core.c:974 + #2 0xc000000000168918 in panic (fmt=fmt@entry=0xc000000001654a60 "sysrq triggered crash\n") + at kernel/panic.c:358 + #3 0xc000000000b735f8 in sysrq_handle_crash (key=) at drivers/tty/sysrq.c:155 + #4 0xc000000000b742cc in __handle_sysrq (key=key@entry=99, check_mask=check_mask@entry=false) + at drivers/tty/sysrq.c:602 + #5 0xc000000000b7506c in write_sysrq_trigger (file=, buf=, + count=2, ppos=) at drivers/tty/sysrq.c:1163 + #6 0xc00000000069a7bc in pde_write (ppos=, count=, + buf=, file=, pde=0xc00000000362cb40) at fs/proc/inode.c:340 + #7 proc_reg_write (file=, buf=, count=, + ppos=) at fs/proc/inode.c:352 + #8 0xc0000000005b3bbc in vfs_write (file=file@entry=0xc000000006aa6b00, + buf=buf@entry=0x61f498b4f60 , + count=count@entry=2, pos=pos@entry=0xc00000000670bda0) at fs/read_write.c:582 + #9 0xc0000000005b4264 in ksys_write (fd=, + buf=0x61f498b4f60 , count=2) + at fs/read_write.c:637 + #10 0xc00000000002ea2c in system_call_exception (regs=0xc00000000670be80, r0=) + at arch/powerpc/kernel/syscall.c:171 + #11 0xc00000000000c270 in system_call_vectored_common () + at arch/powerpc/kernel/interrupt_64.S:192 +-------- + +Nick adds: + So this now saves regs as though it was an interrupt taken in the + caller, at the instruction after the call to ppc_save_regs, whereas + previously the NIP was there, but R1 came from the caller's caller and + that mismatch is what causes gdb's dwarf unwinder to go haywire. + +Signed-off-by: Aditya Gupta +Fixes: d16a58f8854b1 ("powerpc: Improve ppc_save_regs()") +Reivewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230615091047.90433-1-adityag@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/ppc_save_regs.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S +index 6e86f3bf46735..235ae24284519 100644 +--- a/arch/powerpc/kernel/ppc_save_regs.S ++++ b/arch/powerpc/kernel/ppc_save_regs.S +@@ -31,10 +31,10 @@ _GLOBAL(ppc_save_regs) + lbz r0,PACAIRQSOFTMASK(r13) + PPC_STL r0,SOFTE(r3) + #endif +- /* go up one stack frame for SP */ +- PPC_LL r4,0(r1) +- PPC_STL r4,GPR1(r3) ++ /* store current SP */ ++ PPC_STL r1,GPR1(r3) + /* get caller's LR */ ++ PPC_LL r4,0(r1) + PPC_LL r0,LRSAVE(r4) + PPC_STL r0,_LINK(r3) + mflr r0 +-- +2.39.2 + diff --git a/queue-6.1/pstore-ram-add-check-for-kstrdup.patch b/queue-6.1/pstore-ram-add-check-for-kstrdup.patch new file mode 100644 index 00000000000..7a4d9cc4168 --- /dev/null +++ b/queue-6.1/pstore-ram-add-check-for-kstrdup.patch @@ -0,0 +1,37 @@ +From fa91391cc82a746a7332ca8edc3dca8ccfdf189e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 17:37:33 +0800 +Subject: pstore/ram: Add check for kstrdup + +From: Jiasheng Jiang + +[ Upstream commit d97038d5ec2062733c1e016caf9baaf68cf64ea1 ] + +Add check for the return value of kstrdup() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: e163fdb3f7f8 ("pstore/ram: Regularize prz label allocation lifetime") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230614093733.36048-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 8bf09886e7e66..2384de1c2d187 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -591,6 +591,8 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, + raw_spin_lock_init(&prz->buffer_lock); + prz->flags = flags; + prz->label = kstrdup(label, GFP_KERNEL); ++ if (!prz->label) ++ goto err; + + ret = persistent_ram_buffer_map(start, size, prz, memtype); + if (ret) +-- +2.39.2 + diff --git a/queue-6.1/radeon-avoid-double-free-in-ci_dpm_init.patch b/queue-6.1/radeon-avoid-double-free-in-ci_dpm_init.patch new file mode 100644 index 00000000000..85e8643b3ba --- /dev/null +++ b/queue-6.1/radeon-avoid-double-free-in-ci_dpm_init.patch @@ -0,0 +1,110 @@ +From 1bad65ac821d2f7a63e5ce10199c1bd12b80ede1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 08:12:28 -0700 +Subject: radeon: avoid double free in ci_dpm_init() + +From: Nikita Zhandarovich + +[ Upstream commit 20c3dffdccbd494e0dd631d1660aeecbff6775f2 ] + +Several calls to ci_dpm_fini() will attempt to free resources that +either have been freed before or haven't been allocated yet. This +may lead to undefined or dangerous behaviour. + +For instance, if r600_parse_extended_power_table() fails, it might +call r600_free_extended_power_table() as will ci_dpm_fini() later +during error handling. + +Fix this by only freeing pointers to objects previously allocated. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)") +Co-developed-by: Natalia Petrova +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/ci_dpm.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 8ef25ab305ae7..b8f4dac68d850 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -5517,6 +5517,7 @@ static int ci_parse_power_table(struct radeon_device *rdev) + u8 frev, crev; + u8 *power_state_offset; + struct ci_ps *ps; ++ int ret; + + if (!atom_parse_data_header(mode_info->atom_context, index, NULL, + &frev, &crev, &data_offset)) +@@ -5546,11 +5547,15 @@ static int ci_parse_power_table(struct radeon_device *rdev) + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; +- if (!rdev->pm.power_state[i].clock_info) +- return -EINVAL; ++ if (!rdev->pm.power_state[i].clock_info) { ++ ret = -EINVAL; ++ goto err_free_ps; ++ } + ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); +- if (ps == NULL) +- return -ENOMEM; ++ if (ps == NULL) { ++ ret = -ENOMEM; ++ goto err_free_ps; ++ } + rdev->pm.dpm.ps[i].ps_priv = ps; + ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], + non_clock_info, +@@ -5590,6 +5595,12 @@ static int ci_parse_power_table(struct radeon_device *rdev) + } + + return 0; ++ ++err_free_ps: ++ for (i = 0; i < rdev->pm.dpm.num_ps; i++) ++ kfree(rdev->pm.dpm.ps[i].ps_priv); ++ kfree(rdev->pm.dpm.ps); ++ return ret; + } + + static int ci_get_vbios_boot_values(struct radeon_device *rdev, +@@ -5678,25 +5689,26 @@ int ci_dpm_init(struct radeon_device *rdev) + + ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); + return ret; + } + + ret = r600_get_platform_caps(rdev); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); + return ret; + } + + ret = r600_parse_extended_power_table(rdev); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); + return ret; + } + + ret = ci_parse_power_table(rdev); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); ++ r600_free_extended_power_table(rdev); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.1/rcu-make-rcu_cpu_starting-rely-on-interrupts-being-d.patch b/queue-6.1/rcu-make-rcu_cpu_starting-rely-on-interrupts-being-d.patch new file mode 100644 index 00000000000..720c29740ad --- /dev/null +++ b/queue-6.1/rcu-make-rcu_cpu_starting-rely-on-interrupts-being-d.patch @@ -0,0 +1,85 @@ +From 6d2bff9b68b95c578e2e55989890ce7d6e93494f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 10:50:47 -0700 +Subject: rcu: Make rcu_cpu_starting() rely on interrupts being disabled + +From: Paul E. McKenney + +[ Upstream commit 15d44dfa40305da1648de4bf001e91cc63148725 ] + +Currently, rcu_cpu_starting() is written so that it might be invoked +with interrupts enabled. However, it is always called when interrupts +are disabled, either by rcu_init(), notify_cpu_starting(), or from a +call point prior to the call to notify_cpu_starting(). + +But why bother requiring that interrupts be disabled? The purpose is +to allow the rcu_data structure's ->beenonline flag to be set after all +early processing has completed for the incoming CPU, thus allowing this +flag to be used to determine when workqueues have been set up for the +incoming CPU, while still allowing this flag to be used as a diagnostic +within rcu_core(). + +This commit therefore makes rcu_cpu_starting() rely on interrupts being +disabled. + +Signed-off-by: Paul E. McKenney +Stable-dep-of: 401b0de3ae4f ("rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs") +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index d03122f90cc48..5b5ed772f620a 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -4223,15 +4223,16 @@ int rcutree_offline_cpu(unsigned int cpu) + * Note that this function is special in that it is invoked directly + * from the incoming CPU rather than from the cpuhp_step mechanism. + * This is because this function must be invoked at a precise location. ++ * This incoming CPU must not have enabled interrupts yet. + */ + void rcu_cpu_starting(unsigned int cpu) + { +- unsigned long flags; + unsigned long mask; + struct rcu_data *rdp; + struct rcu_node *rnp; + bool newcpu; + ++ lockdep_assert_irqs_disabled(); + rdp = per_cpu_ptr(&rcu_data, cpu); + if (rdp->cpu_started) + return; +@@ -4239,7 +4240,6 @@ void rcu_cpu_starting(unsigned int cpu) + + rnp = rdp->mynode; + mask = rdp->grpmask; +- local_irq_save(flags); + arch_spin_lock(&rcu_state.ofl_lock); + rcu_dynticks_eqs_online(); + raw_spin_lock(&rcu_state.barrier_lock); +@@ -4258,17 +4258,16 @@ void rcu_cpu_starting(unsigned int cpu) + /* An incoming CPU should never be blocking a grace period. */ + if (WARN_ON_ONCE(rnp->qsmask & mask)) { /* RCU waiting on incoming CPU? */ + /* rcu_report_qs_rnp() *really* wants some flags to restore */ +- unsigned long flags2; ++ unsigned long flags; + +- local_irq_save(flags2); ++ local_irq_save(flags); + rcu_disable_urgency_upon_qs(rdp); + /* Report QS -after- changing ->qsmaskinitnext! */ +- rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags2); ++ rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags); + } else { + raw_spin_unlock_rcu_node(rnp); + } + arch_spin_unlock(&rcu_state.ofl_lock); +- local_irq_restore(flags); + smp_mb(); /* Ensure RCU read-side usage follows above initialization. */ + } + +-- +2.39.2 + diff --git a/queue-6.1/rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch b/queue-6.1/rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch new file mode 100644 index 00000000000..291b7377405 --- /dev/null +++ b/queue-6.1/rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch @@ -0,0 +1,245 @@ +From 86608f260167ef1c6c90539a84c1e32ba28e8a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 19:42:40 +0800 +Subject: rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() + +From: Qiuxu Zhuo + +[ Upstream commit bf5ddd736509a7d9077c0b6793e6f0852214dbea ] + +This code-movement-only commit moves the rcu_scale_cleanup() and +rcu_scale_shutdown() functions to follow kfree_scale_cleanup(). +This is code movement is in preparation for a bug-fix patch that invokes +kfree_scale_cleanup() from rcu_scale_cleanup(). + +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Paul E. McKenney +Reviewed-by: Joel Fernandes (Google) +Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale") +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 194 +++++++++++++++++++++--------------------- + 1 file changed, 97 insertions(+), 97 deletions(-) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index de4d4e3844bb1..63e4c2d629a96 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -521,89 +521,6 @@ rcu_scale_print_module_parms(struct rcu_scale_ops *cur_ops, const char *tag) + scale_type, tag, nrealreaders, nrealwriters, verbose, shutdown); + } + +-static void +-rcu_scale_cleanup(void) +-{ +- int i; +- int j; +- int ngps = 0; +- u64 *wdp; +- u64 *wdpp; +- +- /* +- * Would like warning at start, but everything is expedited +- * during the mid-boot phase, so have to wait till the end. +- */ +- if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) +- SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!"); +- if (rcu_gp_is_normal() && gp_exp) +- SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!"); +- if (gp_exp && gp_async) +- SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); +- +- if (torture_cleanup_begin()) +- return; +- if (!cur_ops) { +- torture_cleanup_end(); +- return; +- } +- +- if (reader_tasks) { +- for (i = 0; i < nrealreaders; i++) +- torture_stop_kthread(rcu_scale_reader, +- reader_tasks[i]); +- kfree(reader_tasks); +- } +- +- if (writer_tasks) { +- for (i = 0; i < nrealwriters; i++) { +- torture_stop_kthread(rcu_scale_writer, +- writer_tasks[i]); +- if (!writer_n_durations) +- continue; +- j = writer_n_durations[i]; +- pr_alert("%s%s writer %d gps: %d\n", +- scale_type, SCALE_FLAG, i, j); +- ngps += j; +- } +- pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n", +- scale_type, SCALE_FLAG, +- t_rcu_scale_writer_started, t_rcu_scale_writer_finished, +- t_rcu_scale_writer_finished - +- t_rcu_scale_writer_started, +- ngps, +- rcuscale_seq_diff(b_rcu_gp_test_finished, +- b_rcu_gp_test_started)); +- for (i = 0; i < nrealwriters; i++) { +- if (!writer_durations) +- break; +- if (!writer_n_durations) +- continue; +- wdpp = writer_durations[i]; +- if (!wdpp) +- continue; +- for (j = 0; j < writer_n_durations[i]; j++) { +- wdp = &wdpp[j]; +- pr_alert("%s%s %4d writer-duration: %5d %llu\n", +- scale_type, SCALE_FLAG, +- i, j, *wdp); +- if (j % 100 == 0) +- schedule_timeout_uninterruptible(1); +- } +- kfree(writer_durations[i]); +- } +- kfree(writer_tasks); +- kfree(writer_durations); +- kfree(writer_n_durations); +- } +- +- /* Do torture-type-specific cleanup operations. */ +- if (cur_ops->cleanup != NULL) +- cur_ops->cleanup(); +- +- torture_cleanup_end(); +-} +- + /* + * Return the number if non-negative. If -1, the number of CPUs. + * If less than -1, that much less than the number of CPUs, but +@@ -623,20 +540,6 @@ static int compute_real(int n) + return nr; + } + +-/* +- * RCU scalability shutdown kthread. Just waits to be awakened, then shuts +- * down system. +- */ +-static int +-rcu_scale_shutdown(void *arg) +-{ +- wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); +- smp_mb(); /* Wake before output. */ +- rcu_scale_cleanup(); +- kernel_power_off(); +- return -EINVAL; +-} +- + /* + * kfree_rcu() scalability tests: Start a kfree_rcu() loop on all CPUs for number + * of iterations and measure total time and number of GP for all iterations to complete. +@@ -811,6 +714,103 @@ kfree_scale_init(void) + return firsterr; + } + ++static void ++rcu_scale_cleanup(void) ++{ ++ int i; ++ int j; ++ int ngps = 0; ++ u64 *wdp; ++ u64 *wdpp; ++ ++ /* ++ * Would like warning at start, but everything is expedited ++ * during the mid-boot phase, so have to wait till the end. ++ */ ++ if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) ++ SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!"); ++ if (rcu_gp_is_normal() && gp_exp) ++ SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!"); ++ if (gp_exp && gp_async) ++ SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); ++ ++ if (torture_cleanup_begin()) ++ return; ++ if (!cur_ops) { ++ torture_cleanup_end(); ++ return; ++ } ++ ++ if (reader_tasks) { ++ for (i = 0; i < nrealreaders; i++) ++ torture_stop_kthread(rcu_scale_reader, ++ reader_tasks[i]); ++ kfree(reader_tasks); ++ } ++ ++ if (writer_tasks) { ++ for (i = 0; i < nrealwriters; i++) { ++ torture_stop_kthread(rcu_scale_writer, ++ writer_tasks[i]); ++ if (!writer_n_durations) ++ continue; ++ j = writer_n_durations[i]; ++ pr_alert("%s%s writer %d gps: %d\n", ++ scale_type, SCALE_FLAG, i, j); ++ ngps += j; ++ } ++ pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n", ++ scale_type, SCALE_FLAG, ++ t_rcu_scale_writer_started, t_rcu_scale_writer_finished, ++ t_rcu_scale_writer_finished - ++ t_rcu_scale_writer_started, ++ ngps, ++ rcuscale_seq_diff(b_rcu_gp_test_finished, ++ b_rcu_gp_test_started)); ++ for (i = 0; i < nrealwriters; i++) { ++ if (!writer_durations) ++ break; ++ if (!writer_n_durations) ++ continue; ++ wdpp = writer_durations[i]; ++ if (!wdpp) ++ continue; ++ for (j = 0; j < writer_n_durations[i]; j++) { ++ wdp = &wdpp[j]; ++ pr_alert("%s%s %4d writer-duration: %5d %llu\n", ++ scale_type, SCALE_FLAG, ++ i, j, *wdp); ++ if (j % 100 == 0) ++ schedule_timeout_uninterruptible(1); ++ } ++ kfree(writer_durations[i]); ++ } ++ kfree(writer_tasks); ++ kfree(writer_durations); ++ kfree(writer_n_durations); ++ } ++ ++ /* Do torture-type-specific cleanup operations. */ ++ if (cur_ops->cleanup != NULL) ++ cur_ops->cleanup(); ++ ++ torture_cleanup_end(); ++} ++ ++/* ++ * RCU scalability shutdown kthread. Just waits to be awakened, then shuts ++ * down system. ++ */ ++static int ++rcu_scale_shutdown(void *arg) ++{ ++ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); ++ smp_mb(); /* Wake before output. */ ++ rcu_scale_cleanup(); ++ kernel_power_off(); ++ return -EINVAL; ++} ++ + static int __init + rcu_scale_init(void) + { +-- +2.39.2 + diff --git a/queue-6.1/rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch b/queue-6.1/rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch new file mode 100644 index 00000000000..93d8b4ca64f --- /dev/null +++ b/queue-6.1/rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch @@ -0,0 +1,81 @@ +From 5bdf06cfc3c51c6e22a23d95bc66bd236d3d7d9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 19:42:41 +0800 +Subject: rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading + rcuscale + +From: Qiuxu Zhuo + +[ Upstream commit 23fc8df26dead16687ae6eb47b0561a4a832e2f6 ] + +Running the 'kfree_rcu_test' test case [1] results in a splat [2]. +The root cause is the kfree_scale_thread thread(s) continue running +after unloading the rcuscale module. This commit fixes that isue by +invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing +the rcuscale module. + +[1] modprobe rcuscale kfree_rcu_test=1 + // After some time + rmmod rcuscale + rmmod torture + +[2] BUG: unable to handle page fault for address: ffffffffc0601a87 + #PF: supervisor instruction fetch in kernel mode + #PF: error_code(0x0010) - not-present page + PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0 + Oops: 0010 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 + RIP: 0010:0xffffffffc0601a87 + Code: Unable to access opcode bytes at 0xffffffffc0601a5d. + RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297 + RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de + RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 + R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe + FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? kvfree_call_rcu+0xf0/0x3a0 + ? kthread+0xf3/0x120 + ? kthread_complete_and_exit+0x20/0x20 + ? ret_from_fork+0x1f/0x30 + + Modules linked in: rfkill sunrpc ... [last unloaded: torture] + CR2: ffffffffc0601a87 + ---[ end trace 0000000000000000 ]--- + +Fixes: e6e78b004fa7 ("rcuperf: Add kfree_rcu() performance Tests") +Reviewed-by: Davidlohr Bueso +Reviewed-by: Joel Fernandes (Google) +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index 63e4c2d629a96..7854dc3226e1b 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -734,6 +734,11 @@ rcu_scale_cleanup(void) + if (gp_exp && gp_async) + SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); + ++ if (kfree_rcu_test) { ++ kfree_scale_cleanup(); ++ return; ++ } ++ + if (torture_cleanup_begin()) + return; + if (!cur_ops) { +-- +2.39.2 + diff --git a/queue-6.1/rcu-tasks-stop-rcu_tasks_invoke_cbs-from-using-never.patch b/queue-6.1/rcu-tasks-stop-rcu_tasks_invoke_cbs-from-using-never.patch new file mode 100644 index 00000000000..c29e4f65d8e --- /dev/null +++ b/queue-6.1/rcu-tasks-stop-rcu_tasks_invoke_cbs-from-using-never.patch @@ -0,0 +1,125 @@ +From 46700745f5e101bf32a78c15fb6fd24f34f58de1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 11:11:29 -0700 +Subject: rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs + +From: Paul E. McKenney + +[ Upstream commit 401b0de3ae4fa49d1014c8941e26d9a25f37e7cf ] + +The rcu_tasks_invoke_cbs() function relies on queue_work_on() to silently +fall back to WORK_CPU_UNBOUND when the specified CPU is offline. However, +the queue_work_on() function's silent fallback mechanism relies on that +CPU having been online at some time in the past. When queue_work_on() +is passed a CPU that has never been online, workqueue lockups ensue, +which can be bad for your kernel's general health and well-being. + +This commit therefore checks whether a given CPU has ever been online, +and, if not substitutes WORK_CPU_UNBOUND in the subsequent call to +queue_work_on(). Why not simply omit the queue_work_on() call entirely? +Because this function is flooding callback-invocation notifications +to all CPUs, and must deal with possibilities that include a sparse +cpu_possible_mask. + +This commit also moves the setting of the rcu_data structure's +->beenonline field to rcu_cpu_starting(), which executes on the +incoming CPU before that CPU has ever enabled interrupts. This ensures +that the required workqueues are present. In addition, because the +incoming CPU has not yet enabled its interrupts, there cannot yet have +been any softirq handlers running on this CPU, which means that the +WARN_ON_ONCE(!rdp->beenonline) within the RCU_SOFTIRQ handler cannot +have triggered yet. + +Fixes: d363f833c6d88 ("rcu-tasks: Use workqueues for multiple rcu_tasks_invoke_cbs() invocations") +Reported-by: Tejun Heo +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcu.h | 6 ++++++ + kernel/rcu/tasks.h | 7 +++++-- + kernel/rcu/tree.c | 12 +++++++++++- + 3 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h +index be5979da07f59..48d8f754b730e 100644 +--- a/kernel/rcu/rcu.h ++++ b/kernel/rcu/rcu.h +@@ -583,4 +583,10 @@ void show_rcu_tasks_trace_gp_kthread(void); + static inline void show_rcu_tasks_trace_gp_kthread(void) {} + #endif + ++#ifdef CONFIG_TINY_RCU ++static inline bool rcu_cpu_beenfullyonline(int cpu) { return true; } ++#else ++bool rcu_cpu_beenfullyonline(int cpu); ++#endif ++ + #endif /* __LINUX_RCU_H */ +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index c8409601fec38..df968321feada 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -455,6 +455,7 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu + { + int cpu; + int cpunext; ++ int cpuwq; + unsigned long flags; + int len; + struct rcu_head *rhp; +@@ -465,11 +466,13 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu + cpunext = cpu * 2 + 1; + if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) { + rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext); +- queue_work_on(cpunext, system_wq, &rtpcp_next->rtp_work); ++ cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND; ++ queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work); + cpunext++; + if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) { + rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext); +- queue_work_on(cpunext, system_wq, &rtpcp_next->rtp_work); ++ cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND; ++ queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work); + } + } + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 5b5ed772f620a..917a1e43f7839 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -4138,7 +4138,6 @@ int rcutree_prepare_cpu(unsigned int cpu) + */ + rnp = rdp->mynode; + raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */ +- rdp->beenonline = true; /* We have now been online. */ + rdp->gp_seq = READ_ONCE(rnp->gp_seq); + rdp->gp_seq_needed = rdp->gp_seq; + rdp->cpu_no_qs.b.norm = true; +@@ -4165,6 +4164,16 @@ static void rcutree_affinity_setting(unsigned int cpu, int outgoing) + rcu_boost_kthread_setaffinity(rdp->mynode, outgoing); + } + ++/* ++ * Has the specified (known valid) CPU ever been fully online? ++ */ ++bool rcu_cpu_beenfullyonline(int cpu) ++{ ++ struct rcu_data *rdp = per_cpu_ptr(&rcu_data, cpu); ++ ++ return smp_load_acquire(&rdp->beenonline); ++} ++ + /* + * Near the end of the CPU-online process. Pretty much all services + * enabled, and the CPU is now very much alive. +@@ -4268,6 +4277,7 @@ void rcu_cpu_starting(unsigned int cpu) + raw_spin_unlock_rcu_node(rnp); + } + arch_spin_unlock(&rcu_state.ofl_lock); ++ smp_store_release(&rdp->beenonline, true); + smp_mb(); /* Ensure RCU read-side usage follows above initialization. */ + } + +-- +2.39.2 + diff --git a/queue-6.1/rcuscale-move-shutdown-from-wait_event-to-wait_event.patch b/queue-6.1/rcuscale-move-shutdown-from-wait_event-to-wait_event.patch new file mode 100644 index 00000000000..fa9cfbe8e3f --- /dev/null +++ b/queue-6.1/rcuscale-move-shutdown-from-wait_event-to-wait_event.patch @@ -0,0 +1,57 @@ +From 5551a94de29c0b8e519a25a1211df41e57e05291 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 12:08:54 -0800 +Subject: rcuscale: Move shutdown from wait_event() to wait_event_idle() + +From: Paul E. McKenney + +[ Upstream commit ef1ef3d47677dc191b88650a9f7f91413452cc1b ] + +The rcu_scale_shutdown() and kfree_scale_shutdown() kthreads/functions +use wait_event() to wait for the rcuscale test to complete. However, +each updater thread in such a test waits for at least 100 grace periods. +If each grace period takes more than 1.2 seconds, which is long, but +not insanely so, this can trigger the hung-task timeout. + +This commit therefore replaces those wait_event() calls with calls to +wait_event_idle(), which do not trigger the hung-task timeout. + +Reported-by: kernel test robot +Reported-by: Liam Howlett +Signed-off-by: Paul E. McKenney +Tested-by: Yujie Liu +Signed-off-by: Boqun Feng +Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale") +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index 3ef02d4a81085..de4d4e3844bb1 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -630,8 +630,7 @@ static int compute_real(int n) + static int + rcu_scale_shutdown(void *arg) + { +- wait_event(shutdown_wq, +- atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); ++ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); + smp_mb(); /* Wake before output. */ + rcu_scale_cleanup(); + kernel_power_off(); +@@ -757,8 +756,8 @@ kfree_scale_cleanup(void) + static int + kfree_scale_shutdown(void *arg) + { +- wait_event(shutdown_wq, +- atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads); ++ wait_event_idle(shutdown_wq, ++ atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads); + + smp_mb(); /* Wake before output. */ + +-- +2.39.2 + diff --git a/queue-6.1/rcutorture-correct-name-of-use_softirq-module-parame.patch b/queue-6.1/rcutorture-correct-name-of-use_softirq-module-parame.patch new file mode 100644 index 00000000000..afb284b3054 --- /dev/null +++ b/queue-6.1/rcutorture-correct-name-of-use_softirq-module-parame.patch @@ -0,0 +1,45 @@ +From 28033ad2d2a56c5faab15380c8d2cb30e8692777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 16:40:08 -0700 +Subject: rcutorture: Correct name of use_softirq module parameter + +From: Paul E. McKenney + +[ Upstream commit b409afe0268faeb77267f028ea85f2d93438fced ] + +The BUSTED-BOOST and TREE03 scenarios specify a mythical tree.use_softirq +module parameter, which means a failure to get full test coverage. This +commit therefore corrects the name to rcutree.use_softirq. + +Fixes: e2b949d54392 ("rcutorture: Make TREE03 use real-time tree.use_softirq setting") +Signed-off-by: Paul E. McKenney +Reviewed-by: Joel Fernandes (Google) +Signed-off-by: Sasha Levin +--- + .../testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot | 2 +- + tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot +index f57720c52c0f9..84f6bb98ce993 100644 +--- a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot ++++ b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot +@@ -5,4 +5,4 @@ rcutree.gp_init_delay=3 + rcutree.gp_cleanup_delay=3 + rcutree.kthread_prio=2 + threadirqs +-tree.use_softirq=0 ++rcutree.use_softirq=0 +diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot +index 64f864f1f361f..8e50bfd4b710d 100644 +--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot ++++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot +@@ -4,4 +4,4 @@ rcutree.gp_init_delay=3 + rcutree.gp_cleanup_delay=3 + rcutree.kthread_prio=2 + threadirqs +-tree.use_softirq=0 ++rcutree.use_softirq=0 +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch b/queue-6.1/rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch new file mode 100644 index 00000000000..6dbffdc1355 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch @@ -0,0 +1,99 @@ +From 7b217459ebd06a26f4e285468ae69d38b5e5c3c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 04:01:39 -0700 +Subject: RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context + +From: Kashyap Desai + +[ Upstream commit 3099bcdc19b701f732f638ee45679858c08559bb ] + +bnxt_qplib_service_creq can be called from interrupt or tasklet or +process context. So the function take irq variant of spin_lock. +But when wake_up is invoked with the lock held, it is putting the +calling context to sleep. + +[exception RIP: __wake_up_common+190] +RIP: ffffffffb7539d7e RSP: ffffa73300207ad8 RFLAGS: 00000083 +RAX: 0000000000000001 RBX: ffff91fa295f69b8 RCX: dead000000000200 +RDX: ffffa733344af940 RSI: ffffa73336527940 RDI: ffffa73336527940 +RBP: 000000000000001c R8: 0000000000000002 R9: 00000000000299c0 +R10: 0000017230de82c5 R11: 0000000000000002 R12: ffffa73300207b28 +R13: 0000000000000000 R14: ffffa733341bf928 R15: 0000000000000000 +ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Call the wakeup after releasing the lock. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1686308514-11996-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 3d76fa71641a4..75e0c42f6f424 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -299,7 +299,8 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw, + } + + static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, +- struct creq_qp_event *qp_event) ++ struct creq_qp_event *qp_event, ++ u32 *num_wait) + { + struct creq_qp_error_notification *err_event; + struct bnxt_qplib_hwq *hwq = &rcfw->cmdq.hwq; +@@ -308,6 +309,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, + u16 cbit, blocked = 0; + struct pci_dev *pdev; + unsigned long flags; ++ u32 wait_cmds = 0; + __le16 mcookie; + u16 cookie; + int rc = 0; +@@ -367,9 +369,10 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, + crsqe->req_size = 0; + + if (!blocked) +- wake_up(&rcfw->cmdq.waitq); ++ wait_cmds++; + spin_unlock_irqrestore(&hwq->lock, flags); + } ++ *num_wait += wait_cmds; + return rc; + } + +@@ -383,6 +386,7 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + struct creq_base *creqe; + u32 sw_cons, raw_cons; + unsigned long flags; ++ u32 num_wakeup = 0; + + /* Service the CREQ until budget is over */ + spin_lock_irqsave(&hwq->lock, flags); +@@ -401,7 +405,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + switch (type) { + case CREQ_BASE_TYPE_QP_EVENT: + bnxt_qplib_process_qp_event +- (rcfw, (struct creq_qp_event *)creqe); ++ (rcfw, (struct creq_qp_event *)creqe, ++ &num_wakeup); + creq->stats.creq_qp_event_processed++; + break; + case CREQ_BASE_TYPE_FUNC_EVENT: +@@ -429,6 +434,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + rcfw->res->cctx, true); + } + spin_unlock_irqrestore(&hwq->lock, flags); ++ if (num_wakeup) ++ wake_up_nr(&rcfw->cmdq.waitq, num_wakeup); + } + + static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance) +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch b/queue-6.1/rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch new file mode 100644 index 00000000000..bb4e6f46b05 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch @@ -0,0 +1,150 @@ +From d7ce4674a5618e5b176ba16bf6ec32834bc38c89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:11 -0700 +Subject: RDMA/bnxt_re: Disable/kill tasklet only if it is enabled + +From: Selvin Xavier + +[ Upstream commit ab112ee7899d6171da5acd77a7ed7ae103f488de ] + +When the ulp hook to start the IRQ fails because the rings are not +available, tasklets are not enabled. In this case when the driver is +unloaded, driver calls CREQ tasklet_kill. This causes an indefinite hang +as the tasklet is not enabled. + +Driver shouldn't call tasklet_kill if it is not enabled. So using the +creq->requested and nq->requested flags to identify if both tasklets/irqs +are registered. Checking this flag while scheduling the tasklet from +ISR. Also, added a cleanup for disabling tasklet, in case request_irq +fails during start_irq. + +Check for return value for bnxt_qplib_rcfw_start_irq and in case the +bnxt_qplib_rcfw_start_irq fails, return bnxt_re_start_irq without +attempting to start NQ IRQs. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-2-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 12 +++++++++--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 16 ++++++++++------ + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 14 +++++++++----- + 3 files changed, 28 insertions(+), 14 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 8c0c80a8d3384..1589b1105f2ec 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -333,15 +333,21 @@ static void bnxt_re_start_irq(void *handle, struct bnxt_msix_entry *ent) + for (indx = 0; indx < rdev->num_msix; indx++) + rdev->msix_entries[indx].vector = ent[indx].vector; + +- bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector, +- false); ++ rc = bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector, ++ false); ++ if (rc) { ++ ibdev_warn(&rdev->ibdev, "Failed to reinit CREQ\n"); ++ return; ++ } + for (indx = BNXT_RE_NQ_IDX ; indx < rdev->num_msix; indx++) { + nq = &rdev->nq[indx - 1]; + rc = bnxt_qplib_nq_start_irq(nq, indx - 1, + msix_ent[indx].vector, false); +- if (rc) ++ if (rc) { + ibdev_warn(&rdev->ibdev, "Failed to reinit NQ index %d\n", + indx - 1); ++ return; ++ } + } + } + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index ab2cc1c67f70b..a143bd3580a27 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -405,6 +405,9 @@ static irqreturn_t bnxt_qplib_nq_irq(int irq, void *dev_instance) + + void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill) + { ++ if (!nq->requested) ++ return; ++ + tasklet_disable(&nq->nq_tasklet); + /* Mask h/w interrupt */ + bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, false); +@@ -412,11 +415,10 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill) + synchronize_irq(nq->msix_vec); + if (kill) + tasklet_kill(&nq->nq_tasklet); +- if (nq->requested) { +- irq_set_affinity_hint(nq->msix_vec, NULL); +- free_irq(nq->msix_vec, nq); +- nq->requested = false; +- } ++ ++ irq_set_affinity_hint(nq->msix_vec, NULL); ++ free_irq(nq->msix_vec, nq); ++ nq->requested = false; + } + + void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq) +@@ -455,8 +457,10 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + + snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx); + rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq); +- if (rc) ++ if (rc) { ++ tasklet_disable(&nq->nq_tasklet); + return rc; ++ } + + cpumask_clear(&nq->mask); + cpumask_set_cpu(nq_indx, &nq->mask); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 061b2895dd9b5..e28f0eb5b55d4 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -635,6 +635,10 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill) + struct bnxt_qplib_creq_ctx *creq; + + creq = &rcfw->creq; ++ ++ if (!creq->requested) ++ return; ++ + tasklet_disable(&creq->creq_tasklet); + /* Mask h/w interrupts */ + bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, false); +@@ -643,10 +647,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill) + if (kill) + tasklet_kill(&creq->creq_tasklet); + +- if (creq->requested) { +- free_irq(creq->msix_vec, rcfw); +- creq->requested = false; +- } ++ free_irq(creq->msix_vec, rcfw); ++ creq->requested = false; + } + + void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw) +@@ -692,8 +694,10 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector, + tasklet_enable(&creq->creq_tasklet); + rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0, + "bnxt_qplib_creq", rcfw); +- if (rc) ++ if (rc) { ++ tasklet_disable(&creq->creq_tasklet); + return rc; ++ } + creq->requested = true; + + bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true); +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch b/queue-6.1/rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch new file mode 100644 index 00000000000..38fe20a2690 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch @@ -0,0 +1,44 @@ +From e4c6a98406721c71d6baea8b591c137e5bc2386d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:15 -0700 +Subject: RDMA/bnxt_re: Fix to remove an unnecessary log + +From: Kalesh AP + +[ Upstream commit 43774bc156614346fe5dacabc8e8c229167f2536 ] + +During destroy_qp, driver sets the qp handle in the existing CQEs +belonging to the QP being destroyed to NULL. As a result, a poll_cq after +destroy_qp can report unnecessary messages. Remove this noise from system +logs. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-6-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 640d932bec376..74d56900387a1 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -2734,11 +2734,8 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq, + + qp = (struct bnxt_qplib_qp *)((unsigned long) + le64_to_cpu(hwcqe->qp_handle)); +- if (!qp) { +- dev_err(&cq->hwq.pdev->dev, +- "FP: CQ Process terminal qp is NULL\n"); ++ if (!qp) + return -EINVAL; +- } + + /* Must block new posting of SQ and RQ */ + qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR; +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch b/queue-6.1/rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch new file mode 100644 index 00000000000..6e404551a39 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch @@ -0,0 +1,66 @@ +From 5b0df6195a029d4c1d396a4fc64ae118654da8d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:12 -0700 +Subject: RDMA/bnxt_re: Fix to remove unnecessary return labels + +From: Kalesh AP + +[ Upstream commit 9b3ee47796f529e5bc31a355d6cb756d68a7079a ] + +If there is no cleanup needed then just return directly. This cleans up +the code and improve readability. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-3-git-send-email-selvin.xavier@broadcom.com +Reviewed-by: Kashyap Desai +Reviewed-by: Saravanan Vajravel +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index a143bd3580a27..4abe1f59b3689 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1605,7 +1605,7 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, + il_src = (void *)wqe->sg_list[indx].addr; + t_len += len; + if (t_len > qp->max_inline_data) +- goto bad; ++ return -ENOMEM; + while (len) { + if (pull_dst) { + pull_dst = false; +@@ -1629,8 +1629,6 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, + } + + return t_len; +-bad: +- return -ENOMEM; + } + + static u32 bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq, +@@ -2060,7 +2058,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq) + hwq_attr.sginfo = &cq->sg_info; + rc = bnxt_qplib_alloc_init_hwq(&cq->hwq, &hwq_attr); + if (rc) +- goto exit; ++ return rc; + + RCFW_CMD_PREP(req, CREATE_CQ, cmd_flags); + +@@ -2101,7 +2099,6 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq) + + fail: + bnxt_qplib_free_hwq(res, &cq->hwq); +-exit: + return rc; + } + +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch b/queue-6.1/rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch new file mode 100644 index 00000000000..722f7a62278 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch @@ -0,0 +1,54 @@ +From 1fafe6e5c2eb5ebe453c9ac09ebf79d1b967e799 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:14 -0700 +Subject: RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid + +From: Kalesh AP + +[ Upstream commit b989f90cef0af48aa5679b6a75476371705ec53c ] + +The NULL check inside bnxt_re_update_gid() always return false. If +sgid_tbl->tbl is not allocated, then dev_init would have failed. + +Fixes: 5fac5b1b297f ("RDMA/bnxt_re: Add vlan tag for untagged RoCE traffic when PFC is configured") +Link: https://lore.kernel.org/r/1684478897-12247-5-git-send-email-selvin.xavier@broadcom.com +Reviewed-by: Saravanan Vajravel +Reviewed-by: Damodharam Ammepalli +Reviewed-by: Ajit Khaparde +Signed-off-by: Selvin Xavier +Signed-off-by: Kalesh AP +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 1589b1105f2ec..e58893387bb4d 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -1182,12 +1182,6 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev) + if (!ib_device_try_get(&rdev->ibdev)) + return 0; + +- if (!sgid_tbl) { +- ibdev_err(&rdev->ibdev, "QPLIB: SGID table not allocated"); +- rc = -EINVAL; +- goto out; +- } +- + for (index = 0; index < sgid_tbl->active; index++) { + gid_idx = sgid_tbl->hw_id[index]; + +@@ -1205,7 +1199,7 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev) + rc = bnxt_qplib_update_sgid(sgid_tbl, &gid, gid_idx, + rdev->qplib_res.netdev->dev_addr); + } +-out: ++ + ib_device_put(&rdev->ibdev); + return rc; + } +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-use-unique-names-while-registering-inte.patch b/queue-6.1/rdma-bnxt_re-use-unique-names-while-registering-inte.patch new file mode 100644 index 00000000000..b1a0aed3014 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-use-unique-names-while-registering-inte.patch @@ -0,0 +1,157 @@ +From 3fa3391139a60c9c84d1625817e24a3a55d23382 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:13 -0700 +Subject: RDMA/bnxt_re: Use unique names while registering interrupts + +From: Kalesh AP + +[ Upstream commit ff2e4bfd162cf66a112a81509e419805add44d64 ] + +bnxt_re currently uses the names "bnxt_qplib_creq" and "bnxt_qplib_nq-0" +while registering IRQs. There is no way to distinguish the IRQs of +different device ports when there are multiple IB devices registered. +This could make the scenarios worse where one want to pin IRQs of a device +port to certain CPUs. + +Fixed the code to use unique names which has PCI BDF information while +registering interrupts like: "bnxt_re-nq-0@pci:0000:65:00.0" and +"bnxt_re-creq@pci:0000:65:00.1". + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-4-git-send-email-selvin.xavier@broadcom.com +Reviewed-by: Bhargava Chenna Marreddy +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++++++++++-- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 15 +++++++++++++-- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 1 + + 4 files changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 4abe1f59b3689..640d932bec376 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -418,6 +418,8 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill) + + irq_set_affinity_hint(nq->msix_vec, NULL); + free_irq(nq->msix_vec, nq); ++ kfree(nq->name); ++ nq->name = NULL; + nq->requested = false; + } + +@@ -444,6 +446,7 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq) + int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + int msix_vector, bool need_init) + { ++ struct bnxt_qplib_res *res = nq->res; + int rc; + + if (nq->requested) +@@ -455,9 +458,14 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + else + tasklet_enable(&nq->nq_tasklet); + +- snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx); ++ nq->name = kasprintf(GFP_KERNEL, "bnxt_re-nq-%d@pci:%s", ++ nq_indx, pci_name(res->pdev)); ++ if (!nq->name) ++ return -ENOMEM; + rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq); + if (rc) { ++ kfree(nq->name); ++ nq->name = NULL; + tasklet_disable(&nq->nq_tasklet); + return rc; + } +@@ -471,7 +479,7 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + nq->msix_vec, nq_indx); + } + nq->requested = true; +- bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, true); ++ bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, res->cctx, true); + + return rc; + } +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 0375019525431..f859710f9a7f4 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -471,7 +471,7 @@ typedef int (*srqn_handler_t)(struct bnxt_qplib_nq *nq, + struct bnxt_qplib_nq { + struct pci_dev *pdev; + struct bnxt_qplib_res *res; +- char name[32]; ++ char *name; + struct bnxt_qplib_hwq hwq; + struct bnxt_qplib_nq_db nq_db; + u16 ring_id; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index e28f0eb5b55d4..9c63b8b62edfc 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -648,6 +648,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill) + tasklet_kill(&creq->creq_tasklet); + + free_irq(creq->msix_vec, rcfw); ++ kfree(creq->irq_name); ++ creq->irq_name = NULL; + creq->requested = false; + } + +@@ -680,9 +682,11 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector, + bool need_init) + { + struct bnxt_qplib_creq_ctx *creq; ++ struct bnxt_qplib_res *res; + int rc; + + creq = &rcfw->creq; ++ res = rcfw->res; + + if (creq->requested) + return -EFAULT; +@@ -692,15 +696,22 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector, + tasklet_setup(&creq->creq_tasklet, bnxt_qplib_service_creq); + else + tasklet_enable(&creq->creq_tasklet); ++ ++ creq->irq_name = kasprintf(GFP_KERNEL, "bnxt_re-creq@pci:%s", ++ pci_name(res->pdev)); ++ if (!creq->irq_name) ++ return -ENOMEM; + rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0, +- "bnxt_qplib_creq", rcfw); ++ creq->irq_name, rcfw); + if (rc) { ++ kfree(creq->irq_name); ++ creq->irq_name = NULL; + tasklet_disable(&creq->creq_tasklet); + return rc; + } + creq->requested = true; + +- bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true); ++ bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, res->cctx, true); + + return 0; + } +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 0a3d8e7da3d42..b887e7fbad9ef 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -174,6 +174,7 @@ struct bnxt_qplib_creq_ctx { + u16 ring_id; + int msix_vec; + bool requested; /*irq handler installed */ ++ char *irq_name; + }; + + /* RCFW Communication Channels */ +-- +2.39.2 + diff --git a/queue-6.1/rdma-bnxt_re-wraparound-mbox-producer-index.patch b/queue-6.1/rdma-bnxt_re-wraparound-mbox-producer-index.patch new file mode 100644 index 00000000000..7d226de7b8f --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-wraparound-mbox-producer-index.patch @@ -0,0 +1,55 @@ +From 4e3f248dbf01958c7c85d645c740e2abe2a3b84c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 04:01:38 -0700 +Subject: RDMA/bnxt_re: wraparound mbox producer index + +From: Kashyap Desai + +[ Upstream commit 0af91306e17ef3d18e5f100aa58aa787869118af ] + +Driver is not handling the wraparound of the mbox producer index correctly. +Currently the wraparound happens once u32 max is reached. + +Bit 31 of the producer index register is special and should be set +only once for the first command. Because the producer index overflow +setting bit31 after a long time, FW goes to initialization sequence +and this causes FW hang. + +Fix is to wraparound the mbox producer index once it reaches u16 max. + +Fixes: cee0c7bba486 ("RDMA/bnxt_re: Refactor command queue management code") +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1686308514-11996-2-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 9c63b8b62edfc..3d76fa71641a4 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -181,7 +181,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req, + } while (size > 0); + cmdq->seq_num++; + +- cmdq_prod = hwq->prod; ++ cmdq_prod = hwq->prod & 0xFFFF; + if (test_bit(FIRMWARE_FIRST_FLAG, &cmdq->flags)) { + /* The very first doorbell write + * is required to set this flag +@@ -598,7 +598,7 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res, + rcfw->cmdq_depth = BNXT_QPLIB_CMDQE_MAX_CNT_8192; + + sginfo.pgsize = bnxt_qplib_cmdqe_page_size(rcfw->cmdq_depth); +- hwq_attr.depth = rcfw->cmdq_depth; ++ hwq_attr.depth = rcfw->cmdq_depth & 0x7FFFFFFF; + hwq_attr.stride = BNXT_QPLIB_CMDQE_UNITS; + hwq_attr.type = HWQ_TYPE_CTX; + if (bnxt_qplib_alloc_init_hwq(&cmdq->hwq, &hwq_attr)) { +-- +2.39.2 + diff --git a/queue-6.1/rdma-hns-fix-hns_roce_table_get-return-value.patch b/queue-6.1/rdma-hns-fix-hns_roce_table_get-return-value.patch new file mode 100644 index 00000000000..48d87274897 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-hns_roce_table_get-return-value.patch @@ -0,0 +1,45 @@ +From c0c2a8a47e0b31f3097b7bc7da0d1fbbe406a6c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 20:16:40 +0800 +Subject: RDMA/hns: Fix hns_roce_table_get return value + +From: Chengchang Tang + +[ Upstream commit cf5b608fb0e369c473a8303cad6ddb386505e5b8 ] + +The return value of set_hem has been fixed to ENODEV, which will lead a +diagnostic information missing. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/20230523121641.3132102-3-huangjunxian6@hisilicon.com +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index aa8a08d1c0145..f30274986c0da 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -595,11 +595,12 @@ int hns_roce_table_get(struct hns_roce_dev *hr_dev, + } + + /* Set HEM base address(128K/page, pa) to Hardware */ +- if (hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT)) { ++ ret = hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT); ++ if (ret) { + hns_roce_free_hem(hr_dev, table->hem[i]); + table->hem[i] = NULL; +- ret = -ENODEV; +- dev_err(dev, "set HEM base address to HW failed.\n"); ++ dev_err(dev, "set HEM base address to HW failed, ret = %d.\n", ++ ret); + goto out; + } + +-- +2.39.2 + diff --git a/queue-6.1/rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch b/queue-6.1/rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch new file mode 100644 index 00000000000..246206b61e9 --- /dev/null +++ b/queue-6.1/rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch @@ -0,0 +1,64 @@ +From 80060e7d2e21930ebfe3e64f9d41474df7abb72d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 13:18:45 +0200 +Subject: RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes + +From: Arnd Bergmann + +[ Upstream commit b002760f877c0d91ecd3c78565b52f4bbac379dd ] + +Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") triggers a +warning for fortified memset(): + +In function 'fortify_memset_chk', + inlined from 'irdma_clr_wqes' at drivers/infiniband/hw/irdma/uk.c:103:4: +include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 493 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The problem here isthat the inner array only has four 8-byte elements, so +clearing 4096 bytes overflows that. As this structure is part of an outer +array, change the code to pass a pointer to the irdma_qp_quanta instead, +and change the size argument for readability, matching the comment above +it. + +Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries") +Link: https://lore.kernel.org/r/20230523111859.2197825-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Acked-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/uk.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c +index 16183e894da77..dd428d915c175 100644 +--- a/drivers/infiniband/hw/irdma/uk.c ++++ b/drivers/infiniband/hw/irdma/uk.c +@@ -93,16 +93,18 @@ static int irdma_nop_1(struct irdma_qp_uk *qp) + */ + void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx) + { +- __le64 *wqe; ++ struct irdma_qp_quanta *sq; + u32 wqe_idx; + + if (!(qp_wqe_idx & 0x7F)) { + wqe_idx = (qp_wqe_idx + 128) % qp->sq_ring.size; +- wqe = qp->sq_base[wqe_idx].elem; ++ sq = qp->sq_base + wqe_idx; + if (wqe_idx) +- memset(wqe, qp->swqe_polarity ? 0 : 0xFF, 0x1000); ++ memset(sq, qp->swqe_polarity ? 0 : 0xFF, ++ 128 * sizeof(*sq)); + else +- memset(wqe, qp->swqe_polarity ? 0xFF : 0, 0x1000); ++ memset(sq, qp->swqe_polarity ? 0xFF : 0, ++ 128 * sizeof(*sq)); + } + } + +-- +2.39.2 + diff --git a/queue-6.1/rdma-rxe-add-ibdev_dbg-macros-for-rxe.patch b/queue-6.1/rdma-rxe-add-ibdev_dbg-macros-for-rxe.patch new file mode 100644 index 00000000000..2c106e332a1 --- /dev/null +++ b/queue-6.1/rdma-rxe-add-ibdev_dbg-macros-for-rxe.patch @@ -0,0 +1,53 @@ +From 9d9ee0a4913369c785555fbc6b36fb194784f0b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 12:09:59 -0500 +Subject: RDMA/rxe: Add ibdev_dbg macros for rxe + +From: Bob Pearson + +[ Upstream commit 4554bac48a8c464ff00136a64efe8847e4da4ea8 ] + +Add macros borrowed from siw to call dynamic debug macro ibdev_dbg. + +Link: https://lore.kernel.org/r/20221103171013.20659-2-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 425e1c9018fd ("RDMA/rxe: Fix access checks in rxe_check_bind_mw") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.h | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h +index 30fbdf3bc76a3..ab334900fcc3d 100644 +--- a/drivers/infiniband/sw/rxe/rxe.h ++++ b/drivers/infiniband/sw/rxe/rxe.h +@@ -38,6 +38,25 @@ + + #define RXE_ROCE_V2_SPORT (0xc000) + ++#define rxe_dbg(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \ ++ "%s: " fmt, __func__, ##__VA_ARGS__) ++#define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \ ++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_pd(pd, fmt, ...) ibdev_dbg((pd)->ibpd.device, \ ++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_ah(ah, fmt, ...) ibdev_dbg((ah)->ibah.device, \ ++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_srq(srq, fmt, ...) ibdev_dbg((srq)->ibsrq.device, \ ++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_qp(qp, fmt, ...) ibdev_dbg((qp)->ibqp.device, \ ++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_cq(cq, fmt, ...) ibdev_dbg((cq)->ibcq.device, \ ++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_mr(mr, fmt, ...) ibdev_dbg((mr)->ibmr.device, \ ++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \ ++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) ++ + void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu); + + int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name); +-- +2.39.2 + diff --git a/queue-6.1/rdma-rxe-fix-access-checks-in-rxe_check_bind_mw.patch b/queue-6.1/rdma-rxe-fix-access-checks-in-rxe_check_bind_mw.patch new file mode 100644 index 00000000000..0b032e565bc --- /dev/null +++ b/queue-6.1/rdma-rxe-fix-access-checks-in-rxe_check_bind_mw.patch @@ -0,0 +1,102 @@ +From d3e0f537b749af37a3867562f8d2adb325c58440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 17:13:32 -0500 +Subject: RDMA/rxe: Fix access checks in rxe_check_bind_mw + +From: Bob Pearson + +[ Upstream commit 425e1c9018fdf25cb4531606cc92d9d01a55534f ] + +The subroutine rxe_check_bind_mw() in rxe_mw.c performs checks on the mw +access flags before they are set so they always succeed. This patch +instead checks the access flags passed in the send wqe. + +Fixes: 32a577b4c3a9 ("RDMA/rxe: Add support for bind MW work requests") +Link: https://lore.kernel.org/r/20230530221334.89432-4-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_mw.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c +index 70252991320a0..cebc9f0f428d8 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mw.c ++++ b/drivers/infiniband/sw/rxe/rxe_mw.c +@@ -48,7 +48,7 @@ int rxe_dealloc_mw(struct ib_mw *ibmw) + } + + static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, +- struct rxe_mw *mw, struct rxe_mr *mr) ++ struct rxe_mw *mw, struct rxe_mr *mr, int access) + { + if (mw->ibmw.type == IB_MW_TYPE_1) { + if (unlikely(mw->state != RXE_MW_STATE_VALID)) { +@@ -58,7 +58,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + } + + /* o10-36.2.2 */ +- if (unlikely((mw->access & IB_ZERO_BASED))) { ++ if (unlikely((access & IB_ZERO_BASED))) { + rxe_dbg_mw(mw, "attempt to bind a zero based type 1 MW\n"); + return -EINVAL; + } +@@ -104,7 +104,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + } + + /* C10-74 */ +- if (unlikely((mw->access & ++ if (unlikely((access & + (IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) && + !(mr->access & IB_ACCESS_LOCAL_WRITE))) { + rxe_dbg_mw(mw, +@@ -113,7 +113,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + } + + /* C10-75 */ +- if (mw->access & IB_ZERO_BASED) { ++ if (access & IB_ZERO_BASED) { + if (unlikely(wqe->wr.wr.mw.length > mr->ibmr.length)) { + rxe_dbg_mw(mw, + "attempt to bind a ZB MW outside of the MR\n"); +@@ -133,12 +133,12 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + } + + static void rxe_do_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, +- struct rxe_mw *mw, struct rxe_mr *mr) ++ struct rxe_mw *mw, struct rxe_mr *mr, int access) + { + u32 key = wqe->wr.wr.mw.rkey & 0xff; + + mw->rkey = (mw->rkey & ~0xff) | key; +- mw->access = wqe->wr.wr.mw.access; ++ mw->access = access; + mw->state = RXE_MW_STATE_VALID; + mw->addr = wqe->wr.wr.mw.addr; + mw->length = wqe->wr.wr.mw.length; +@@ -169,6 +169,7 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + struct rxe_dev *rxe = to_rdev(qp->ibqp.device); + u32 mw_rkey = wqe->wr.wr.mw.mw_rkey; + u32 mr_lkey = wqe->wr.wr.mw.mr_lkey; ++ int access = wqe->wr.wr.mw.access; + + mw = rxe_pool_get_index(&rxe->mw_pool, mw_rkey >> 8); + if (unlikely(!mw)) { +@@ -198,11 +199,11 @@ int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + + spin_lock_bh(&mw->lock); + +- ret = rxe_check_bind_mw(qp, wqe, mw, mr); ++ ret = rxe_check_bind_mw(qp, wqe, mw, mr, access); + if (ret) + goto err_unlock; + +- rxe_do_bind_mw(qp, wqe, mw, mr); ++ rxe_do_bind_mw(qp, wqe, mw, mr, access); + err_unlock: + spin_unlock_bh(&mw->lock); + err_drop_mr: +-- +2.39.2 + diff --git a/queue-6.1/rdma-rxe-replace-pr_xxx-by-rxe_dbg_xxx-in-rxe_mw.c.patch b/queue-6.1/rdma-rxe-replace-pr_xxx-by-rxe_dbg_xxx-in-rxe_mw.c.patch new file mode 100644 index 00000000000..77ecabf7036 --- /dev/null +++ b/queue-6.1/rdma-rxe-replace-pr_xxx-by-rxe_dbg_xxx-in-rxe_mw.c.patch @@ -0,0 +1,112 @@ +From 591de55311744cb9337653dc8053b89bf44386a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 12:10:03 -0500 +Subject: RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c + +From: Bob Pearson + +[ Upstream commit e8a87efdf87455454d0a14fd486c679769bfeee2 ] + +Replace calls to pr_xxx() int rxe_mw.c with rxe_dbg_xxx(). + +Link: https://lore.kernel.org/r/20221103171013.20659-6-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 425e1c9018fd ("RDMA/rxe: Fix access checks in rxe_check_bind_mw") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_mw.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c +index 902b7df7aaedb..70252991320a0 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mw.c ++++ b/drivers/infiniband/sw/rxe/rxe_mw.c +@@ -52,14 +52,14 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + { + if (mw->ibmw.type == IB_MW_TYPE_1) { + if (unlikely(mw->state != RXE_MW_STATE_VALID)) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind a type 1 MW not in the valid state\n"); + return -EINVAL; + } + + /* o10-36.2.2 */ + if (unlikely((mw->access & IB_ZERO_BASED))) { +- pr_err_once("attempt to bind a zero based type 1 MW\n"); ++ rxe_dbg_mw(mw, "attempt to bind a zero based type 1 MW\n"); + return -EINVAL; + } + } +@@ -67,21 +67,21 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + if (mw->ibmw.type == IB_MW_TYPE_2) { + /* o10-37.2.30 */ + if (unlikely(mw->state != RXE_MW_STATE_FREE)) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind a type 2 MW not in the free state\n"); + return -EINVAL; + } + + /* C10-72 */ + if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind type 2 MW with qp with different PD\n"); + return -EINVAL; + } + + /* o10-37.2.40 */ + if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to invalidate type 2 MW by binding with NULL or zero length MR\n"); + return -EINVAL; + } +@@ -92,13 +92,13 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + return 0; + + if (unlikely(mr->access & IB_ZERO_BASED)) { +- pr_err_once("attempt to bind MW to zero based MR\n"); ++ rxe_dbg_mw(mw, "attempt to bind MW to zero based MR\n"); + return -EINVAL; + } + + /* C10-73 */ + if (unlikely(!(mr->access & IB_ACCESS_MW_BIND))) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind an MW to an MR without bind access\n"); + return -EINVAL; + } +@@ -107,7 +107,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + if (unlikely((mw->access & + (IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) && + !(mr->access & IB_ACCESS_LOCAL_WRITE))) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind an Writable MW to an MR without local write access\n"); + return -EINVAL; + } +@@ -115,7 +115,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + /* C10-75 */ + if (mw->access & IB_ZERO_BASED) { + if (unlikely(wqe->wr.wr.mw.length > mr->ibmr.length)) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind a ZB MW outside of the MR\n"); + return -EINVAL; + } +@@ -123,7 +123,7 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + if (unlikely((wqe->wr.wr.mw.addr < mr->ibmr.iova) || + ((wqe->wr.wr.mw.addr + wqe->wr.wr.mw.length) > + (mr->ibmr.iova + mr->ibmr.length)))) { +- pr_err_once( ++ rxe_dbg_mw(mw, + "attempt to bind a VA MW outside of the MR\n"); + return -EINVAL; + } +-- +2.39.2 + diff --git a/queue-6.1/regulator-core-fix-more-error-checking-for-debugfs_c.patch b/queue-6.1/regulator-core-fix-more-error-checking-for-debugfs_c.patch new file mode 100644 index 00000000000..2e765ee5cf4 --- /dev/null +++ b/queue-6.1/regulator-core-fix-more-error-checking-for-debugfs_c.patch @@ -0,0 +1,40 @@ +From 01a4a458f54d6456678f45f6583e66acc21b0bea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 13:13:58 +0200 +Subject: regulator: core: Fix more error checking for debugfs_create_dir() + +From: Geert Uytterhoeven + +[ Upstream commit 2715bb11cfff964aa33946847f9527cfbd4874f5 ] + +In case of failure, debugfs_create_dir() does not return NULL, but an +error pointer. Most incorrect error checks were fixed, but the one in +create_regulator() was forgotten. + +Fix the remaining error check. + +Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/ee980a108b5854dd8ce3630f8f673e784e057d17.1685013051.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index e01cade8be0c7..eaf9d99f1f43c 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1918,7 +1918,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + + if (err != -EEXIST) + regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs); +- if (!regulator->debugfs) { ++ if (IS_ERR(regulator->debugfs)) { + rdev_dbg(rdev, "Failed to create debugfs directory\n"); + } else { + debugfs_create_u32("uA_load", 0444, regulator->debugfs, +-- +2.39.2 + diff --git a/queue-6.1/regulator-core-streamline-debugfs-operations.patch b/queue-6.1/regulator-core-streamline-debugfs-operations.patch new file mode 100644 index 00000000000..f7f767e3e48 --- /dev/null +++ b/queue-6.1/regulator-core-streamline-debugfs-operations.patch @@ -0,0 +1,100 @@ +From 76719d76b99136d2b2d98095519ac4dd1f9d01e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 13:13:59 +0200 +Subject: regulator: core: Streamline debugfs operations + +From: Geert Uytterhoeven + +[ Upstream commit 08880713ceec023dd94d634f1e8902728c385939 ] + +If CONFIG_DEBUG_FS is not set: + + regulator: Failed to create debugfs directory + ... + regulator-dummy: Failed to create debugfs directory + +As per the comments for debugfs_create_dir(), errors returned by this +function should be expected, and ignored: + + * If debugfs is not enabled in the kernel, the value -%ENODEV will be + * returned. + * + * NOTE: it's expected that most callers should _ignore_ the errors returned + * by this function. Other debugfs functions handle the fact that the "dentry" + * passed to them could be an error and they don't crash in that case. + * Drivers should generally work fine even if debugfs fails to init anyway. + +Adhere to the debugfs spirit, and streamline all operations by: + 1. Demoting the importance of the printed error messages to debug + level, like is already done in create_regulator(), + 2. Further ignoring any returned errors, as by design, all debugfs + functions are no-ops when passed an error pointer. + +Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/2f8bb6e113359ddfab7b59e4d4274bd4c06d6d0a.1685013051.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index eaf9d99f1f43c..351f0fd225b14 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1918,19 +1918,17 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + + if (err != -EEXIST) + regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs); +- if (IS_ERR(regulator->debugfs)) { ++ if (IS_ERR(regulator->debugfs)) + rdev_dbg(rdev, "Failed to create debugfs directory\n"); +- } else { +- debugfs_create_u32("uA_load", 0444, regulator->debugfs, +- ®ulator->uA_load); +- debugfs_create_u32("min_uV", 0444, regulator->debugfs, +- ®ulator->voltage[PM_SUSPEND_ON].min_uV); +- debugfs_create_u32("max_uV", 0444, regulator->debugfs, +- ®ulator->voltage[PM_SUSPEND_ON].max_uV); +- debugfs_create_file("constraint_flags", 0444, +- regulator->debugfs, regulator, +- &constraint_flags_fops); +- } ++ ++ debugfs_create_u32("uA_load", 0444, regulator->debugfs, ++ ®ulator->uA_load); ++ debugfs_create_u32("min_uV", 0444, regulator->debugfs, ++ ®ulator->voltage[PM_SUSPEND_ON].min_uV); ++ debugfs_create_u32("max_uV", 0444, regulator->debugfs, ++ ®ulator->voltage[PM_SUSPEND_ON].max_uV); ++ debugfs_create_file("constraint_flags", 0444, regulator->debugfs, ++ regulator, &constraint_flags_fops); + + /* + * Check now if the regulator is an always on regulator - if +@@ -5257,10 +5255,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev) + } + + rdev->debugfs = debugfs_create_dir(rname, debugfs_root); +- if (IS_ERR(rdev->debugfs)) { +- rdev_warn(rdev, "Failed to create debugfs directory\n"); +- return; +- } ++ if (IS_ERR(rdev->debugfs)) ++ rdev_dbg(rdev, "Failed to create debugfs directory\n"); + + debugfs_create_u32("use_count", 0444, rdev->debugfs, + &rdev->use_count); +@@ -6180,7 +6176,7 @@ static int __init regulator_init(void) + + debugfs_root = debugfs_create_dir("regulator", NULL); + if (IS_ERR(debugfs_root)) +- pr_warn("regulator: Failed to create debugfs directory\n"); ++ pr_debug("regulator: Failed to create debugfs directory\n"); + + #ifdef CONFIG_DEBUG_FS + debugfs_create_file("supply_map", 0444, debugfs_root, NULL, +-- +2.39.2 + diff --git a/queue-6.1/riscv-uprobes-restore-thread.bad_cause.patch b/queue-6.1/riscv-uprobes-restore-thread.bad_cause.patch new file mode 100644 index 00000000000..11c0e95b8e4 --- /dev/null +++ b/queue-6.1/riscv-uprobes-restore-thread.bad_cause.patch @@ -0,0 +1,47 @@ +From 0fa7955c8bc2ab061a72ff6c9b1f6757c3d7fac9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Apr 2023 09:42:26 +0800 +Subject: riscv: uprobes: Restore thread.bad_cause + +From: Tiezhu Yang + +[ Upstream commit 58b1294dd1d65bb62f08dddbf418f954210c2057 ] + +thread.bad_cause is saved in arch_uprobe_pre_xol(), it should be restored +in arch_uprobe_{post,abort}_xol() accordingly, otherwise the save operation +is meaningless, this change is similar with x86 and powerpc. + +Signed-off-by: Tiezhu Yang +Acked-by: Oleg Nesterov +Reviewed-by: Guo Ren +Fixes: 74784081aac8 ("riscv: Add uprobes supported") +Link: https://lore.kernel.org/r/1682214146-3756-1-git-send-email-yangtiezhu@loongson.cn +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/uprobes.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/riscv/kernel/probes/uprobes.c b/arch/riscv/kernel/probes/uprobes.c +index c976a21cd4bd5..194f166b2cc40 100644 +--- a/arch/riscv/kernel/probes/uprobes.c ++++ b/arch/riscv/kernel/probes/uprobes.c +@@ -67,6 +67,7 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) + struct uprobe_task *utask = current->utask; + + WARN_ON_ONCE(current->thread.bad_cause != UPROBE_TRAP_NR); ++ current->thread.bad_cause = utask->autask.saved_cause; + + instruction_pointer_set(regs, utask->vaddr + auprobe->insn_size); + +@@ -102,6 +103,7 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) + { + struct uprobe_task *utask = current->utask; + ++ current->thread.bad_cause = utask->autask.saved_cause; + /* + * Task has received a fatal signal, so reset back to probbed + * address. +-- +2.39.2 + diff --git a/queue-6.1/rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch b/queue-6.1/rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch new file mode 100644 index 00000000000..d8d1dc5bbfd --- /dev/null +++ b/queue-6.1/rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch @@ -0,0 +1,167 @@ +From d772fda0519dde16f1237c4b8c715d175c750c8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 13:51:08 +0300 +Subject: rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO + +From: Edwin Peer + +[ Upstream commit fa0e21fa44438a0e856d42224bfa24641d37b979 ] + +This filter already exists for excluding IPv6 SNMP stats. Extend its +definition to also exclude IFLA_VF_INFO stats in RTM_GETLINK. + +This patch constitutes a partial fix for a netlink attribute nesting +overflow bug in IFLA_VFINFO_LIST. By excluding the stats when the +requester doesn't need them, the truncation of the VF list is avoided. + +While it was technically only the stats added in commit c5a9f6f0ab40 +("net/core: Add drop counters to VF statistics") breaking the camel's +back, the appreciable size of the stats data should never have been +included without due consideration for the maximum number of VFs +supported by PCI. + +Fixes: 3b766cd83232 ("net/core: Add reading VF statistics through the PF netdevice") +Fixes: c5a9f6f0ab40 ("net/core: Add drop counters to VF statistics") +Signed-off-by: Edwin Peer +Cc: Edwin Peer +Signed-off-by: Gal Pressman +Link: https://lore.kernel.org/r/20230611105108.122586-1-gal@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 96 +++++++++++++++++++++++--------------------- + 1 file changed, 51 insertions(+), 45 deletions(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index b192c69f3936c..ef2a07ae5496e 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -957,24 +957,27 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev, + nla_total_size(sizeof(struct ifla_vf_rate)) + + nla_total_size(sizeof(struct ifla_vf_link_state)) + + nla_total_size(sizeof(struct ifla_vf_rss_query_en)) + +- nla_total_size(0) + /* nest IFLA_VF_STATS */ +- /* IFLA_VF_STATS_RX_PACKETS */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_TX_PACKETS */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_RX_BYTES */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_TX_BYTES */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_BROADCAST */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_MULTICAST */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_RX_DROPPED */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_TX_DROPPED */ +- nla_total_size_64bit(sizeof(__u64)) + + nla_total_size(sizeof(struct ifla_vf_trust))); ++ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) { ++ size += num_vfs * ++ (nla_total_size(0) + /* nest IFLA_VF_STATS */ ++ /* IFLA_VF_STATS_RX_PACKETS */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_TX_PACKETS */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_RX_BYTES */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_TX_BYTES */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_BROADCAST */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_MULTICAST */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_RX_DROPPED */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_TX_DROPPED */ ++ nla_total_size_64bit(sizeof(__u64))); ++ } + return size; + } else + return 0; +@@ -1253,7 +1256,8 @@ static noinline_for_stack int rtnl_fill_stats(struct sk_buff *skb, + static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + struct net_device *dev, + int vfs_num, +- struct nlattr *vfinfo) ++ struct nlattr *vfinfo, ++ u32 ext_filter_mask) + { + struct ifla_vf_rss_query_en vf_rss_query_en; + struct nlattr *vf, *vfstats, *vfvlanlist; +@@ -1359,33 +1363,35 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + goto nla_put_vf_failure; + } + nla_nest_end(skb, vfvlanlist); +- memset(&vf_stats, 0, sizeof(vf_stats)); +- if (dev->netdev_ops->ndo_get_vf_stats) +- dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num, +- &vf_stats); +- vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS); +- if (!vfstats) +- goto nla_put_vf_failure; +- if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS, +- vf_stats.rx_packets, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS, +- vf_stats.tx_packets, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES, +- vf_stats.rx_bytes, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES, +- vf_stats.tx_bytes, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST, +- vf_stats.broadcast, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST, +- vf_stats.multicast, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED, +- vf_stats.rx_dropped, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED, +- vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) { +- nla_nest_cancel(skb, vfstats); +- goto nla_put_vf_failure; ++ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) { ++ memset(&vf_stats, 0, sizeof(vf_stats)); ++ if (dev->netdev_ops->ndo_get_vf_stats) ++ dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num, ++ &vf_stats); ++ vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS); ++ if (!vfstats) ++ goto nla_put_vf_failure; ++ if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS, ++ vf_stats.rx_packets, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS, ++ vf_stats.tx_packets, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES, ++ vf_stats.rx_bytes, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES, ++ vf_stats.tx_bytes, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST, ++ vf_stats.broadcast, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST, ++ vf_stats.multicast, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED, ++ vf_stats.rx_dropped, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED, ++ vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) { ++ nla_nest_cancel(skb, vfstats); ++ goto nla_put_vf_failure; ++ } ++ nla_nest_end(skb, vfstats); + } +- nla_nest_end(skb, vfstats); + nla_nest_end(skb, vf); + return 0; + +@@ -1418,7 +1424,7 @@ static noinline_for_stack int rtnl_fill_vf(struct sk_buff *skb, + return -EMSGSIZE; + + for (i = 0; i < num_vfs; i++) { +- if (rtnl_fill_vfinfo(skb, dev, i, vfinfo)) ++ if (rtnl_fill_vfinfo(skb, dev, i, vfinfo, ext_filter_mask)) + return -EMSGSIZE; + } + +-- +2.39.2 + diff --git a/queue-6.1/samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch b/queue-6.1/samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch new file mode 100644 index 00000000000..c2937d10e38 --- /dev/null +++ b/queue-6.1/samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch @@ -0,0 +1,36 @@ +From 57c7cc673825a53e62e62f1c5547cb6bf83cf3e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 16:50:58 +0800 +Subject: samples/bpf: Fix buffer overflow in tcp_basertt + +From: Pengcheng Yang + +[ Upstream commit f4dea9689c5fea3d07170c2cb0703e216f1a0922 ] + +Using sizeof(nv) or strlen(nv)+1 is correct. + +Fixes: c890063e4404 ("bpf: sample BPF_SOCKET_OPS_BASE_RTT program") +Signed-off-by: Pengcheng Yang +Link: https://lore.kernel.org/r/1683276658-2860-1-git-send-email-yangpc@wangsu.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + samples/bpf/tcp_basertt_kern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/bpf/tcp_basertt_kern.c b/samples/bpf/tcp_basertt_kern.c +index 8dfe09a92feca..822b0742b8154 100644 +--- a/samples/bpf/tcp_basertt_kern.c ++++ b/samples/bpf/tcp_basertt_kern.c +@@ -47,7 +47,7 @@ int bpf_basertt(struct bpf_sock_ops *skops) + case BPF_SOCK_OPS_BASE_RTT: + n = bpf_getsockopt(skops, SOL_TCP, TCP_CONGESTION, + cong, sizeof(cong)); +- if (!n && !__builtin_memcmp(cong, nv, sizeof(nv)+1)) { ++ if (!n && !__builtin_memcmp(cong, nv, sizeof(nv))) { + /* Set base_rtt to 80us */ + rv = 80; + } else if (n) { +-- +2.39.2 + diff --git a/queue-6.1/samples-bpf-xdp1-and-xdp2-reduce-xdpbufsize-to-60.patch b/queue-6.1/samples-bpf-xdp1-and-xdp2-reduce-xdpbufsize-to-60.patch new file mode 100644 index 00000000000..40d71347419 --- /dev/null +++ b/queue-6.1/samples-bpf-xdp1-and-xdp2-reduce-xdpbufsize-to-60.patch @@ -0,0 +1,58 @@ +From 2af2b621781b0e4d5b91a3ee49ce27319d65e0e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 16:30:41 +0200 +Subject: samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60 + +From: Jesper Dangaard Brouer + +[ Upstream commit 60548b825b082cedf89b275c21c28b1e1d030e50 ] + +Default samples/pktgen scripts send 60 byte packets as hardware adds +4-bytes FCS checksum, which fulfils minimum Ethernet 64 bytes frame +size. + +XDP layer will not necessary have access to the 4-bytes FCS checksum. + +This leads to bpf_xdp_load_bytes() failing as it tries to copy 64-bytes +from an XDP packet that only have 60-bytes available. + +Fixes: 772251742262 ("samples/bpf: fixup some tools to be able to support xdp multibuffer") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/bpf/168545704139.2996228.2516528552939485216.stgit@firesoul +Signed-off-by: Sasha Levin +--- + samples/bpf/xdp1_kern.c | 2 +- + samples/bpf/xdp2_kern.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/samples/bpf/xdp1_kern.c b/samples/bpf/xdp1_kern.c +index 0a5c704badd00..d91f27cbcfa99 100644 +--- a/samples/bpf/xdp1_kern.c ++++ b/samples/bpf/xdp1_kern.c +@@ -39,7 +39,7 @@ static int parse_ipv6(void *data, u64 nh_off, void *data_end) + return ip6h->nexthdr; + } + +-#define XDPBUFSIZE 64 ++#define XDPBUFSIZE 60 + SEC("xdp.frags") + int xdp_prog1(struct xdp_md *ctx) + { +diff --git a/samples/bpf/xdp2_kern.c b/samples/bpf/xdp2_kern.c +index 67804ecf7ce37..8bca674451ed1 100644 +--- a/samples/bpf/xdp2_kern.c ++++ b/samples/bpf/xdp2_kern.c +@@ -55,7 +55,7 @@ static int parse_ipv6(void *data, u64 nh_off, void *data_end) + return ip6h->nexthdr; + } + +-#define XDPBUFSIZE 64 ++#define XDPBUFSIZE 60 + SEC("xdp.frags") + int xdp_prog1(struct xdp_md *ctx) + { +-- +2.39.2 + diff --git a/queue-6.1/scsi-3w-xxxx-add-error-handling-for-initialization-f.patch b/queue-6.1/scsi-3w-xxxx-add-error-handling-for-initialization-f.patch new file mode 100644 index 00000000000..aff8890e9bf --- /dev/null +++ b/queue-6.1/scsi-3w-xxxx-add-error-handling-for-initialization-f.patch @@ -0,0 +1,47 @@ +From 8e0f66ac778049f4d627ab9f4b691c0bc124b8fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 22:12:55 +0800 +Subject: scsi: 3w-xxxx: Add error handling for initialization failure in + tw_probe() + +From: Yuchen Yang + +[ Upstream commit 2e2fe5ac695a00ab03cab4db1f4d6be07168ed9d ] + +Smatch complains that: + +tw_probe() warn: missing error code 'retval' + +This patch adds error checking to tw_probe() to handle initialization +failure. If tw_reset_sequence() function returns a non-zero value, the +function will return -EINVAL to indicate initialization failure. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yuchen Yang +Link: https://lore.kernel.org/r/20230505141259.7730-1-u202114568@hust.edu.cn +Reviewed-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/3w-xxxx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index ffdecb12d654c..9bd70e4618d52 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2305,8 +2305,10 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (tw_reset_sequence(tw_dev)) ++ if (tw_reset_sequence(tw_dev)) { ++ retval = -EINVAL; + goto out_release_mem_region; ++ } + + /* Set host specific parameters */ + host->max_id = TW_MAX_UNITS; +-- +2.39.2 + diff --git a/queue-6.1/scsi-lpfc-revise-npiv-els-unsol-rcv-cmpl-logic-to-dr.patch b/queue-6.1/scsi-lpfc-revise-npiv-els-unsol-rcv-cmpl-logic-to-dr.patch new file mode 100644 index 00000000000..29371bc67fc --- /dev/null +++ b/queue-6.1/scsi-lpfc-revise-npiv-els-unsol-rcv-cmpl-logic-to-dr.patch @@ -0,0 +1,59 @@ +From e35000e2234a1bbbf63bab181ac7d32fd658b78b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 11:32:01 -0700 +Subject: scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based + on nlp_state + +From: Justin Tee + +[ Upstream commit 9914a3d033d3e1d836a43e93e9738e7dd44a096a ] + +When NPIV ports are zoned to devices that support both initiator and target +mode, a remote device's initiated PRLI results in unintended final kref +clean up of the device's ndlp structure. This disrupts NPIV ports' +discovery for target devices that support both initiator and target mode. + +Modify the NPIV lpfc_drop_node clause such that we allow the ndlp to live +so long as it was in NLP_STE_PLOGI_ISSUE, NLP_STE_REG_LOGIN_ISSUE, or +NLP_STE_PRLI_ISSUE nlp_state. This allows lpfc's issued PRLI completion +routine to determine if the final kref clean up should execute rather than +a remote device's issued PRLI. + +Fixes: db651ec22524 ("scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery") +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20230523183206.7728-5-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index ddd5949d8fc01..e21c73a3803ec 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -5413,9 +5413,19 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + ndlp->nlp_flag &= ~NLP_RELEASE_RPI; + spin_unlock_irq(&ndlp->lock); + } ++ lpfc_drop_node(vport, ndlp); ++ } else if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE && ++ ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE && ++ ndlp->nlp_state != NLP_STE_PRLI_ISSUE) { ++ /* Drop ndlp if there is no planned or outstanding ++ * issued PRLI. ++ * ++ * In cases when the ndlp is acting as both an initiator ++ * and target function, let our issued PRLI determine ++ * the final ndlp kref drop. ++ */ ++ lpfc_drop_node(vport, ndlp); + } +- +- lpfc_drop_node(vport, ndlp); + } + + /* Release the originating I/O reference. */ +-- +2.39.2 + diff --git a/queue-6.1/scsi-qedf-fix-null-dereference-in-error-handling.patch b/queue-6.1/scsi-qedf-fix-null-dereference-in-error-handling.patch new file mode 100644 index 00000000000..40c900f2f95 --- /dev/null +++ b/queue-6.1/scsi-qedf-fix-null-dereference-in-error-handling.patch @@ -0,0 +1,47 @@ +From 2cd866532edad92d91f33bc16006502ab19cc796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 22:00:21 +0800 +Subject: scsi: qedf: Fix NULL dereference in error handling + +From: Jinhong Zhu + +[ Upstream commit f025312b089474a54e4859f3453771314d9e3d4f ] + +Smatch reported: + +drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() +warn: missing unwind goto? + +At this point in the function, nothing has been allocated so we can return +directly. In particular the "qedf->global_queues" have not been allocated +so calling qedf_free_global_queues() will lead to a NULL dereference when +we check if (!gl[i]) and "gl" is NULL. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Signed-off-by: Jinhong Zhu +Link: https://lore.kernel.org/r/20230502140022.2852-1-jinhongzhu@hust.edu.cn +Reviewed-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index e045c6e250902..ecff2ec83a002 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3046,9 +3046,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) + * addresses of our queues + */ + if (!qedf->p_cpuq) { +- status = -EINVAL; + QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n"); +- goto mem_alloc_failure; ++ return -EINVAL; + } + + qedf->global_queues = kzalloc((sizeof(struct global_queue *) +-- +2.39.2 + diff --git a/queue-6.1/sctp-add-bpf_bypass_getsockopt-proto-callback.patch b/queue-6.1/sctp-add-bpf_bypass_getsockopt-proto-callback.patch new file mode 100644 index 00000000000..c6f876036b7 --- /dev/null +++ b/queue-6.1/sctp-add-bpf_bypass_getsockopt-proto-callback.patch @@ -0,0 +1,93 @@ +From edb1bf796d46b88c864335ca4e6ce63a04ef47ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 15:25:06 +0200 +Subject: sctp: add bpf_bypass_getsockopt proto callback + +From: Alexander Mikhalitsyn + +[ Upstream commit 2598619e012cee5273a2821441b9a051ad931249 ] + +Implement ->bpf_bypass_getsockopt proto callback and filter out +SCTP_SOCKOPT_PEELOFF, SCTP_SOCKOPT_PEELOFF_FLAGS and SCTP_SOCKOPT_CONNECTX3 +socket options from running eBPF hook on them. + +SCTP_SOCKOPT_PEELOFF and SCTP_SOCKOPT_PEELOFF_FLAGS options do fd_install(), +and if BPF_CGROUP_RUN_PROG_GETSOCKOPT hook returns an error after success of +the original handler sctp_getsockopt(...), userspace will receive an error +from getsockopt syscall and will be not aware that fd was successfully +installed into a fdtable. + +As pointed by Marcelo Ricardo Leitner it seems reasonable to skip +bpf getsockopt hook for SCTP_SOCKOPT_CONNECTX3 sockopt too. +Because internaly, it triggers connect() and if error is masked +then userspace will be confused. + +This patch was born as a result of discussion around a new SCM_PIDFD interface: +https://lore.kernel.org/all/20230413133355.350571-3-aleksandr.mikhalitsyn@canonical.com/ + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Cc: Daniel Borkmann +Cc: Christian Brauner +Cc: Stanislav Fomichev +Cc: Neil Horman +Cc: Marcelo Ricardo Leitner +Cc: Xin Long +Cc: linux-sctp@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: netdev@vger.kernel.org +Suggested-by: Stanislav Fomichev +Acked-by: Stanislav Fomichev +Signed-off-by: Alexander Mikhalitsyn +Acked-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index bc3d08bd7cef3..e1011311bc877 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -8279,6 +8279,22 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname, + return retval; + } + ++static bool sctp_bpf_bypass_getsockopt(int level, int optname) ++{ ++ if (level == SOL_SCTP) { ++ switch (optname) { ++ case SCTP_SOCKOPT_PEELOFF: ++ case SCTP_SOCKOPT_PEELOFF_FLAGS: ++ case SCTP_SOCKOPT_CONNECTX3: ++ return true; ++ default: ++ return false; ++ } ++ } ++ ++ return false; ++} ++ + static int sctp_hash(struct sock *sk) + { + /* STUB */ +@@ -9643,6 +9659,7 @@ struct proto sctp_prot = { + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, ++ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt, + .sendmsg = sctp_sendmsg, + .recvmsg = sctp_recvmsg, + .bind = sctp_bind, +@@ -9698,6 +9715,7 @@ struct proto sctpv6_prot = { + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, ++ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt, + .sendmsg = sctp_sendmsg, + .recvmsg = sctp_recvmsg, + .bind = sctp_bind, +-- +2.39.2 + diff --git a/queue-6.1/selftests-bpf-do-not-use-sign-file-as-testcase.patch b/queue-6.1/selftests-bpf-do-not-use-sign-file-as-testcase.patch new file mode 100644 index 00000000000..e68370844eb --- /dev/null +++ b/queue-6.1/selftests-bpf-do-not-use-sign-file-as-testcase.patch @@ -0,0 +1,52 @@ +From 4107f6e289467006d779ac7e2c533f83d88bffbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 11:49:46 +0200 +Subject: selftests/bpf: Do not use sign-file as testcase + +From: Alexey Gladkov + +[ Upstream commit f04a32b2c5b539e3c097cb5c7c1df12a8f4a0cf0 ] + +The sign-file utility (from scripts/) is used in prog_tests/verify_pkcs7_sig.c, +but the utility should not be called as a test. Executing this utility produces +the following error: + + selftests: /linux/tools/testing/selftests/bpf: urandom_read + ok 16 selftests: /linux/tools/testing/selftests/bpf: urandom_read + + selftests: /linux/tools/testing/selftests/bpf: sign-file + not ok 17 selftests: /linux/tools/testing/selftests/bpf: sign-file # exit=2 + +Also, urandom_read is mistakenly used as a test. It does not lead to an error, +but should be moved over to TEST_GEN_FILES as well. The empty TEST_CUSTOM_PROGS +can then be removed. + +Fixes: fc97590668ae ("selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc") +Signed-off-by: Alexey Gladkov +Signed-off-by: Daniel Borkmann +Reviewed-by: Roberto Sassu +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/ZEuWFk3QyML9y5QQ@example.org +Link: https://lore.kernel.org/bpf/88e3ab23029d726a2703adcf6af8356f7a2d3483.1684316821.git.legion@kernel.org +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 0465ddc81f352..3b57fbf8fff4a 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -85,8 +85,7 @@ TEST_GEN_PROGS_EXTENDED = test_sock_addr test_skb_cgroup_id_user \ + test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \ + xskxceiver xdp_redirect_multi xdp_synproxy veristat + +-TEST_CUSTOM_PROGS = $(OUTPUT)/urandom_read $(OUTPUT)/sign-file +-TEST_GEN_FILES += liburandom_read.so ++TEST_GEN_FILES += liburandom_read.so urandom_read sign-file + + # Emit succinct information message describing current building step + # $1 - generic step name (e.g., CC, LINK, etc); +-- +2.39.2 + diff --git a/queue-6.1/selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch b/queue-6.1/selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch new file mode 100644 index 00000000000..ef520cd55e5 --- /dev/null +++ b/queue-6.1/selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch @@ -0,0 +1,42 @@ +From 6c6b5547e3922bc67b9a1b16456da8d608ad42c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 13:30:47 +0200 +Subject: selftests/bpf: Fix check_mtu using wrong variable type + +From: Jesper Dangaard Brouer + +[ Upstream commit 095641817e1bf6aa2560e025e47575188ee3edaf ] + +Dan Carpenter found via Smatch static checker, that unsigned 'mtu_lo' is +never less than zero. + +Variable mtu_lo should have been an 'int', because read_mtu_device_lo() +uses minus as error indications. + +Fixes: b62eba563229 ("selftests/bpf: Tests using bpf_check_mtu BPF-helper") +Reported-by: Dan Carpenter +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/bpf/168605104733.3636467.17945947801753092590.stgit@firesoul +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/check_mtu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/check_mtu.c b/tools/testing/selftests/bpf/prog_tests/check_mtu.c +index 12f4395f18b37..a756760a45edb 100644 +--- a/tools/testing/selftests/bpf/prog_tests/check_mtu.c ++++ b/tools/testing/selftests/bpf/prog_tests/check_mtu.c +@@ -183,7 +183,7 @@ static void test_check_mtu_tc(__u32 mtu, __u32 ifindex) + + void serial_test_check_mtu(void) + { +- __u32 mtu_lo; ++ int mtu_lo; + + if (test__start_subtest("bpf_check_mtu XDP-attach")) + test_check_mtu_xdp_attach(); +-- +2.39.2 + diff --git a/queue-6.1/selftests-cgroup-fix-unexpected-failure-on-test_memc.patch b/queue-6.1/selftests-cgroup-fix-unexpected-failure-on-test_memc.patch new file mode 100644 index 00000000000..8f8a8945d46 --- /dev/null +++ b/queue-6.1/selftests-cgroup-fix-unexpected-failure-on-test_memc.patch @@ -0,0 +1,53 @@ +From 76414634f75ae06e7c1619ff1c9365ab41367e92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 09:52:33 +0000 +Subject: selftests: cgroup: fix unexpected failure on test_memcg_low + +From: Haifeng Xu + +[ Upstream commit 19ab365762c6cc39dfdee9e13ab0d12fe4b5540d ] + +Since commit f079a020ba95 ("selftests: memcg: factor out common parts of +memory.{low,min} tests"), the value used in second alloc_anon has changed +from 148M to 170M. Because memory.low allows reclaiming page cache in +child cgroups, so the memory.current is close to 30M instead of 50M. +Therefore, adjust the expected value of parent cgroup. + +Link: https://lkml.kernel.org/r/20230522095233.4246-2-haifeng.xu@shopee.com +Fixes: f079a020ba95 ("selftests: memcg: factor out common parts of memory.{low,min} tests") +Signed-off-by: Haifeng Xu +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Roman Gushchin +Cc: Shakeel Butt +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/cgroup/test_memcontrol.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c +index fe4f9f4302822..5a526a8e7d333 100644 +--- a/tools/testing/selftests/cgroup/test_memcontrol.c ++++ b/tools/testing/selftests/cgroup/test_memcontrol.c +@@ -284,6 +284,7 @@ static int test_memcg_protection(const char *root, bool min) + char *children[4] = {NULL}; + const char *attribute = min ? "memory.min" : "memory.low"; + long c[4]; ++ long current; + int i, attempts; + int fd; + +@@ -392,7 +393,8 @@ static int test_memcg_protection(const char *root, bool min) + goto cleanup; + } + +- if (!values_close(cg_read_long(parent[1], "memory.current"), MB(50), 3)) ++ current = min ? MB(50) : MB(30); ++ if (!values_close(cg_read_long(parent[1], "memory.current"), current, 3)) + goto cleanup; + + if (min) { +-- +2.39.2 + diff --git a/queue-6.1/selftests-rtnetlink-remove-netdevsim-device-after-ip.patch b/queue-6.1/selftests-rtnetlink-remove-netdevsim-device-after-ip.patch new file mode 100644 index 00000000000..146f16efdef --- /dev/null +++ b/queue-6.1/selftests-rtnetlink-remove-netdevsim-device-after-ip.patch @@ -0,0 +1,40 @@ +From 20a9c2e73d8db5375f521ee2bf8a35c7dc8671ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 23:03:34 +0200 +Subject: selftests: rtnetlink: remove netdevsim device after ipsec offload + test + +From: Sabrina Dubroca + +[ Upstream commit 5f789f103671fec3733ebe756e56adf15c90c21d ] + +On systems where netdevsim is built-in or loaded before the test +starts, kci_test_ipsec_offload doesn't remove the netdevsim device it +created during the test. + +Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe") +Signed-off-by: Sabrina Dubroca +Reviewed-by: Simon Horman +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/e1cb94f4f82f4eca4a444feec4488a1323396357.1687466906.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/rtnetlink.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh +index 275491be3da2f..cafd14b1ed2ab 100755 +--- a/tools/testing/selftests/net/rtnetlink.sh ++++ b/tools/testing/selftests/net/rtnetlink.sh +@@ -835,6 +835,7 @@ EOF + fi + + # clean up any leftovers ++ echo 0 > /sys/bus/netdevsim/del_device + $probed && rmmod netdevsim + + if [ $ret -ne 0 ]; then +-- +2.39.2 + diff --git a/queue-6.1/series b/queue-6.1/series index 4c780c4c14c..3db857001a2 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1 +1,372 @@ drm-use-mgr-dev-in-drm_dbg_kms-in-drm_dp_add_payload_part2.patch +fs-pipe-reveal-missing-function-protoypes.patch +block-fix-the-type-of-the-second-bdev_op_is_zoned_wr.patch +erofs-clean-up-cached-i-o-strategies.patch +erofs-avoid-tagged-pointers-to-mark-sync-decompressi.patch +erofs-remove-tagged-pointer-helpers.patch +erofs-move-zdata.h-into-zdata.c.patch +erofs-kill-hooked-chains-to-avoid-loops-on-deduplica.patch +x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch +blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch +x86-sev-fix-calculation-of-end-address-based-on-numb.patch +virt-sevguest-add-config_crypto-dependency.patch +blk-mq-fix-potential-io-hang-by-wrong-wake_batch.patch +lockd-drop-inappropriate-svc_get-from-locked_get.patch +nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch +nvme-auth-rename-authentication-work-elements.patch +nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch +nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch +nvme-core-fix-memory-leak-in-dhchap_secret_store.patch +nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch +nvme-auth-don-t-ignore-key-generation-failures-when-.patch +nvme-core-add-missing-fault-injection-cleanup.patch +nvme-core-fix-dev_pm_qos-memleak.patch +md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch +md-raid10-fix-overflow-of-md-safe_mode_delay.patch +md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch +md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch +md-raid10-fix-io-loss-while-replacement-replace-rdev.patch +md-raid1-10-factor-out-a-helper-to-add-bio-to-plug.patch +md-raid1-10-factor-out-a-helper-to-submit-normal-wri.patch +md-raid1-10-submit-write-io-directly-if-bitmap-is-no.patch +block-fix-blktrace-debugfs-entries-leakage.patch +irqchip-stm32-exti-fix-warning-on-initialized-field-.patch +irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch +svcrdma-prevent-page-release-when-nothing-was-receiv.patch +erofs-simplify-iloc.patch +erofs-fix-compact-4b-support-for-16k-block-size.patch +posix-timers-prevent-rt-livelock-in-itimer_delete.patch +tick-rcu-fix-bogus-ratelimit-condition.patch +tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch +clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch +pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch +perf-arm-cmn-fix-dtc-reset.patch +x86-mm-allow-guest.enc_status_change_prepare-to-fail.patch +x86-tdx-fix-race-between-set_memory_encrypted-and-lo.patch +drivers-perf-hisi-don-t-migrate-perf-to-the-cpu-goin.patch +powercap-rapl-fix-config_iosf_mbi-dependency.patch +pm-domains-move-the-verification-of-in-params-from-g.patch +arm-9303-1-kprobes-avoid-missing-declaration-warning.patch +cpufreq-intel_pstate-fix-energy_performance_preferen.patch +thermal-drivers-mediatek-relocate-driver-to-mediatek.patch +thermal-drivers-sun8i-fix-some-error-handling-paths-.patch +rcu-make-rcu_cpu_starting-rely-on-interrupts-being-d.patch +rcu-tasks-stop-rcu_tasks_invoke_cbs-from-using-never.patch +rcutorture-correct-name-of-use_softirq-module-parame.patch +rcuscale-move-shutdown-from-wait_event-to-wait_event.patch +rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch +rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch +kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch +perf-ibs-fix-interface-via-core-pmu-events.patch +x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch +locking-atomic-arm-fix-sync-ops.patch +evm-complete-description-of-evm_inode_setattr.patch +evm-fix-build-warnings.patch +ima-fix-build-warnings.patch +pstore-ram-add-check-for-kstrdup.patch +igc-enable-and-fix-rx-hash-usage-by-netstack.patch +wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch +wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch +libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch +samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch +spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch +wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch +wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch +sctp-add-bpf_bypass_getsockopt-proto-callback.patch +libbpf-fix-offsetof-and-container_of-to-work-with-co.patch +bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch +spi-dw-round-of-n_bytes-to-power-of-2.patch +nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch +bpftool-jit-limited-misreported-as-negative-value-on.patch +bpf-remove-bpf-trampoline-selector.patch +bpf-fix-memleak-due-to-fentry-attach-failure.patch +selftests-bpf-do-not-use-sign-file-as-testcase.patch +regulator-core-fix-more-error-checking-for-debugfs_c.patch +regulator-core-streamline-debugfs-operations.patch +wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch +wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch +wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch +wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch +wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch +wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch +samples-bpf-xdp1-and-xdp2-reduce-xdpbufsize-to-60.patch +wifi-ath10k-trigger-sta-disconnect-after-reconfig-co.patch +wifi-mac80211-recalc-min-chandef-for-new-sta-links.patch +selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch +wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch +wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch +ice-handle-extts-in-the-miscellaneous-interrupt-thre.patch +selftests-cgroup-fix-unexpected-failure-on-test_memc.patch +watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch +watchdog-perf-more-properly-prevent-false-positives-.patch +kexec-fix-a-memory-leak-in-crash_shrink_memory.patch +mmc-mediatek-avoid-ugly-error-message-when-sdio-wake.patch +memstick-r592-make-memstick_debug_get_tpc_name-stati.patch +wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch +wifi-mac80211-fix-permissions-for-valid_links-debugf.patch +rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch +wifi-ath11k-add-missing-check-for-ioremap.patch +wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch +wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch +wifi-mac80211-remove-missing-iftype-sband-data-eht-c.patch +wifi-cfg80211-rewrite-merging-of-inherited-elements.patch +wifi-cfg80211-drop-incorrect-nontransmitted-bss-upda.patch +wifi-cfg80211-fix-regulatory-disconnect-with-ocb-nan.patch +wifi-cfg80211-mac80211-fix-ml-element-common-size-ca.patch +wifi-ieee80211-fix-the-common-size-calculation-for-r.patch +mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch +wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch +wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch +bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch +bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch +bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch +can-length-fix-bitstuffing-count.patch +can-kvaser_pciefd-add-function-to-set-skb-hwtstamps.patch +can-kvaser_pciefd-set-hardware-timestamp-on-transmit.patch +net-stmmac-fix-double-serdes-powerdown.patch +netlink-fix-potential-deadlock-in-netlink_set_err.patch +netlink-do-not-hard-code-device-address-lenth-in-fdb.patch +bonding-do-not-assume-skb-mac_header-is-set.patch +selftests-rtnetlink-remove-netdevsim-device-after-ip.patch +gtp-fix-use-after-free-in-__gtp_encap_destroy.patch +net-axienet-move-reset-before-64-bit-dma-detection.patch +ocfs2-fix-use-of-slab-data-with-sendpage.patch +sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch +net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch +lib-ts_bm-reset-initial-match-offset-for-every-block.patch +netfilter-conntrack-dccp-copy-entire-header-to-stack.patch +netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch +ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch +netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch +drm-amd-display-add-logging-for-display-mall-refresh.patch +radeon-avoid-double-free-in-ci_dpm_init.patch +drm-amd-display-explicitly-specify-update-type-per-p.patch +drm-bridge-it6505-move-a-variable-assignment-behind-.patch +input-drv260x-sleep-between-polling-go-bit.patch +drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch +drm-bridge-tc358768-always-enable-hs-video-mode.patch +drm-bridge-tc358768-fix-pll-parameters-computation.patch +drm-bridge-tc358768-fix-pll-target-frequency.patch +drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch +drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch +drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch +drm-bridge-tc358768-fix-ths_zerocnt-computation.patch +drm-bridge-tc358768-fix-txtagocnt-computation.patch +drm-bridge-tc358768-fix-ths_trailcnt-computation.patch +drm-vram-helper-fix-function-names-in-vram-helper-do.patch +arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch +arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch +clk-vc5-use-clamp-to-restrict-pll-range.patch +clk-vc5-fix-.driver_data-content-in-i2c_device_id.patch +clk-vc7-fix-.driver_data-content-in-i2c_device_id.patch +clk-rs9-fix-.driver_data-content-in-i2c_device_id.patch +input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch +drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch +drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch +driver-soc-xilinx-use-_safe-loop-iterator-to-avoid-a.patch +asoc-intel-sof_sdw-remove-sof_sdw_tgl_hdmi-for-meteo.patch +drm-vkms-isolate-pixel-conversion-functionality.patch +drm-add-fixed-point-helper-to-get-rounded-integer-va.patch +drm-vkms-fix-rgb565-pixel-conversion.patch +arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch +bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch +arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch +drm-bridge-tc358767-switch-to-devm-mipi-dsi-helpers.patch +clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch +hwmon-f71882fg-prevent-possible-division-by-zero.patch +rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch +rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch +rdma-bnxt_re-use-unique-names-while-registering-inte.patch +rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch +rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch +drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch +drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch +drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch +iommu-virtio-detach-domain-on-endpoint-release.patch +iommu-virtio-return-size-mapped-for-a-detached-domai.patch +clk-renesas-rzg2l-fix-cpg_sipll5_clk1-register-write.patch +arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch +drm-bridge-anx7625-convert-to-i2c-s-.probe_new.patch +drm-bridge-anx7625-prevent-endless-probe-loop.patch +arm-dts-qcom-msm8974-do-not-use-underscore-in-node-n.patch +arm64-dts-qcom-msm8916-correct-camss-unit-address.patch +arm64-dts-qcom-msm8916-correct-mmc-unit-address.patch +arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch +arm64-dts-qcom-msm8996-correct-camss-unit-address.patch +arm64-dts-qcom-sdm630-correct-camss-unit-address.patch +arm64-dts-qcom-sdm845-correct-camss-unit-address.patch +arm64-dts-qcom-sm8350-add-gpi-dma-compatible-fallbac.patch +arm64-dts-qcom-sm8350-correct-dma-controller-unit-ad.patch +arm64-dts-qcom-sdm845-polaris-add-missing-touchscree.patch +arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch +arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch +drm-bridge-introduce-pre_enable_prev_first-to-alter-.patch +drm-bridge-ti-sn65dsi83-fix-enable-disable-flow-to-m.patch +drm-panel-simple-fix-active-size-for-ampire-am-48027.patch +arm-ep93xx-fix-missing-prototype-warnings.patch +arm-omap2-fix-missing-tick_broadcast-prototype.patch +arm64-dts-qcom-pm7250b-add-missing-spmi-vadc-include.patch +arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch +arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch +arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch +memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch +arm-dts-qcom-apq8074-dragonboard-set-dma-as-remotely.patch +asoc-es8316-increment-max-value-for-alc-capture-targ.patch +asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch +arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch +soc-fsl-qe-fix-usb.c-build-errors.patch +rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch +ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch +rdma-hns-fix-hns_roce_table_get-return-value.patch +arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch +arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch +drm-msm-dpu-set-dsc-flush-bit-correctly-at-mdp-ctl-f.patch +fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch +arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch +input-pm8941-powerkey-fix-debounce-on-gen2-pmics.patch +arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch +arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch +hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch +hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch +arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch +clk-export-clk_hw_forward_rate_request.patch +mips-dts-ci20-fix-act8600-regulator-node-names.patch +drm-amd-display-fix-a-test-calculateprefetchschedule.patch +drm-amd-display-fix-a-test-dml32_rq_dlg_get_rq_reg.patch +drm-amdkfd-fix-potential-deallocation-of-previously-.patch +soc-mediatek-svs-fix-mt8192-gpu-node-name.patch +drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch +drm-radeon-fix-possible-division-by-zero-errors.patch +hid-input-map-battery-system-charging.patch +hid-uclogic-modular-kunit-tests-should-not-depend-on.patch +rdma-rxe-add-ibdev_dbg-macros-for-rxe.patch +rdma-rxe-replace-pr_xxx-by-rxe_dbg_xxx-in-rxe_mw.c.patch +rdma-rxe-fix-access-checks-in-rxe_check_bind_mw.patch +amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch +drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch +rdma-bnxt_re-wraparound-mbox-producer-index.patch +rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch +clk-imx-clk-imxrt1050-fix-memory-leak-in-imxrt1050_c.patch +clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch +clk-imx93-fix-memory-leak-and-missing-unwind-goto-in.patch +clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch +clk-mediatek-mt8192-correctly-unregister-and-free-cl.patch +clk-mediatek-mt8192-propagate-struct-device-for-gate.patch +clk-mediatek-clk-gate-propagate-struct-device-with-m.patch +clk-mediatek-clk-mtk-propagate-struct-device-for-com.patch +clk-mediatek-clk-mux-propagate-struct-device-for-mtk.patch +clk-mediatek-clk-mtk-extend-mtk_clk_simple_probe.patch +clk-mediatek-fix-of_iomap-memory-leak.patch +arm64-dts-qcom-sdm845-flush-rsc-sleep-wake-votes.patch +arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch +clk-bcm-rpi-fix-off-by-one-in-raspberrypi_discover_c.patch +clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch +clk-tegra-tegra124-emc-fix-potential-memory-leak.patch +alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch +drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch +drm-msm-dpu-fix-slice_last_group_size-calculation.patch +drm-msm-dsi-use-dsc-slice-s-packet-size-to-compute-w.patch +drm-msm-dsi-flip-greater-than-check-for-slice_count-.patch +drm-msm-dsi-remove-incorrect-references-to-slice_cou.patch +drm-msm-dp-free-resources-after-unregistering-them.patch +arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch +arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch +drm-amdgpu-fix-memcpy-in-sienna_cichlid_append_power.patch +drm-amdgpu-fix-usage-of-umc-fill-record-in-ras.patch +drm-msm-dpu-correct-merge_3d-length.patch +clk-vc5-check-memory-returned-by-kasprintf.patch +clk-cdce925-check-return-value-of-kasprintf.patch +clk-si5341-return-error-if-one-synth-clock-registrat.patch +clk-si5341-check-return-value-of-devm_-kasprintf.patch +clk-si5341-free-unused-memory-on-probe-failure.patch +clk-keystone-sci-clk-check-return-value-of-kasprintf.patch +clk-ti-clkctrl-check-return-value-of-kasprintf.patch +clocking-wizard-support-higher-frequency-accuracy.patch +clk-clocking-wizard-check-return-value-of-devm_kaspr.patch +drivers-meson-secure-pwrc-always-enable-dma-domain.patch +ovl-update-of-dentry-revalidate-flags-after-copy-up.patch +asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch +clk-fix-memory-leak-in-devm_clk_notifier_register.patch +arm-dts-lan966x-kontron-d10-fix-board-reset.patch +arm-dts-lan966x-kontron-d10-fix-spi-cs.patch +asoc-amd-acp-clear-pdm-dma-interrupt-mask.patch +mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch +mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch +pci-cadence-fix-gen2-link-retraining-process.patch +pci-vmd-reset-vmd-config-register-between-soft-reboo.patch +scsi-qedf-fix-null-dereference-in-error-handling.patch +pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch +platform-x86-lenovo-yogabook-fix-work-race-on-remove.patch +platform-x86-lenovo-yogabook-reprobe-devices-on-remo.patch +platform-x86-lenovo-yogabook-set-default-keyboard-ba.patch +pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch +scsi-3w-xxxx-add-error-handling-for-initialization-f.patch +pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch +pci-ftpci100-release-the-clock-resources.patch +pinctrl-sunplus-add-check-for-kmalloc.patch +pci-add-pci_clear_master-stub-for-non-config_pci.patch +scsi-lpfc-revise-npiv-els-unsol-rcv-cmpl-logic-to-dr.patch +perf-bench-add-missing-setlocale-call-to-allow-usage.patch +pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch +platform-x86-think-lmi-mutex-protection-around-multi.patch +platform-x86-think-lmi-correct-system-password-inter.patch +platform-x86-think-lmi-correct-nvme-password-handlin.patch +pinctrl-sunplus-add-check-for-kmalloc.patch-1604 +pinctrl-npcm7xx-add-missing-check-for-ioremap.patch +kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch +powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch +powerpc-signal32-force-inlining-of-__unsafe_save_use.patch +perf-script-fix-allocation-of-evsel-priv-related-to-.patch +platform-x86-thinkpad_acpi-fix-lkp-tests-warnings-fo.patch +perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch +acpi-make-remove-callback-of-acpi-driver-void.patch +platform-x86-dell-dell-rbtn-fix-resources-leaking-on.patch +perf-tool-x86-consolidate-is_amd-check-into-single-f.patch +perf-tool-x86-fix-perf_env-memory-leak.patch +powerpc-64s-fix-vas-mm-use-after-free.patch +pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch +pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch +powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch +powerpc-simplify-ppc_save_regs.patch +powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch +pci-qcom-remove-pcie20_-prefix-from-register-definit.patch +pci-qcom-sort-and-group-registers-and-bitfield-defin.patch +pci-qcom-use-lower-case-for-hex.patch +pci-qcom-use-dwc-helpers-for-modifying-the-read-only.patch +pci-qcom-disable-write-access-to-read-only-registers.patch +riscv-uprobes-restore-thread.bad_cause.patch +powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch +powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch +pci-endpoint-fix-kconfig-indent-style.patch +pci-endpoint-fix-a-kconfig-prompt-of-vntb-driver.patch +pci-endpoint-functions-pci-epf-test-fix-dma_chan-dir.patch +pci-vmd-fix-uninitialized-variable-usage-in-vmd_enab.patch +vfio-mdev-move-the-compat_class-initialization-to-mo.patch +hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch +modpost-remove-broken-calculation-of-exception_table.patch +crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch +modpost-fix-section-mismatch-message-for-r_arm_abs32.patch +modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch +crypto-marvell-cesa-fix-type-mismatch-warning.patch +crypto-jitter-correct-health-test-during-initializat.patch +modpost-fix-off-by-one-in-is_executable_section.patch +arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch +crypto-kpp-add-helper-to-set-reqsize.patch +crypto-qat-use-helper-to-set-reqsize.patch +crypto-qat-unmap-buffer-before-free-for-dh.patch +crypto-qat-unmap-buffers-before-free-for-rsa.patch +nfsv4.2-fix-wrong-shrinker_id.patch +nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch +smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch +dax-fix-dax_mapping_release-use-after-free.patch +dax-introduce-alloc_dev_dax_id.patch +dax-kmem-pass-valid-argument-to-memory_group_registe.patch +hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch +kbuild-disable-gcov-for-.mod.o.patch +efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch +cifs-prevent-use-after-free-by-freeing-the-cfile-lat.patch +cifs-do-all-necessary-checks-for-credits-within-or-b.patch +smb-client-fix-broken-file-attrs-with-nodfs-mounts.patch +ksmbd-avoid-field-overflow-warning.patch +arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch +x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch diff --git a/queue-6.1/sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch b/queue-6.1/sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch new file mode 100644 index 00000000000..cd242d3ecfc --- /dev/null +++ b/queue-6.1/sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch @@ -0,0 +1,70 @@ +From ee5aa246c50e27c6aa505b3d65ed36beb5e71301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 15:34:48 +0100 +Subject: sfc: fix crash when reading stats while NIC is resetting + +From: Edward Cree + +[ Upstream commit d1b355438b8325a486f087e506d412c4e852f37b ] + +efx_net_stats() (.ndo_get_stats64) can be called during an ethtool + selftest, during which time nic_data->mc_stats is NULL as the NIC has + been fini'd. In this case do not attempt to fetch the latest stats + from the hardware, else we will crash on a NULL dereference: + BUG: kernel NULL pointer dereference, address: 0000000000000038 + RIP efx_nic_update_stats + abridged calltrace: + efx_ef10_update_stats_pf + efx_net_stats + dev_get_stats + dev_seq_printf_stats +Skipping the read is safe, we will simply give out stale stats. +To ensure that the free in efx_ef10_fini_nic() does not race against + efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the + efx->stats_lock in fini_nic (it is already held across update_stats). + +Fixes: d3142c193dca ("sfc: refactor EF10 stats handling") +Reviewed-by: Pieter Jansen van Vuuren +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index b63e47af63655..8c019f382a7f3 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1297,8 +1297,10 @@ static void efx_ef10_fini_nic(struct efx_nic *efx) + { + struct efx_ef10_nic_data *nic_data = efx->nic_data; + ++ spin_lock_bh(&efx->stats_lock); + kfree(nic_data->mc_stats); + nic_data->mc_stats = NULL; ++ spin_unlock_bh(&efx->stats_lock); + } + + static int efx_ef10_init_nic(struct efx_nic *efx) +@@ -1852,9 +1854,14 @@ static size_t efx_ef10_update_stats_pf(struct efx_nic *efx, u64 *full_stats, + + efx_ef10_get_stat_mask(efx, mask); + +- efx_nic_copy_stats(efx, nic_data->mc_stats); +- efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, +- mask, stats, nic_data->mc_stats, false); ++ /* If NIC was fini'd (probably resetting), then we can't read ++ * updated stats right now. ++ */ ++ if (nic_data->mc_stats) { ++ efx_nic_copy_stats(efx, nic_data->mc_stats); ++ efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, ++ mask, stats, nic_data->mc_stats, false); ++ } + + /* Update derived statistics */ + efx_nic_fix_nodesc_drop_stat(efx, +-- +2.39.2 + diff --git a/queue-6.1/smb-client-fix-broken-file-attrs-with-nodfs-mounts.patch b/queue-6.1/smb-client-fix-broken-file-attrs-with-nodfs-mounts.patch new file mode 100644 index 00000000000..c7f3347ce67 --- /dev/null +++ b/queue-6.1/smb-client-fix-broken-file-attrs-with-nodfs-mounts.patch @@ -0,0 +1,58 @@ +From 1a78eb37a341ea50715c7d01ee59d9e8b50a53f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 21:24:49 -0300 +Subject: smb: client: fix broken file attrs with nodfs mounts + +From: Paulo Alcantara + +[ Upstream commit d439b29057e26464120fc6c18f97433aa003b5fe ] + +*_get_inode_info() functions expect -EREMOTE when query path info +calls find a DFS link, regardless whether !CONFIG_CIFS_DFS_UPCALL or +'nodfs' mount option. Otherwise, those files will miss the fake DFS +file attributes. + +Before patch + + $ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs + $ ls -l /mnt/1 + ls: cannot access '/mnt/1/link': Operation not supported + total 0 + -rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt + drwxr-xr-x 2 root root 0 Aug 8 2022 dir1 + d????????? ? ? ? ? ? link + +After patch + + $ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs + $ ls -l /mnt/1 + total 0 + -rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt + drwxr-xr-x 2 root root 0 Aug 8 2022 dir1 + drwx--x--x 2 root root 0 Jun 26 20:29 link + +Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests") +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2inode.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 57526bdbab171..5ddc629e62168 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -592,9 +592,6 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + if (islink) + rc = -EREMOTE; + } +- if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && +- (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) +- rc = -EOPNOTSUPP; + } + + out: +-- +2.39.2 + diff --git a/queue-6.1/smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch b/queue-6.1/smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch new file mode 100644 index 00000000000..47339f73fb9 --- /dev/null +++ b/queue-6.1/smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch @@ -0,0 +1,66 @@ +From f3a0d9422c5355d9a7c8109c5dc847f65cb40f87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 19:02:24 +0000 +Subject: SMB3: Do not send lease break acknowledgment if all file handles have + been closed + +From: Bharath SM + +[ Upstream commit da787d5b74983f7525d1eb4b9c0b4aff2821511a ] + +In case if all existing file handles are deferred handles and if all of +them gets closed due to handle lease break then we dont need to send +lease break acknowledgment to server, because last handle close will be +considered as lease break ack. +After closing deferred handels, we check for openfile list of inode, +if its empty then we skip sending lease break ack. + +Fixes: 59a556aebc43 ("SMB3: drop reference to cfile before sending oplock break") +Reviewed-by: Tom Talpey +Signed-off-by: Bharath SM +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/file.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c +index 87dcffece7623..9a367d4c74e47 100644 +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -5140,20 +5140,19 @@ void cifs_oplock_break(struct work_struct *work) + + _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false); + /* +- * releasing stale oplock after recent reconnect of smb session using +- * a now incorrect file handle is not a data integrity issue but do +- * not bother sending an oplock release if session to server still is +- * disconnected since oplock already released by the server ++ * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require ++ * an acknowledgment to be sent when the file has already been closed. ++ * check for server null, since can race with kill_sb calling tree disconnect. + */ +- if (!oplock_break_cancelled) { +- /* check for server null since can race with kill_sb calling tree disconnect */ +- if (tcon->ses && tcon->ses->server) { +- rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid, +- volatile_fid, net_fid, cinode); +- cifs_dbg(FYI, "Oplock release rc = %d\n", rc); +- } else +- pr_warn_once("lease break not sent for unmounted share\n"); +- } ++ spin_lock(&cinode->open_file_lock); ++ if (tcon->ses && tcon->ses->server && !oplock_break_cancelled && ++ !list_empty(&cinode->openFileList)) { ++ spin_unlock(&cinode->open_file_lock); ++ rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid, ++ volatile_fid, net_fid, cinode); ++ cifs_dbg(FYI, "Oplock release rc = %d\n", rc); ++ } else ++ spin_unlock(&cinode->open_file_lock); + + cifs_done_oplock_break(cinode); + } +-- +2.39.2 + diff --git a/queue-6.1/soc-fsl-qe-fix-usb.c-build-errors.patch b/queue-6.1/soc-fsl-qe-fix-usb.c-build-errors.patch new file mode 100644 index 00000000000..ce3e03667d2 --- /dev/null +++ b/queue-6.1/soc-fsl-qe-fix-usb.c-build-errors.patch @@ -0,0 +1,60 @@ +From a631165bd44d862b54fdbf1c4c0edd4cecd69f1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 May 2023 15:52:16 -0700 +Subject: soc/fsl/qe: fix usb.c build errors + +From: Randy Dunlap + +[ Upstream commit 7b1a78babd0d2cd27aa07255dee0c2d7ac0f31e3 ] + +Fix build errors in soc/fsl/qe/usb.c when QUICC_ENGINE is not set. +This happens when PPC_EP88XC is set, which selects CPM1 & CPM. +When CPM is set, USB_FSL_QE can be set without QUICC_ENGINE +being set. When USB_FSL_QE is set, QE_USB deafults to y, which +causes build errors when QUICC_ENGINE is not set. Making +QE_USB depend on QUICC_ENGINE prevents QE_USB from defaulting to y. + +Fixes these build errors: + +drivers/soc/fsl/qe/usb.o: in function `qe_usb_clock_set': +usb.c:(.text+0x1e): undefined reference to `qe_immr' +powerpc-linux-ld: usb.c:(.text+0x2a): undefined reference to `qe_immr' +powerpc-linux-ld: usb.c:(.text+0xbc): undefined reference to `qe_setbrg' +powerpc-linux-ld: usb.c:(.text+0xca): undefined reference to `cmxgcr_lock' +powerpc-linux-ld: usb.c:(.text+0xce): undefined reference to `cmxgcr_lock' + +Fixes: 5e41486c408e ("powerpc/QE: add support for QE USB clocks routing") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Link: https://lore.kernel.org/all/202301101500.pillNv6R-lkp@intel.com/ +Suggested-by: Michael Ellerman +Cc: Christophe Leroy +Cc: Leo Li +Cc: Masahiro Yamada +Cc: Nicolas Schier +Cc: Qiang Zhao +Cc: linuxppc-dev +Cc: linux-arm-kernel@lists.infradead.org +Cc: Kumar Gala +Acked-by: Nicolas Schier +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qe/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig +index 357c5800b112f..7afa796dbbb89 100644 +--- a/drivers/soc/fsl/qe/Kconfig ++++ b/drivers/soc/fsl/qe/Kconfig +@@ -39,6 +39,7 @@ config QE_TDM + + config QE_USB + bool ++ depends on QUICC_ENGINE + default y if USB_FSL_QE + help + QE USB Controller support +-- +2.39.2 + diff --git a/queue-6.1/soc-mediatek-svs-fix-mt8192-gpu-node-name.patch b/queue-6.1/soc-mediatek-svs-fix-mt8192-gpu-node-name.patch new file mode 100644 index 00000000000..2fa85776d4f --- /dev/null +++ b/queue-6.1/soc-mediatek-svs-fix-mt8192-gpu-node-name.patch @@ -0,0 +1,45 @@ +From beeb3ec20f15bcd638ac06de99e6b91fd847e016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 14:35:30 +0800 +Subject: soc: mediatek: SVS: Fix MT8192 GPU node name + +From: Chen-Yu Tsai + +[ Upstream commit 95094495401bdf6a0649d220dfd095e6079b5e39 ] + +Device tree node names should be generic. The planned device node name +for the GPU, according to the bindings and posted DT changes, is "gpu", +not "mali". + +Fix the GPU node name in the SVS driver to follow. + +Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Alexandre Mergnat +Link: https://lore.kernel.org/r/20230531063532.2240038-1-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-svs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c +index e55fb16fdc5ac..f00cd5c723499 100644 +--- a/drivers/soc/mediatek/mtk-svs.c ++++ b/drivers/soc/mediatek/mtk-svs.c +@@ -2114,9 +2114,9 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp) + svsb = &svsp->banks[idx]; + + if (svsb->type == SVSB_HIGH) +- svsb->opp_dev = svs_add_device_link(svsp, "mali"); ++ svsb->opp_dev = svs_add_device_link(svsp, "gpu"); + else if (svsb->type == SVSB_LOW) +- svsb->opp_dev = svs_get_subsys_device(svsp, "mali"); ++ svsb->opp_dev = svs_get_subsys_device(svsp, "gpu"); + + if (IS_ERR(svsb->opp_dev)) + return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev), +-- +2.39.2 + diff --git a/queue-6.1/spi-dw-round-of-n_bytes-to-power-of-2.patch b/queue-6.1/spi-dw-round-of-n_bytes-to-power-of-2.patch new file mode 100644 index 00000000000..b8ba1de6cc9 --- /dev/null +++ b/queue-6.1/spi-dw-round-of-n_bytes-to-power-of-2.patch @@ -0,0 +1,59 @@ +From 6ee2d40d8e92847eaf6f0e02238c91621155a5fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 10:47:45 +0000 +Subject: spi: dw: Round of n_bytes to power of 2 + +From: Joy Chakraborty + +[ Upstream commit 9f34baf67e4d08908fd94ff29c825bb673295336 ] + +n_bytes variable in the driver represents the number of bytes per word +that needs to be sent/copied to fifo. Bits/word can be between 8 and 32 +bits from the client but in memory they are a power of 2, same is mentioned +in spi.h header: +" + * @bits_per_word: Data transfers involve one or more words; word sizes + * like eight or 12 bits are common. In-memory wordsizes are + * powers of two bytes (e.g. 20 bit samples use 32 bits). + * This may be changed by the device's driver, or left at the + * default (0) indicating protocol words are eight bit bytes. + * The spi_transfer.bits_per_word can override this for each transfer. +" + +Hence, round of n_bytes to a power of 2 to avoid values like 3 which +would generate unalligned/odd accesses to memory/fifo. + +* tested on Baikal-T1 based system with DW SPI-looped back interface +transferring a chunk of data with DFS:8,12,16. + +Fixes: a51acc2400d4 ("spi: dw: Add support for 32-bits max xfer size") +Suggested-by: Andy Shevchenko +--- + drivers/spi/spi-dw-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c +index c3bfb6c84cab2..4976e3b8923ee 100644 +--- a/drivers/spi/spi-dw-core.c ++++ b/drivers/spi/spi-dw-core.c +@@ -426,7 +426,10 @@ static int dw_spi_transfer_one(struct spi_controller *master, + int ret; + + dws->dma_mapped = 0; +- dws->n_bytes = DIV_ROUND_UP(transfer->bits_per_word, BITS_PER_BYTE); ++ dws->n_bytes = ++ roundup_pow_of_two(DIV_ROUND_UP(transfer->bits_per_word, ++ BITS_PER_BYTE)); ++ + dws->tx = (void *)transfer->tx_buf; + dws->tx_len = transfer->len / dws->n_bytes; + dws->rx = transfer->rx_buf; +-- +2.39.2 + diff --git a/queue-6.1/spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch b/queue-6.1/spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch new file mode 100644 index 00000000000..18e6b9640ed --- /dev/null +++ b/queue-6.1/spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch @@ -0,0 +1,44 @@ +From 779dde932b00961a93d7a3fe95f2d224a255ebc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 14:12:08 +0530 +Subject: spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG + +From: Vijaya Krishna Nivarthi + +[ Upstream commit 5fd7c99ecf45c8ee8a9b1268f0ffc91cc6271da2 ] + +The CS_TOGGLE bit when set is supposed to instruct FW to +toggle CS line between words. The driver with intent of +disabling this behaviour has been unsetting BIT(0). This has +not caused any trouble so far because the original BIT(1) +is untouched and BIT(0) likely wasn't being used. + +Correct this to prevent a potential future bug. + +Signed-off-by: Vijaya Krishna Nivarthi +--- + drivers/spi/spi-geni-qcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index dd1581893fe72..689b94fc5570a 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -35,7 +35,7 @@ + #define CS_DEMUX_OUTPUT_SEL GENMASK(3, 0) + + #define SE_SPI_TRANS_CFG 0x25c +-#define CS_TOGGLE BIT(0) ++#define CS_TOGGLE BIT(1) + + #define SE_SPI_WORD_LEN 0x268 + #define WORD_LEN_MSK GENMASK(9, 0) +-- +2.39.2 + diff --git a/queue-6.1/svcrdma-prevent-page-release-when-nothing-was-receiv.patch b/queue-6.1/svcrdma-prevent-page-release-when-nothing-was-receiv.patch new file mode 100644 index 00000000000..381dc6396ab --- /dev/null +++ b/queue-6.1/svcrdma-prevent-page-release-when-nothing-was-receiv.patch @@ -0,0 +1,53 @@ +From a7302893f02720d2f2767fca34f01adeeb775274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 10:10:20 -0400 +Subject: svcrdma: Prevent page release when nothing was received + +From: Chuck Lever + +[ Upstream commit baf6d18b116b7dc84ed5e212c3a89f17cdc3f28c ] + +I noticed that svc_rqst_release_pages() was still unnecessarily +releasing a page when svc_rdma_recvfrom() returns zero. + +Fixes: a53d5cb0646a ("svcrdma: Avoid releasing a page in svc_xprt_release()") +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +index 53a7cb2f6c07d..6da6608985ce9 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +@@ -796,6 +796,12 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp) + struct svc_rdma_recv_ctxt *ctxt; + int ret; + ++ /* Prevent svc_xprt_release() from releasing pages in rq_pages ++ * when returning 0 or an error. ++ */ ++ rqstp->rq_respages = rqstp->rq_pages; ++ rqstp->rq_next_page = rqstp->rq_respages; ++ + rqstp->rq_xprt_ctxt = NULL; + + ctxt = NULL; +@@ -819,12 +825,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp) + DMA_FROM_DEVICE); + svc_rdma_build_arg_xdr(rqstp, ctxt); + +- /* Prevent svc_xprt_release from releasing pages in rq_pages +- * if we return 0 or an error. +- */ +- rqstp->rq_respages = rqstp->rq_pages; +- rqstp->rq_next_page = rqstp->rq_respages; +- + ret = svc_rdma_xdr_decode_req(&rqstp->rq_arg, ctxt); + if (ret < 0) + goto out_err; +-- +2.39.2 + diff --git a/queue-6.1/thermal-drivers-mediatek-relocate-driver-to-mediatek.patch b/queue-6.1/thermal-drivers-mediatek-relocate-driver-to-mediatek.patch new file mode 100644 index 00000000000..1c8c7fe7f15 --- /dev/null +++ b/queue-6.1/thermal-drivers-mediatek-relocate-driver-to-mediatek.patch @@ -0,0 +1,122 @@ +From 0c5ad2b0ede5b59edcbbb1114c18d9f5cdda47a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 11:56:23 +0100 +Subject: thermal/drivers/mediatek: Relocate driver to mediatek folder + +From: Balsam CHIHI + +[ Upstream commit fad399ebdd67f602f306b524e6f62c3570943a48 ] + +Add MediaTek proprietary folder to upstream more thermal zone and cooler +drivers, relocate the original thermal controller driver to it, and rename it +as "auxadc_thermal.c" to show its purpose more clearly. + +Signed-off-by: Balsam CHIHI +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230209105628.50294-2-bchihi@baylibre.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 86edac7d3888 ("Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"") +Signed-off-by: Sasha Levin +--- + drivers/thermal/Kconfig | 14 ++++--------- + drivers/thermal/Makefile | 2 +- + drivers/thermal/mediatek/Kconfig | 21 +++++++++++++++++++ + drivers/thermal/mediatek/Makefile | 1 + + .../auxadc_thermal.c} | 2 +- + 5 files changed, 28 insertions(+), 12 deletions(-) + create mode 100644 drivers/thermal/mediatek/Kconfig + create mode 100644 drivers/thermal/mediatek/Makefile + rename drivers/thermal/{mtk_thermal.c => mediatek/auxadc_thermal.c} (99%) + +diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig +index e052dae614ebb..d35f63daca3b7 100644 +--- a/drivers/thermal/Kconfig ++++ b/drivers/thermal/Kconfig +@@ -412,16 +412,10 @@ config DA9062_THERMAL + zone. + Compatible with the DA9062 and DA9061 PMICs. + +-config MTK_THERMAL +- tristate "Temperature sensor driver for mediatek SoCs" +- depends on ARCH_MEDIATEK || COMPILE_TEST +- depends on HAS_IOMEM +- depends on NVMEM || NVMEM=n +- depends on RESET_CONTROLLER +- default y +- help +- Enable this option if you want to have support for thermal management +- controller present in Mediatek SoCs ++menu "Mediatek thermal drivers" ++depends on ARCH_MEDIATEK || COMPILE_TEST ++source "drivers/thermal/mediatek/Kconfig" ++endmenu + + config AMLOGIC_THERMAL + tristate "Amlogic Thermal Support" +diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile +index 2506c6c8ca83a..766ce38ff4f33 100644 +--- a/drivers/thermal/Makefile ++++ b/drivers/thermal/Makefile +@@ -55,7 +55,7 @@ obj-y += st/ + obj-y += qcom/ + obj-y += tegra/ + obj-$(CONFIG_HISI_THERMAL) += hisi_thermal.o +-obj-$(CONFIG_MTK_THERMAL) += mtk_thermal.o ++obj-y += mediatek/ + obj-$(CONFIG_GENERIC_ADC_THERMAL) += thermal-generic-adc.o + obj-$(CONFIG_UNIPHIER_THERMAL) += uniphier_thermal.o + obj-$(CONFIG_AMLOGIC_THERMAL) += amlogic_thermal.o +diff --git a/drivers/thermal/mediatek/Kconfig b/drivers/thermal/mediatek/Kconfig +new file mode 100644 +index 0000000000000..7558a847d4e92 +--- /dev/null ++++ b/drivers/thermal/mediatek/Kconfig +@@ -0,0 +1,21 @@ ++config MTK_THERMAL ++ tristate "MediaTek thermal drivers" ++ depends on THERMAL_OF ++ help ++ This is the option for MediaTek thermal software solutions. ++ Please enable corresponding options to get temperature ++ information from thermal sensors or turn on throttle ++ mechaisms for thermal mitigation. ++ ++if MTK_THERMAL ++ ++config MTK_SOC_THERMAL ++ tristate "AUXADC temperature sensor driver for MediaTek SoCs" ++ depends on HAS_IOMEM ++ help ++ Enable this option if you want to get SoC temperature ++ information for MediaTek platforms. ++ This driver configures thermal controllers to collect ++ temperature via AUXADC interface. ++ ++endif +diff --git a/drivers/thermal/mediatek/Makefile b/drivers/thermal/mediatek/Makefile +new file mode 100644 +index 0000000000000..53e86e30b26ff +--- /dev/null ++++ b/drivers/thermal/mediatek/Makefile +@@ -0,0 +1 @@ ++obj-$(CONFIG_MTK_SOC_THERMAL) += auxadc_thermal.o +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mediatek/auxadc_thermal.c +similarity index 99% +rename from drivers/thermal/mtk_thermal.c +rename to drivers/thermal/mediatek/auxadc_thermal.c +index 8440692e3890d..b4ef57fa9183e 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mediatek/auxadc_thermal.c +@@ -23,7 +23,7 @@ + #include + #include + +-#include "thermal_hwmon.h" ++#include "../thermal_hwmon.h" + + /* AUXADC Registers */ + #define AUXADC_CON1_SET_V 0x008 +-- +2.39.2 + diff --git a/queue-6.1/thermal-drivers-sun8i-fix-some-error-handling-paths-.patch b/queue-6.1/thermal-drivers-sun8i-fix-some-error-handling-paths-.patch new file mode 100644 index 00000000000..55a300467ea --- /dev/null +++ b/queue-6.1/thermal-drivers-sun8i-fix-some-error-handling-paths-.patch @@ -0,0 +1,144 @@ +From 538a3db6cf6095d87e4446f6a0d0b58fac1d7ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 May 2023 20:46:05 +0200 +Subject: thermal/drivers/sun8i: Fix some error handling paths in + sun8i_ths_probe() + +From: Christophe JAILLET + +[ Upstream commit 89382022b370dfd34eaae9c863baa123fcd4d132 ] + +Should an error occur after calling sun8i_ths_resource_init() in the probe +function, some resources need to be released, as already done in the +.remove() function. + +Switch to the devm_clk_get_enabled() helper and add a new devm_action to +turn sun8i_ths_resource_init() into a fully managed function. + +Move the place where reset_control_deassert() is called so that the +recommended order of reset release/clock enable steps is kept. +A64 manual states that: + + 3.3.6.4. Gating and reset + + Make sure that the reset signal has been released before the release of + module clock gating; + +This fixes the issue and removes some LoC at the same time. + +Fixes: dccc5c3b6f30 ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40") +Signed-off-by: Christophe JAILLET +Acked-by: Maxime Ripard +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/a8ae84bd2dc4b55fe428f8e20f31438bf8bb6762.1684089931.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/thermal/sun8i_thermal.c | 55 +++++++++++---------------------- + 1 file changed, 18 insertions(+), 37 deletions(-) + +diff --git a/drivers/thermal/sun8i_thermal.c b/drivers/thermal/sun8i_thermal.c +index e64d06d1328ce..80614b6adfac5 100644 +--- a/drivers/thermal/sun8i_thermal.c ++++ b/drivers/thermal/sun8i_thermal.c +@@ -319,6 +319,11 @@ static int sun8i_ths_calibrate(struct ths_device *tmdev) + return ret; + } + ++static void sun8i_ths_reset_control_assert(void *data) ++{ ++ reset_control_assert(data); ++} ++ + static int sun8i_ths_resource_init(struct ths_device *tmdev) + { + struct device *dev = tmdev->dev; +@@ -339,47 +344,35 @@ static int sun8i_ths_resource_init(struct ths_device *tmdev) + if (IS_ERR(tmdev->reset)) + return PTR_ERR(tmdev->reset); + +- tmdev->bus_clk = devm_clk_get(&pdev->dev, "bus"); ++ ret = reset_control_deassert(tmdev->reset); ++ if (ret) ++ return ret; ++ ++ ret = devm_add_action_or_reset(dev, sun8i_ths_reset_control_assert, ++ tmdev->reset); ++ if (ret) ++ return ret; ++ ++ tmdev->bus_clk = devm_clk_get_enabled(&pdev->dev, "bus"); + if (IS_ERR(tmdev->bus_clk)) + return PTR_ERR(tmdev->bus_clk); + } + + if (tmdev->chip->has_mod_clk) { +- tmdev->mod_clk = devm_clk_get(&pdev->dev, "mod"); ++ tmdev->mod_clk = devm_clk_get_enabled(&pdev->dev, "mod"); + if (IS_ERR(tmdev->mod_clk)) + return PTR_ERR(tmdev->mod_clk); + } + +- ret = reset_control_deassert(tmdev->reset); +- if (ret) +- return ret; +- +- ret = clk_prepare_enable(tmdev->bus_clk); +- if (ret) +- goto assert_reset; +- + ret = clk_set_rate(tmdev->mod_clk, 24000000); + if (ret) +- goto bus_disable; +- +- ret = clk_prepare_enable(tmdev->mod_clk); +- if (ret) +- goto bus_disable; ++ return ret; + + ret = sun8i_ths_calibrate(tmdev); + if (ret) +- goto mod_disable; ++ return ret; + + return 0; +- +-mod_disable: +- clk_disable_unprepare(tmdev->mod_clk); +-bus_disable: +- clk_disable_unprepare(tmdev->bus_clk); +-assert_reset: +- reset_control_assert(tmdev->reset); +- +- return ret; + } + + static int sun8i_h3_thermal_init(struct ths_device *tmdev) +@@ -530,17 +523,6 @@ static int sun8i_ths_probe(struct platform_device *pdev) + return 0; + } + +-static int sun8i_ths_remove(struct platform_device *pdev) +-{ +- struct ths_device *tmdev = platform_get_drvdata(pdev); +- +- clk_disable_unprepare(tmdev->mod_clk); +- clk_disable_unprepare(tmdev->bus_clk); +- reset_control_assert(tmdev->reset); +- +- return 0; +-} +- + static const struct ths_thermal_chip sun8i_a83t_ths = { + .sensor_num = 3, + .scale = 705, +@@ -642,7 +624,6 @@ MODULE_DEVICE_TABLE(of, of_ths_match); + + static struct platform_driver ths_driver = { + .probe = sun8i_ths_probe, +- .remove = sun8i_ths_remove, + .driver = { + .name = "sun8i-thermal", + .of_match_table = of_ths_match, +-- +2.39.2 + diff --git a/queue-6.1/tick-rcu-fix-bogus-ratelimit-condition.patch b/queue-6.1/tick-rcu-fix-bogus-ratelimit-condition.patch new file mode 100644 index 00000000000..89817a62b26 --- /dev/null +++ b/queue-6.1/tick-rcu-fix-bogus-ratelimit-condition.patch @@ -0,0 +1,46 @@ +From aec743e88f9876785f416f0bd4e3f99b255adb81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 00:12:53 +0800 +Subject: tick/rcu: Fix bogus ratelimit condition + +From: Wen Yang + +[ Upstream commit a7e282c77785c7eabf98836431b1f029481085ad ] + +The ratelimit logic in report_idle_softirq() is broken because the +exit condition is always true: + + static int ratelimit; + + if (ratelimit < 10) + return false; ---> always returns here + + ratelimit++; ---> no chance to run + +Make it check for >= 10 instead. + +Fixes: 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") +Signed-off-by: Wen Yang +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/tencent_5AAA3EEAB42095C9B7740BE62FBF9A67E007@qq.com +Signed-off-by: Sasha Levin +--- + kernel/time/tick-sched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index d6fb6a676bbbb..1ad89eec2a55f 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -1046,7 +1046,7 @@ static bool report_idle_softirq(void) + return false; + } + +- if (ratelimit < 10) ++ if (ratelimit >= 10) + return false; + + /* On RT, softirqs handling may be waiting on some lock */ +-- +2.39.2 + diff --git a/queue-6.1/tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch b/queue-6.1/tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch new file mode 100644 index 00000000000..dc63ede60be --- /dev/null +++ b/queue-6.1/tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch @@ -0,0 +1,47 @@ +From de58738024f628a7c7f21926ea8a0aac8a081484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 16:38:54 +0200 +Subject: tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). + +From: Sebastian Andrzej Siewior + +[ Upstream commit 2951580ba6adb082bb6b7154a5ecb24e7c1f7569 ] + +The trace output for the HRTIMER_MODE_.*_HARD modes is seen as a number +since these modes are not decoded. The author was not aware of the fancy +decoding function which makes the life easier. + +Extend decode_hrtimer_mode() with the additional HRTIMER_MODE_.*_HARD +modes. + +Fixes: ae6683d815895 ("hrtimer: Introduce HARD expiry mode") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Mukesh Ojha +Acked-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20230418143854.8vHWQKLM@linutronix.de +Signed-off-by: Sasha Levin +--- + include/trace/events/timer.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h +index 3e8619c72f774..b4bc2828fa09f 100644 +--- a/include/trace/events/timer.h ++++ b/include/trace/events/timer.h +@@ -158,7 +158,11 @@ DEFINE_EVENT(timer_class, timer_cancel, + { HRTIMER_MODE_ABS_SOFT, "ABS|SOFT" }, \ + { HRTIMER_MODE_REL_SOFT, "REL|SOFT" }, \ + { HRTIMER_MODE_ABS_PINNED_SOFT, "ABS|PINNED|SOFT" }, \ +- { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }) ++ { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }, \ ++ { HRTIMER_MODE_ABS_HARD, "ABS|HARD" }, \ ++ { HRTIMER_MODE_REL_HARD, "REL|HARD" }, \ ++ { HRTIMER_MODE_ABS_PINNED_HARD, "ABS|PINNED|HARD" }, \ ++ { HRTIMER_MODE_REL_PINNED_HARD, "REL|PINNED|HARD" }) + + /** + * hrtimer_init - called when the hrtimer is initialized +-- +2.39.2 + diff --git a/queue-6.1/vfio-mdev-move-the-compat_class-initialization-to-mo.patch b/queue-6.1/vfio-mdev-move-the-compat_class-initialization-to-mo.patch new file mode 100644 index 00000000000..60838acea34 --- /dev/null +++ b/queue-6.1/vfio-mdev-move-the-compat_class-initialization-to-mo.patch @@ -0,0 +1,116 @@ +From 3607a158ba683189915ab750eec8a0ced96ef13b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 15:36:42 +0200 +Subject: vfio/mdev: Move the compat_class initialization to module init + +From: Eric Farman + +[ Upstream commit ff598081e5b9d0bdd6874bfe340811bbb75b35e4 ] + +The pointer to mdev_bus_compat_class is statically defined at the top +of mdev_core, and was originally (commit 7b96953bc640 ("vfio: Mediated +device Core driver") serialized by the parent_list_lock. The blamed +commit removed this mutex, leaving the pointer initialization +unserialized. As a result, the creation of multiple MDEVs in parallel +(such as during boot) can encounter errors during the creation of the +sysfs entries, such as: + + [ 8.337509] sysfs: cannot create duplicate filename '/class/mdev_bus' + [ 8.337514] vfio_ccw 0.0.01d8: MDEV: Registered + [ 8.337516] CPU: 13 PID: 946 Comm: driverctl Not tainted 6.4.0-rc7 #20 + [ 8.337522] Hardware name: IBM 3906 M05 780 (LPAR) + [ 8.337525] Call Trace: + [ 8.337528] [<0000000162b0145a>] dump_stack_lvl+0x62/0x80 + [ 8.337540] [<00000001622aeb30>] sysfs_warn_dup+0x78/0x88 + [ 8.337549] [<00000001622aeca6>] sysfs_create_dir_ns+0xe6/0xf8 + [ 8.337552] [<0000000162b04504>] kobject_add_internal+0xf4/0x340 + [ 8.337557] [<0000000162b04d48>] kobject_add+0x78/0xd0 + [ 8.337561] [<0000000162b04e0a>] kobject_create_and_add+0x6a/0xb8 + [ 8.337565] [<00000001627a110e>] class_compat_register+0x5e/0x90 + [ 8.337572] [<000003ff7fd815da>] mdev_register_parent+0x102/0x130 [mdev] + [ 8.337581] [<000003ff7fdc7f2c>] vfio_ccw_sch_probe+0xe4/0x178 [vfio_ccw] + [ 8.337588] [<0000000162a7833c>] css_probe+0x44/0x80 + [ 8.337599] [<000000016279f4da>] really_probe+0xd2/0x460 + [ 8.337603] [<000000016279fa08>] driver_probe_device+0x40/0xf0 + [ 8.337606] [<000000016279fb78>] __device_attach_driver+0xc0/0x140 + [ 8.337610] [<000000016279cbe0>] bus_for_each_drv+0x90/0xd8 + [ 8.337618] [<00000001627a00b0>] __device_attach+0x110/0x190 + [ 8.337621] [<000000016279c7c8>] bus_rescan_devices_helper+0x60/0xb0 + [ 8.337626] [<000000016279cd48>] drivers_probe_store+0x48/0x80 + [ 8.337632] [<00000001622ac9b0>] kernfs_fop_write_iter+0x138/0x1f0 + [ 8.337635] [<00000001621e5e14>] vfs_write+0x1ac/0x2f8 + [ 8.337645] [<00000001621e61d8>] ksys_write+0x70/0x100 + [ 8.337650] [<0000000162b2bdc4>] __do_syscall+0x1d4/0x200 + [ 8.337656] [<0000000162b3c828>] system_call+0x70/0x98 + [ 8.337664] kobject: kobject_add_internal failed for mdev_bus with -EEXIST, don't try to register things with the same name in the same directory. + [ 8.337668] kobject: kobject_create_and_add: kobject_add error: -17 + [ 8.337674] vfio_ccw: probe of 0.0.01d9 failed with error -12 + [ 8.342941] vfio_ccw_mdev aeb9ca91-10c6-42bc-a168-320023570aea: Adding to iommu group 2 + +Move the initialization of the mdev_bus_compat_class pointer to the +init path, to match the cleanup in module exit. This way the code +in mdev_register_parent() can simply link the new parent to it, +rather than determining whether initialization is required first. + +Fixes: 89345d5177aa ("vfio/mdev: embedd struct mdev_parent in the parent data structure") +Reported-by: Alexander Egorenkov +Signed-off-by: Eric Farman +Reviewed-by: Kevin Tian +Reviewed-by: Christoph Hellwig +Reviewed-by: Tony Krowiak +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/20230626133642.2939168-1-farman@linux.ibm.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/mdev/mdev_core.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c +index 58f91b3bd670c..ed4737de45289 100644 +--- a/drivers/vfio/mdev/mdev_core.c ++++ b/drivers/vfio/mdev/mdev_core.c +@@ -72,12 +72,6 @@ int mdev_register_parent(struct mdev_parent *parent, struct device *dev, + parent->nr_types = nr_types; + atomic_set(&parent->available_instances, mdev_driver->max_instances); + +- if (!mdev_bus_compat_class) { +- mdev_bus_compat_class = class_compat_register("mdev_bus"); +- if (!mdev_bus_compat_class) +- return -ENOMEM; +- } +- + ret = parent_create_sysfs_files(parent); + if (ret) + return ret; +@@ -251,13 +245,24 @@ int mdev_device_remove(struct mdev_device *mdev) + + static int __init mdev_init(void) + { +- return bus_register(&mdev_bus_type); ++ int ret; ++ ++ ret = bus_register(&mdev_bus_type); ++ if (ret) ++ return ret; ++ ++ mdev_bus_compat_class = class_compat_register("mdev_bus"); ++ if (!mdev_bus_compat_class) { ++ bus_unregister(&mdev_bus_type); ++ return -ENOMEM; ++ } ++ ++ return 0; + } + + static void __exit mdev_exit(void) + { +- if (mdev_bus_compat_class) +- class_compat_unregister(mdev_bus_compat_class); ++ class_compat_unregister(mdev_bus_compat_class); + bus_unregister(&mdev_bus_type); + } + +-- +2.39.2 + diff --git a/queue-6.1/virt-sevguest-add-config_crypto-dependency.patch b/queue-6.1/virt-sevguest-add-config_crypto-dependency.patch new file mode 100644 index 00000000000..030ae69b6d4 --- /dev/null +++ b/queue-6.1/virt-sevguest-add-config_crypto-dependency.patch @@ -0,0 +1,44 @@ +From 943254c5989af95c94027318be7b7fd77d2f7337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 18:13:56 +0100 +Subject: virt: sevguest: Add CONFIG_CRYPTO dependency + +From: Arnd Bergmann + +[ Upstream commit 84b9b44b99780d35fe72ac63c4724f158771e898 ] + +This driver fails to link when CRYPTO is disabled, or in a loadable +module: + + WARNING: unmet direct dependencies detected for CRYPTO_GCM + WARNING: unmet direct dependencies detected for CRYPTO_AEAD2 + Depends on [m]: CRYPTO [=m] + Selected by [y]: + - SEV_GUEST [=y] && VIRT_DRIVERS [=y] && AMD_MEM_ENCRYPT [=y] + +x86_64-linux-ld: crypto/aead.o: in function `crypto_register_aeads': + +Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver") +Signed-off-by: Arnd Bergmann +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230117171416.2715125-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/virt/coco/sev-guest/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/virt/coco/sev-guest/Kconfig b/drivers/virt/coco/sev-guest/Kconfig +index f9db0799ae67c..da2d7ca531f0f 100644 +--- a/drivers/virt/coco/sev-guest/Kconfig ++++ b/drivers/virt/coco/sev-guest/Kconfig +@@ -2,6 +2,7 @@ config SEV_GUEST + tristate "AMD SEV Guest driver" + default m + depends on AMD_MEM_ENCRYPT ++ select CRYPTO + select CRYPTO_AEAD2 + select CRYPTO_GCM + help +-- +2.39.2 + diff --git a/queue-6.1/watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch b/queue-6.1/watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch new file mode 100644 index 00000000000..bb0ec3174e2 --- /dev/null +++ b/queue-6.1/watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch @@ -0,0 +1,89 @@ +From d7e3212fc3717c58db3fbc9555827e5857580496 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 10:18:25 -0700 +Subject: watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on + correct config + +From: Douglas Anderson + +[ Upstream commit 5e008df11c55228a86a1bae692cc2002503572c9 ] + +Patch series "watchdog/hardlockup: Add the buddy hardlockup detector", v5. + +This patch series adds the "buddy" hardlockup detector. In brief, the +buddy hardlockup detector can detect hardlockups without arch-level +support by having CPUs checkup on a "buddy" CPU periodically. + +Given the new design of this patch series, testing all combinations is +fairly difficult. I've attempted to make sure that all combinations of +CONFIG_ options are good, but it wouldn't surprise me if I missed +something. I apologize in advance and I'll do my best to fix any +problems that are found. + +This patch (of 18): + +The real watchdog_update_hrtimer_threshold() is defined in +kernel/watchdog_hld.c. That file is included if +CONFIG_HARDLOCKUP_DETECTOR_PERF and the function is defined in that file +if CONFIG_HARDLOCKUP_CHECK_TIMESTAMP. + +The dummy version of the function in "nmi.h" didn't get that quite right. +While this doesn't appear to be a huge deal, it's nice to make it +consistent. + +It doesn't break builds because CHECK_TIMESTAMP is only defined by x86 so +others don't get a double definition, and x86 uses perf lockup detector, +so it gets the out of line version. + +Link: https://lkml.kernel.org/r/20230519101840.v5.18.Ia44852044cdcb074f387e80df6b45e892965d4a1@changeid +Link: https://lkml.kernel.org/r/20230519101840.v5.1.I8cbb2f4fa740528fcfade4f5439b6cdcdd059251@changeid +Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes") +Signed-off-by: Douglas Anderson +Reviewed-by: Nicholas Piggin +Reviewed-by: Petr Mladek +Cc: Andi Kleen +Cc: Catalin Marinas +Cc: Chen-Yu Tsai +Cc: Christophe Leroy +Cc: Daniel Thompson +Cc: "David S. Miller" +Cc: Guenter Roeck +Cc: Ian Rogers +Cc: Lecopzer Chen +Cc: Marc Zyngier +Cc: Mark Rutland +Cc: Masayoshi Mizuma +Cc: Matthias Kaehlcke +Cc: Michael Ellerman +Cc: Pingfan Liu +Cc: Randy Dunlap +Cc: "Ravi V. Shankar" +Cc: Ricardo Neri +Cc: Stephane Eranian +Cc: Stephen Boyd +Cc: Sumit Garg +Cc: Tzung-Bi Shih +Cc: Will Deacon +Cc: Colin Cross +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/nmi.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index f700ff2df074e..0db377ff8f608 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -197,7 +197,7 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh); + #endif + + #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \ +- defined(CONFIG_HARDLOCKUP_DETECTOR) ++ defined(CONFIG_HARDLOCKUP_DETECTOR_PERF) + void watchdog_update_hrtimer_threshold(u64 period); + #else + static inline void watchdog_update_hrtimer_threshold(u64 period) { } +-- +2.39.2 + diff --git a/queue-6.1/watchdog-perf-more-properly-prevent-false-positives-.patch b/queue-6.1/watchdog-perf-more-properly-prevent-false-positives-.patch new file mode 100644 index 00000000000..ca3bba30900 --- /dev/null +++ b/queue-6.1/watchdog-perf-more-properly-prevent-false-positives-.patch @@ -0,0 +1,84 @@ +From 958e2e01451053824fbbf476b4e744245ed84624 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 10:18:26 -0700 +Subject: watchdog/perf: more properly prevent false positives with turbo modes + +From: Douglas Anderson + +[ Upstream commit 4379e59fe5665cfda737e45b8bf2f05321ef049c ] + +Currently, in the watchdog_overflow_callback() we first check to see if +the watchdog had been touched and _then_ we handle the workaround for +turbo mode. This order should be reversed. + +Specifically, "touching" the hardlockup detector's watchdog should avoid +lockups being detected for one period that should be roughly the same +regardless of whether we're running turbo or not. That means that we +should do the extra accounting for turbo _before_ we look at (and clear) +the global indicating that we've been touched. + +NOTE: this fix is made based on code inspection. I am not aware of any +reports where the old code would have generated false positives. That +being said, this order seems more correct and also makes it easier down +the line to share code with the "buddy" hardlockup detector. + +Link: https://lkml.kernel.org/r/20230519101840.v5.2.I843b0d1de3e096ba111a179f3adb16d576bef5c7@changeid +Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes") +Signed-off-by: Douglas Anderson +Cc: Andi Kleen +Cc: Catalin Marinas +Cc: Chen-Yu Tsai +Cc: Christophe Leroy +Cc: Colin Cross +Cc: Daniel Thompson +Cc: "David S. Miller" +Cc: Guenter Roeck +Cc: Ian Rogers +Cc: Lecopzer Chen +Cc: Marc Zyngier +Cc: Mark Rutland +Cc: Masayoshi Mizuma +Cc: Matthias Kaehlcke +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Petr Mladek +Cc: Pingfan Liu +Cc: Randy Dunlap +Cc: "Ravi V. Shankar" +Cc: Ricardo Neri +Cc: Stephane Eranian +Cc: Stephen Boyd +Cc: Sumit Garg +Cc: Tzung-Bi Shih +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/watchdog_hld.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c +index 247bf0b1582ca..1e8a49dc956e2 100644 +--- a/kernel/watchdog_hld.c ++++ b/kernel/watchdog_hld.c +@@ -114,14 +114,14 @@ static void watchdog_overflow_callback(struct perf_event *event, + /* Ensure the watchdog never gets throttled */ + event->hw.interrupts = 0; + ++ if (!watchdog_check_timestamp()) ++ return; ++ + if (__this_cpu_read(watchdog_nmi_touch) == true) { + __this_cpu_write(watchdog_nmi_touch, false); + return; + } + +- if (!watchdog_check_timestamp()) +- return; +- + /* check for a hardlockup + * This is done by making sure our timer interrupt + * is incrementing. The timer interrupt should have +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath10k-trigger-sta-disconnect-after-reconfig-co.patch b/queue-6.1/wifi-ath10k-trigger-sta-disconnect-after-reconfig-co.patch new file mode 100644 index 00000000000..6093a3215ce --- /dev/null +++ b/queue-6.1/wifi-ath10k-trigger-sta-disconnect-after-reconfig-co.patch @@ -0,0 +1,90 @@ +From 82c0f0cdca98d83591171e27836cff6e88712cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 12:41:08 +0300 +Subject: wifi: ath10k: Trigger STA disconnect after reconfig complete on + hardware restart + +From: Youghandhar Chintala + +[ Upstream commit 75bd32f5ce94bc365ba0b9b68bcf9de84a391d37 ] + +Currently, on WCN3990, the station disconnect after hardware recovery is +not working as expected. This is because of setting the +IEEE80211_SDATA_DISCONNECT_HW_RESTART flag very early in the hardware +recovery process even before the driver invokes ieee80211_hw_restart(). +On the contrary, mac80211 expects this flag to be set after +ieee80211_hw_restart() is invoked for it to trigger station disconnect. + +Set the IEEE80211_SDATA_DISCONNECT_HW_RESTART flag in +ath10k_reconfig_complete() instead to fix this. + +The other targets are not affected by this change, since the hardware +params flag is not set. + +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2.c10-00754-QCAHLSWMTPL-1 + +Fixes: 2c3fc50591ff ("ath10k: Trigger sta disconnect on hardware restart") +Signed-off-by: Youghandhar Chintala +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230518101515.3820-1-quic_youghand@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/core.c | 9 --------- + drivers/net/wireless/ath/ath10k/mac.c | 7 +++++++ + 2 files changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 5eb131ab916fd..b6052dcc45ebf 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -2504,7 +2504,6 @@ EXPORT_SYMBOL(ath10k_core_napi_sync_disable); + static void ath10k_core_restart(struct work_struct *work) + { + struct ath10k *ar = container_of(work, struct ath10k, restart_work); +- struct ath10k_vif *arvif; + int ret; + + set_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags); +@@ -2543,14 +2542,6 @@ static void ath10k_core_restart(struct work_struct *work) + ar->state = ATH10K_STATE_RESTARTING; + ath10k_halt(ar); + ath10k_scan_finish(ar); +- if (ar->hw_params.hw_restart_disconnect) { +- list_for_each_entry(arvif, &ar->arvifs, list) { +- if (arvif->is_up && +- arvif->vdev_type == WMI_VDEV_TYPE_STA) +- ieee80211_hw_restart_disconnect(arvif->vif); +- } +- } +- + ieee80211_restart_hw(ar->hw); + break; + case ATH10K_STATE_OFF: +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index ec8d5b29bc72c..f0729acdec50a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -8108,6 +8108,7 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw, + enum ieee80211_reconfig_type reconfig_type) + { + struct ath10k *ar = hw->priv; ++ struct ath10k_vif *arvif; + + if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART) + return; +@@ -8122,6 +8123,12 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw, + ar->state = ATH10K_STATE_ON; + ieee80211_wake_queues(ar->hw); + clear_bit(ATH10K_FLAG_RESTARTING, &ar->dev_flags); ++ if (ar->hw_params.hw_restart_disconnect) { ++ list_for_each_entry(arvif, &ar->arvifs, list) { ++ if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA) ++ ieee80211_hw_restart_disconnect(arvif->vif); ++ } ++ } + } + + mutex_unlock(&ar->conf_mutex); +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath11k-add-missing-check-for-ioremap.patch b/queue-6.1/wifi-ath11k-add-missing-check-for-ioremap.patch new file mode 100644 index 00000000000..0faf9c5d81f --- /dev/null +++ b/queue-6.1/wifi-ath11k-add-missing-check-for-ioremap.patch @@ -0,0 +1,48 @@ +From 995598c010c5fbe2d5f2bf3539e7aea76000c3d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 12:19:40 +0300 +Subject: wifi: ath11k: Add missing check for ioremap + +From: Jiasheng Jiang + +[ Upstream commit 16e0077e14a73866e9b0f4a6bf4ad3d4a5cb0f2a ] + +Add check for ioremap() and return the error if it fails in order to +guarantee the success of ioremap(), same as in +ath11k_qmi_load_file_target_mem(). + +Fixes: 6ac04bdc5edb ("ath11k: Use reserved host DDR addresses from DT for PCI devices") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230608022858.27405-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/qmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c +index 381c6b390dd78..01b02c03fa89c 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.c ++++ b/drivers/net/wireless/ath/ath11k/qmi.c +@@ -2058,6 +2058,9 @@ static int ath11k_qmi_assign_target_mem_chunk(struct ath11k_base *ab) + ab->qmi.target_mem[idx].iaddr = + ioremap(ab->qmi.target_mem[idx].paddr, + ab->qmi.target_mem[i].size); ++ if (!ab->qmi.target_mem[idx].iaddr) ++ return -EIO; ++ + ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size; + host_ddr_sz = ab->qmi.target_mem[i].size; + ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type; +@@ -2083,6 +2086,8 @@ static int ath11k_qmi_assign_target_mem_chunk(struct ath11k_base *ab) + ab->qmi.target_mem[idx].iaddr = + ioremap(ab->qmi.target_mem[idx].paddr, + ab->qmi.target_mem[i].size); ++ if (!ab->qmi.target_mem[idx].iaddr) ++ return -EIO; + } else { + ab->qmi.target_mem[idx].paddr = + ATH11K_QMI_CALDB_ADDRESS; +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch b/queue-6.1/wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch new file mode 100644 index 00000000000..724feab4486 --- /dev/null +++ b/queue-6.1/wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch @@ -0,0 +1,58 @@ +From 968fa1985486baa0eb283134a02d2402f13aefda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 17:35:01 +0300 +Subject: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit f24292e827088bba8de7158501ac25a59b064953 ] + +For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid +uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should +validate pkt_len before accessing the SKB. + +For example, the obtained SKB may have been badly constructed with +pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr +but after being processed in ath9k_htc_rx_msg() and passed to +ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI +command header which should be located inside its data payload. + +Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit +memory can be referenced. + +Tested on Qualcomm Atheros Communications AR9271 802.11n . + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-and-tested-by: syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230424183348.111355-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index 19345b8f7bfd5..d652c647d56b5 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -221,6 +221,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb, + if (unlikely(wmi->stopped)) + goto free_skb; + ++ /* Validate the obtained SKB. */ ++ if (unlikely(skb->len < sizeof(struct wmi_cmd_hdr))) ++ goto free_skb; ++ + hdr = (struct wmi_cmd_hdr *) skb->data; + cmd_id = be16_to_cpu(hdr->command_id); + +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch b/queue-6.1/wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch new file mode 100644 index 00000000000..1670c1a9efe --- /dev/null +++ b/queue-6.1/wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch @@ -0,0 +1,51 @@ +From f52437221fcfeb24157b521d19ea346412b9c82d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 16:46:55 +0300 +Subject: wifi: ath9k: convert msecs to jiffies where needed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Antipov + +[ Upstream commit 2aa083acea9f61be3280184384551178f510ff51 ] + +Since 'ieee80211_queue_delayed_work()' expects timeout in +jiffies and not milliseconds, 'msecs_to_jiffies()' should +be used in 'ath_restart_work()' and '__ath9k_flush()'. + +Fixes: d63ffc45c5d3 ("ath9k: rename tx_complete_work to hw_check_work") +Signed-off-by: Dmitry Antipov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230613134655.248728-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 7f9f06ea8a05f..6360d3356e256 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -203,7 +203,7 @@ void ath_cancel_work(struct ath_softc *sc) + void ath_restart_work(struct ath_softc *sc) + { + ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work, +- ATH_HW_CHECK_POLL_INT); ++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT)); + + if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah)) + ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work, +@@ -2240,7 +2240,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop, + } + + ieee80211_queue_delayed_work(hw, &sc->hw_check_work, +- ATH_HW_CHECK_POLL_INT); ++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT)); + } + + static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw) +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch b/queue-6.1/wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch new file mode 100644 index 00000000000..3c7676d33dc --- /dev/null +++ b/queue-6.1/wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch @@ -0,0 +1,54 @@ +From b88dce85085c13d65bc987731600f45cd49ab225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 18:03:17 +0300 +Subject: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 061b0cb9327b80d7a0f63a33e7c3e2a91a71f142 ] + +A bad USB device is able to construct a service connection response +message with target endpoint being ENDPOINT0 which is reserved for +HTC_CTRL_RSVD_SVC and should not be modified to be used for any other +services. + +Reject such service connection responses. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-by: syzbot+b68fbebe56d8362907e8@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230516150427.79469-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index fe62ff668f757..99667aba289df 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target, + + if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) { + epid = svc_rspmsg->endpoint_id; +- if (epid < 0 || epid >= ENDPOINT_MAX) ++ ++ /* Check that the received epid for the endpoint to attach ++ * a new service is valid. ENDPOINT0 can't be used here as it ++ * is already reserved for HTC_CTRL_RSVD_SVC service and thus ++ * should not be modified. ++ */ ++ if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX) + return; + + service_id = be16_to_cpu(svc_rspmsg->service_id); +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch b/queue-6.1/wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch new file mode 100644 index 00000000000..752c5dc68d6 --- /dev/null +++ b/queue-6.1/wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch @@ -0,0 +1,95 @@ +From 8a1b505a0a34350d02700e4d7c8b35a9081f7f26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 17:35:00 +0300 +Subject: wifi: ath9k: fix AR9003 mac hardware hang check register offset + calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peter Seiderer + +[ Upstream commit 3e56c80931c7615250fe4bf83f93b57881969266 ] + +Fix ath9k_hw_verify_hang()/ar9003_hw_detect_mac_hang() register offset +calculation (do not overflow the shift for the second register/queues +above five, use the register layout described in the comments above +ath9k_hw_verify_hang() instead). + +Fixes: 222e04830ff0 ("ath9k: Fix MAC HW hang check for AR9003") + +Reported-by: Gregg Wonderly +Link: https://lore.kernel.org/linux-wireless/E3A9C354-0CB7-420C-ADEF-F0177FB722F4@seqtechllc.com/ +Signed-off-by: Peter Seiderer +Acked-by: Toke Høiland-Jørgensen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230422212423.26065-1-ps.report@gmx.net +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_hw.c | 27 ++++++++++++++-------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c +index 42f00a2a8c800..cf5648188459c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c +@@ -1099,17 +1099,22 @@ static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue) + { + u32 dma_dbg_chain, dma_dbg_complete; + u8 dcu_chain_state, dcu_complete_state; ++ unsigned int dbg_reg, reg_offset; + int i; + +- for (i = 0; i < NUM_STATUS_READS; i++) { +- if (queue < 6) +- dma_dbg_chain = REG_READ(ah, AR_DMADBG_4); +- else +- dma_dbg_chain = REG_READ(ah, AR_DMADBG_5); ++ if (queue < 6) { ++ dbg_reg = AR_DMADBG_4; ++ reg_offset = queue * 5; ++ } else { ++ dbg_reg = AR_DMADBG_5; ++ reg_offset = (queue - 6) * 5; ++ } + ++ for (i = 0; i < NUM_STATUS_READS; i++) { ++ dma_dbg_chain = REG_READ(ah, dbg_reg); + dma_dbg_complete = REG_READ(ah, AR_DMADBG_6); + +- dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f; ++ dcu_chain_state = (dma_dbg_chain >> reg_offset) & 0x1f; + dcu_complete_state = dma_dbg_complete & 0x3; + + if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1)) +@@ -1128,6 +1133,7 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah) + u8 dcu_chain_state, dcu_complete_state; + bool dcu_wait_frdone = false; + unsigned long chk_dcu = 0; ++ unsigned int reg_offset; + unsigned int i = 0; + + dma_dbg_4 = REG_READ(ah, AR_DMADBG_4); +@@ -1139,12 +1145,15 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah) + goto exit; + + for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) { +- if (i < 6) ++ if (i < 6) { + chk_dbg = dma_dbg_4; +- else ++ reg_offset = i * 5; ++ } else { + chk_dbg = dma_dbg_5; ++ reg_offset = (i - 6) * 5; ++ } + +- dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f; ++ dcu_chain_state = (chk_dbg >> reg_offset) & 0x1f; + if (dcu_chain_state == 0x6) { + dcu_wait_frdone = true; + chk_dcu |= BIT(i); +-- +2.39.2 + diff --git a/queue-6.1/wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch b/queue-6.1/wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch new file mode 100644 index 00000000000..f48b935aa25 --- /dev/null +++ b/queue-6.1/wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch @@ -0,0 +1,111 @@ +From 63520b05ce2a1923d422bfccdb2ecc7af2e91bdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:37:44 +0200 +Subject: wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Remi Pommarel + +[ Upstream commit 75086cc6dee046e3fbb3dba148b376d8802f83bc ] + +On EDMA capable hardware, ath9k_txq_list_has_key() can enter infinite +loop if it is called while all txq_fifos have packets that use different +key that the one we are looking for. Fix it by exiting the loop if all +txq_fifos have been checked already. + +Because this loop is called under spin_lock_bh() (see ath_txq_lock) it +causes the following rcu stall: + +rcu: INFO: rcu_sched self-detected stall on CPU +ath10k_pci 0000:01:00.0: failed to read temperature -11 +rcu: 1-....: (5254 ticks this GP) idle=189/1/0x4000000000000002 softirq=8442983/8442984 fqs=2579 + (t=5257 jiffies g=17983297 q=334) +Task dump for CPU 1: +task:hostapd state:R running task stack: 0 pid: 297 ppid: 289 flags:0x0000000a +Call trace: + dump_backtrace+0x0/0x170 + show_stack+0x1c/0x24 + sched_show_task+0x140/0x170 + dump_cpu_task+0x48/0x54 + rcu_dump_cpu_stacks+0xf0/0x134 + rcu_sched_clock_irq+0x8d8/0x9fc + update_process_times+0xa0/0xec + tick_sched_timer+0x5c/0xd0 + __hrtimer_run_queues+0x154/0x320 + hrtimer_interrupt+0x120/0x2f0 + arch_timer_handler_virt+0x38/0x44 + handle_percpu_devid_irq+0x9c/0x1e0 + handle_domain_irq+0x64/0x90 + gic_handle_irq+0x78/0xb0 + call_on_irq_stack+0x28/0x38 + do_interrupt_handler+0x54/0x5c + el1_interrupt+0x2c/0x4c + el1h_64_irq_handler+0x14/0x1c + el1h_64_irq+0x74/0x78 + ath9k_txq_has_key+0x1bc/0x250 [ath9k] + ath9k_set_key+0x1cc/0x3dc [ath9k] + drv_set_key+0x78/0x170 + ieee80211_key_replace+0x564/0x6cc + ieee80211_key_link+0x174/0x220 + ieee80211_add_key+0x11c/0x300 + nl80211_new_key+0x12c/0x330 + genl_family_rcv_msg_doit+0xbc/0x11c + genl_rcv_msg+0xd8/0x1c4 + netlink_rcv_skb+0x40/0x100 + genl_rcv+0x3c/0x50 + netlink_unicast+0x1ec/0x2c0 + netlink_sendmsg+0x198/0x3c0 + ____sys_sendmsg+0x210/0x250 + ___sys_sendmsg+0x78/0xc4 + __sys_sendmsg+0x4c/0x90 + __arm64_sys_sendmsg+0x28/0x30 + invoke_syscall.constprop.0+0x60/0x100 + do_el0_svc+0x48/0xd0 + el0_svc+0x14/0x50 + el0t_64_sync_handler+0xa8/0xb0 + el0t_64_sync+0x158/0x15c + +This rcu stall is hard to reproduce as is, but changing ATH_TXFIFO_DEPTH +from 8 to 2 makes it reasonably easy to reproduce. + +Fixes: ca2848022c12 ("ath9k: Postpone key cache entry deletion for TXQ frames reference it") +Signed-off-by: Remi Pommarel +Tested-by: Nicolas Escande +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230609093744.1985-1-repk@triplefau.lt +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/main.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index a4197c14f0a92..7f9f06ea8a05f 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -850,7 +850,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) + static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) + { + struct ath_hw *ah = sc->sc_ah; +- int i; ++ int i, j; + struct ath_txq *txq; + bool key_in_use = false; + +@@ -868,8 +868,9 @@ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) + if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { + int idx = txq->txq_tailidx; + +- while (!key_in_use && +- !list_empty(&txq->txq_fifo[idx])) { ++ for (j = 0; !key_in_use && ++ !list_empty(&txq->txq_fifo[idx]) && ++ j < ATH_TXFIFO_DEPTH; j++) { + key_in_use = ath9k_txq_list_has_key( + &txq->txq_fifo[idx], keyix); + INCR(idx, ATH_TXFIFO_DEPTH); +-- +2.39.2 + diff --git a/queue-6.1/wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch b/queue-6.1/wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch new file mode 100644 index 00000000000..b53b9c12a73 --- /dev/null +++ b/queue-6.1/wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch @@ -0,0 +1,59 @@ +From 97f50db3dc68fe69b87fcb96900afb8f0813199d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:53:14 +0200 +Subject: wifi: atmel: Fix an error handling path in atmel_probe() + +From: Christophe JAILLET + +[ Upstream commit 6b92e4351a29af52c285fe235e6e4d1a75de04b2 ] + +Should atmel_config() fail, some resources need to be released as already +done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +atmel_probe(), not atmel_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1e65f174607a83348034197fa7d603bab10ba4a9.1684569156.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/atmel/atmel_cs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/atmel/atmel_cs.c b/drivers/net/wireless/atmel/atmel_cs.c +index 453bb84cb3386..58bba9875d366 100644 +--- a/drivers/net/wireless/atmel/atmel_cs.c ++++ b/drivers/net/wireless/atmel/atmel_cs.c +@@ -72,6 +72,7 @@ struct local_info { + static int atmel_probe(struct pcmcia_device *p_dev) + { + struct local_info *local; ++ int ret; + + dev_dbg(&p_dev->dev, "atmel_attach()\n"); + +@@ -82,8 +83,16 @@ static int atmel_probe(struct pcmcia_device *p_dev) + + p_dev->priv = local; + +- return atmel_config(p_dev); +-} /* atmel_attach */ ++ ret = atmel_config(p_dev); ++ if (ret) ++ goto err_free_priv; ++ ++ return 0; ++ ++err_free_priv: ++ kfree(p_dev->priv); ++ return ret; ++} + + static void atmel_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-6.1/wifi-cfg80211-drop-incorrect-nontransmitted-bss-upda.patch b/queue-6.1/wifi-cfg80211-drop-incorrect-nontransmitted-bss-upda.patch new file mode 100644 index 00000000000..35cf7b41be2 --- /dev/null +++ b/queue-6.1/wifi-cfg80211-drop-incorrect-nontransmitted-bss-upda.patch @@ -0,0 +1,218 @@ +From 8209d65a47db44640b47173eae3a7bb9272d0fca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 09:54:04 +0300 +Subject: wifi: cfg80211: drop incorrect nontransmitted BSS update code + +From: Benjamin Berg + +[ Upstream commit 39432f8a3752a87a53fd8d5e51824a43aaae5cab ] + +The removed code ran for any BSS that was not included in the MBSSID +element in order to update it. However, instead of using the correct +inheritance rules, it would simply copy the elements from the +transmitting AP. The result is that we would report incorrect elements +in this case. + +After some discussions, it seems that there are likely not even APs +actually using this feature. Either way, removing the code decreases +complexity and makes the cfg80211 behaviour more correct. + +Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") +Signed-off-by: Benjamin Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230616094949.cfd6d8db1f26.Ia1044902b86cd7d366400a4bfb93691b8f05d68c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 154 ++++---------------------------------------- + 1 file changed, 11 insertions(+), 143 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 9fcb6f06b8cbe..efe9283e98935 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -2308,118 +2308,6 @@ cfg80211_inform_bss_data(struct wiphy *wiphy, + } + EXPORT_SYMBOL(cfg80211_inform_bss_data); + +-static void +-cfg80211_parse_mbssid_frame_data(struct wiphy *wiphy, +- struct cfg80211_inform_bss *data, +- struct ieee80211_mgmt *mgmt, size_t len, +- struct cfg80211_non_tx_bss *non_tx_data, +- gfp_t gfp) +-{ +- enum cfg80211_bss_frame_type ftype; +- const u8 *ie = mgmt->u.probe_resp.variable; +- size_t ielen = len - offsetof(struct ieee80211_mgmt, +- u.probe_resp.variable); +- +- ftype = ieee80211_is_beacon(mgmt->frame_control) ? +- CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP; +- +- cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid, +- le64_to_cpu(mgmt->u.probe_resp.timestamp), +- le16_to_cpu(mgmt->u.probe_resp.beacon_int), +- ie, ielen, non_tx_data, gfp); +-} +- +-static void +-cfg80211_update_notlisted_nontrans(struct wiphy *wiphy, +- struct cfg80211_bss *nontrans_bss, +- struct ieee80211_mgmt *mgmt, size_t len) +-{ +- u8 *ie, *new_ie, *pos; +- const struct element *nontrans_ssid; +- const u8 *trans_ssid, *mbssid; +- size_t ielen = len - offsetof(struct ieee80211_mgmt, +- u.probe_resp.variable); +- size_t new_ie_len; +- struct cfg80211_bss_ies *new_ies; +- const struct cfg80211_bss_ies *old; +- size_t cpy_len; +- +- lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock); +- +- ie = mgmt->u.probe_resp.variable; +- +- new_ie_len = ielen; +- trans_ssid = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); +- if (!trans_ssid) +- return; +- new_ie_len -= trans_ssid[1]; +- mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen); +- /* +- * It's not valid to have the MBSSID element before SSID +- * ignore if that happens - the code below assumes it is +- * after (while copying things inbetween). +- */ +- if (!mbssid || mbssid < trans_ssid) +- return; +- new_ie_len -= mbssid[1]; +- +- nontrans_ssid = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID); +- if (!nontrans_ssid) +- return; +- +- new_ie_len += nontrans_ssid->datalen; +- +- /* generate new ie for nontrans BSS +- * 1. replace SSID with nontrans BSS' SSID +- * 2. skip MBSSID IE +- */ +- new_ie = kzalloc(new_ie_len, GFP_ATOMIC); +- if (!new_ie) +- return; +- +- new_ies = kzalloc(sizeof(*new_ies) + new_ie_len, GFP_ATOMIC); +- if (!new_ies) +- goto out_free; +- +- pos = new_ie; +- +- /* copy the nontransmitted SSID */ +- cpy_len = nontrans_ssid->datalen + 2; +- memcpy(pos, nontrans_ssid, cpy_len); +- pos += cpy_len; +- /* copy the IEs between SSID and MBSSID */ +- cpy_len = trans_ssid[1] + 2; +- memcpy(pos, (trans_ssid + cpy_len), (mbssid - (trans_ssid + cpy_len))); +- pos += (mbssid - (trans_ssid + cpy_len)); +- /* copy the IEs after MBSSID */ +- cpy_len = mbssid[1] + 2; +- memcpy(pos, mbssid + cpy_len, ((ie + ielen) - (mbssid + cpy_len))); +- +- /* update ie */ +- new_ies->len = new_ie_len; +- new_ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp); +- new_ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control); +- memcpy(new_ies->data, new_ie, new_ie_len); +- if (ieee80211_is_probe_resp(mgmt->frame_control)) { +- old = rcu_access_pointer(nontrans_bss->proberesp_ies); +- rcu_assign_pointer(nontrans_bss->proberesp_ies, new_ies); +- rcu_assign_pointer(nontrans_bss->ies, new_ies); +- if (old) +- kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); +- } else { +- old = rcu_access_pointer(nontrans_bss->beacon_ies); +- rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies); +- cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss), +- new_ies, old); +- rcu_assign_pointer(nontrans_bss->ies, new_ies); +- if (old) +- kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); +- } +- +-out_free: +- kfree(new_ie); +-} +- + /* cfg80211_inform_bss_width_frame helper */ + static struct cfg80211_bss * + cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy, +@@ -2561,51 +2449,31 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy, + struct ieee80211_mgmt *mgmt, size_t len, + gfp_t gfp) + { +- struct cfg80211_bss *res, *tmp_bss; ++ struct cfg80211_bss *res; + const u8 *ie = mgmt->u.probe_resp.variable; +- const struct cfg80211_bss_ies *ies1, *ies2; + size_t ielen = len - offsetof(struct ieee80211_mgmt, + u.probe_resp.variable); ++ enum cfg80211_bss_frame_type ftype; + struct cfg80211_non_tx_bss non_tx_data = {}; + + res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt, + len, gfp); ++ if (!res) ++ return NULL; + + /* don't do any further MBSSID handling for S1G */ + if (ieee80211_is_s1g_beacon(mgmt->frame_control)) + return res; + +- if (!res || !wiphy->support_mbssid || +- !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) +- return res; +- if (wiphy->support_only_he_mbssid && +- !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ie, ielen)) +- return res; +- ++ ftype = ieee80211_is_beacon(mgmt->frame_control) ? ++ CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP; + non_tx_data.tx_bss = res; +- /* process each non-transmitting bss */ +- cfg80211_parse_mbssid_frame_data(wiphy, data, mgmt, len, +- &non_tx_data, gfp); +- +- spin_lock_bh(&wiphy_to_rdev(wiphy)->bss_lock); + +- /* check if the res has other nontransmitting bss which is not +- * in MBSSID IE +- */ +- ies1 = rcu_access_pointer(res->ies); +- +- /* go through nontrans_list, if the timestamp of the BSS is +- * earlier than the timestamp of the transmitting BSS then +- * update it +- */ +- list_for_each_entry(tmp_bss, &res->nontrans_list, +- nontrans_list) { +- ies2 = rcu_access_pointer(tmp_bss->ies); +- if (ies2->tsf < ies1->tsf) +- cfg80211_update_notlisted_nontrans(wiphy, tmp_bss, +- mgmt, len); +- } +- spin_unlock_bh(&wiphy_to_rdev(wiphy)->bss_lock); ++ /* process each non-transmitting bss */ ++ cfg80211_parse_mbssid_data(wiphy, data, ftype, mgmt->bssid, ++ le64_to_cpu(mgmt->u.probe_resp.timestamp), ++ le16_to_cpu(mgmt->u.probe_resp.beacon_int), ++ ie, ielen, &non_tx_data, gfp); + + return res; + } +-- +2.39.2 + diff --git a/queue-6.1/wifi-cfg80211-fix-regulatory-disconnect-with-ocb-nan.patch b/queue-6.1/wifi-cfg80211-fix-regulatory-disconnect-with-ocb-nan.patch new file mode 100644 index 00000000000..c7eb897bbdb --- /dev/null +++ b/queue-6.1/wifi-cfg80211-fix-regulatory-disconnect-with-ocb-nan.patch @@ -0,0 +1,123 @@ +From f7d9ff206869276e75b9682adb2e205857c353a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 22:28:45 +0200 +Subject: wifi: cfg80211: fix regulatory disconnect with OCB/NAN + +From: Johannes Berg + +[ Upstream commit e8c2af660ba0790afd14d5cbc2fd05c6dc85e207 ] + +Since regulatory disconnect was added, OCB and NAN interface +types were added, which made it completely unusable for any +driver that allowed OCB/NAN. Add OCB/NAN (though NAN doesn't +do anything, we don't have any info) and also remove all the +logic that opts out, so it won't be broken again if/when new +interface types are added. + +Fixes: 6e0bd6c35b02 ("cfg80211: 802.11p OCB mode handling") +Fixes: cb3b7d87652a ("cfg80211: add start / stop NAN commands") +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20230616222844.2794d1625a26.I8e78a3789a29e6149447b3139df724a6f1b46fc3@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/regulatory.h | 13 +------------ + net/wireless/core.c | 16 ---------------- + net/wireless/reg.c | 14 ++++++++++---- + 3 files changed, 11 insertions(+), 32 deletions(-) + +diff --git a/include/net/regulatory.h b/include/net/regulatory.h +index 896191f420d50..b2cb4a9eb04dc 100644 +--- a/include/net/regulatory.h ++++ b/include/net/regulatory.h +@@ -140,17 +140,6 @@ struct regulatory_request { + * otherwise initiating radiation is not allowed. This will enable the + * relaxations enabled under the CFG80211_REG_RELAX_NO_IR configuration + * option +- * @REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make sure +- * all interfaces on this wiphy reside on allowed channels. If this flag +- * is not set, upon a regdomain change, the interfaces are given a grace +- * period (currently 60 seconds) to disconnect or move to an allowed +- * channel. Interfaces on forbidden channels are forcibly disconnected. +- * Currently these types of interfaces are supported for enforcement: +- * NL80211_IFTYPE_ADHOC, NL80211_IFTYPE_STATION, NL80211_IFTYPE_AP, +- * NL80211_IFTYPE_AP_VLAN, NL80211_IFTYPE_MONITOR, +- * NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO, +- * NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device +- * includes any modes unsupported for enforcement checking. + * @REGULATORY_WIPHY_SELF_MANAGED: for devices that employ wiphy-specific + * regdom management. These devices will ignore all regdom changes not + * originating from their own wiphy. +@@ -177,7 +166,7 @@ enum ieee80211_regulatory_flags { + REGULATORY_COUNTRY_IE_FOLLOW_POWER = BIT(3), + REGULATORY_COUNTRY_IE_IGNORE = BIT(4), + REGULATORY_ENABLE_RELAX_NO_IR = BIT(5), +- REGULATORY_IGNORE_STALE_KICKOFF = BIT(6), ++ /* reuse bit 6 next time */ + REGULATORY_WIPHY_SELF_MANAGED = BIT(7), + }; + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index b3ec9eaec36b3..609b79fe4a748 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -721,22 +721,6 @@ int wiphy_register(struct wiphy *wiphy) + return -EINVAL; + } + +- /* +- * if a wiphy has unsupported modes for regulatory channel enforcement, +- * opt-out of enforcement checking +- */ +- if (wiphy->interface_modes & ~(BIT(NL80211_IFTYPE_STATION) | +- BIT(NL80211_IFTYPE_P2P_CLIENT) | +- BIT(NL80211_IFTYPE_AP) | +- BIT(NL80211_IFTYPE_MESH_POINT) | +- BIT(NL80211_IFTYPE_P2P_GO) | +- BIT(NL80211_IFTYPE_ADHOC) | +- BIT(NL80211_IFTYPE_P2P_DEVICE) | +- BIT(NL80211_IFTYPE_NAN) | +- BIT(NL80211_IFTYPE_AP_VLAN) | +- BIT(NL80211_IFTYPE_MONITOR))) +- wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF; +- + if (WARN_ON((wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) && + (wiphy->regulatory_flags & + (REGULATORY_CUSTOM_REG | +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 522180919a1a3..3b44fa59dbbab 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2429,9 +2429,17 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev) + case NL80211_IFTYPE_P2P_DEVICE: + /* no enforcement required */ + break; ++ case NL80211_IFTYPE_OCB: ++ if (!wdev->u.ocb.chandef.chan) ++ continue; ++ chandef = wdev->u.ocb.chandef; ++ break; ++ case NL80211_IFTYPE_NAN: ++ /* we have no info, but NAN is also pretty universal */ ++ continue; + default: + /* others not implemented for now */ +- WARN_ON(1); ++ WARN_ON_ONCE(1); + break; + } + +@@ -2490,9 +2498,7 @@ static void reg_check_chans_work(struct work_struct *work) + rtnl_lock(); + + list_for_each_entry(rdev, &cfg80211_rdev_list, list) +- if (!(rdev->wiphy.regulatory_flags & +- REGULATORY_IGNORE_STALE_KICKOFF)) +- reg_leave_invalid_chans(&rdev->wiphy); ++ reg_leave_invalid_chans(&rdev->wiphy); + + rtnl_unlock(); + } +-- +2.39.2 + diff --git a/queue-6.1/wifi-cfg80211-mac80211-fix-ml-element-common-size-ca.patch b/queue-6.1/wifi-cfg80211-mac80211-fix-ml-element-common-size-ca.patch new file mode 100644 index 00000000000..c015a740b68 --- /dev/null +++ b/queue-6.1/wifi-cfg80211-mac80211-fix-ml-element-common-size-ca.patch @@ -0,0 +1,51 @@ +From c3fb19dde537b842a67b161d64e56c741265ccc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 17:23:09 +0300 +Subject: wifi: cfg80211/mac80211: Fix ML element common size calculation + +From: Ilan Peer + +[ Upstream commit 1403b109c9a5244dc6ab79154f04eecc209ef3d2 ] + +The common size is part of the length in the data +so don't add it again. + +Signed-off-by: Ilan Peer +Signed-off-by: Johannes Berg +Stable-dep-of: ce6e1f600b0c ("wifi: ieee80211: Fix the common size calculation for reconfiguration ML") +Signed-off-by: Sasha Levin +--- + include/linux/ieee80211.h | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index d3088666f3f44..470fafce2e707 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -4573,18 +4573,17 @@ static inline u8 ieee80211_mle_common_size(const u8 *data) + + switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) { + case IEEE80211_ML_CONTROL_TYPE_BASIC: +- common += sizeof(struct ieee80211_mle_basic_common_info); +- break; + case IEEE80211_ML_CONTROL_TYPE_PREQ: +- common += sizeof(struct ieee80211_mle_preq_common_info); ++ case IEEE80211_ML_CONTROL_TYPE_TDLS: ++ /* ++ * The length is the first octet pointed by mle->variable so no ++ * need to add anything ++ */ + break; + case IEEE80211_ML_CONTROL_TYPE_RECONF: + if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR) + common += ETH_ALEN; + return common; +- case IEEE80211_ML_CONTROL_TYPE_TDLS: +- common += sizeof(struct ieee80211_mle_tdls_common_info); +- break; + case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: + if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR) + common += ETH_ALEN; +-- +2.39.2 + diff --git a/queue-6.1/wifi-cfg80211-rewrite-merging-of-inherited-elements.patch b/queue-6.1/wifi-cfg80211-rewrite-merging-of-inherited-elements.patch new file mode 100644 index 00000000000..bcf5471422b --- /dev/null +++ b/queue-6.1/wifi-cfg80211-rewrite-merging-of-inherited-elements.patch @@ -0,0 +1,290 @@ +From d680b674f4012918be4944f06291bec140fbbce0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 09:54:03 +0300 +Subject: wifi: cfg80211: rewrite merging of inherited elements + +From: Benjamin Berg + +[ Upstream commit dfd9aa3e7a456d57b18021d66472ab7ff8373ab7 ] + +The cfg80211_gen_new_ie function merges the IEs using inheritance rules. +Rewrite this function to fix issues around inheritance rules. In +particular, vendor elements do not require any special handling, as they +are either all inherited or overridden by the subprofile. +Also, add fragmentation handling as this may be needed in some cases. + +This also changes the function to not require making a copy. The new +version could be optimized a bit by explicitly tracking which IEs have +been handled already rather than looking that up again every time. + +Note that a small behavioural change is the removal of the SSID special +handling. This should be fine for the MBSSID element, as the SSID must +be included in the subelement. + +Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") +Signed-off-by: Benjamin Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230616094949.bc6152e146db.I2b5f3bc45085e1901e5b5192a674436adaf94748@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 213 ++++++++++++++++++++++++++------------------ + 1 file changed, 124 insertions(+), 89 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 6c2b73c0d36e8..9fcb6f06b8cbe 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -262,117 +262,152 @@ bool cfg80211_is_element_inherited(const struct element *elem, + } + EXPORT_SYMBOL(cfg80211_is_element_inherited); + +-static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, +- const u8 *subelement, size_t subie_len, +- u8 *new_ie, gfp_t gfp) ++static size_t cfg80211_copy_elem_with_frags(const struct element *elem, ++ const u8 *ie, size_t ie_len, ++ u8 **pos, u8 *buf, size_t buf_len) + { +- u8 *pos, *tmp; +- const u8 *tmp_old, *tmp_new; +- const struct element *non_inherit_elem; +- u8 *sub_copy; ++ if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len || ++ elem->data + elem->datalen > ie + ie_len)) ++ return 0; + +- /* copy subelement as we need to change its content to +- * mark an ie after it is processed. +- */ +- sub_copy = kmemdup(subelement, subie_len, gfp); +- if (!sub_copy) ++ if (elem->datalen + 2 > buf + buf_len - *pos) + return 0; + +- pos = &new_ie[0]; ++ memcpy(*pos, elem, elem->datalen + 2); ++ *pos += elem->datalen + 2; + +- /* set new ssid */ +- tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len); +- if (tmp_new) { +- memcpy(pos, tmp_new, tmp_new[1] + 2); +- pos += (tmp_new[1] + 2); ++ /* Finish if it is not fragmented */ ++ if (elem->datalen != 255) ++ return *pos - buf; ++ ++ ie_len = ie + ie_len - elem->data - elem->datalen; ++ ie = (const u8 *)elem->data + elem->datalen; ++ ++ for_each_element(elem, ie, ie_len) { ++ if (elem->id != WLAN_EID_FRAGMENT) ++ break; ++ ++ if (elem->datalen + 2 > buf + buf_len - *pos) ++ return 0; ++ ++ memcpy(*pos, elem, elem->datalen + 2); ++ *pos += elem->datalen + 2; ++ ++ if (elem->datalen != 255) ++ break; + } + +- /* get non inheritance list if exists */ +- non_inherit_elem = +- cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, +- sub_copy, subie_len); ++ return *pos - buf; ++} + +- /* go through IEs in ie (skip SSID) and subelement, +- * merge them into new_ie ++static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, ++ const u8 *subie, size_t subie_len, ++ u8 *new_ie, size_t new_ie_len) ++{ ++ const struct element *non_inherit_elem, *parent, *sub; ++ u8 *pos = new_ie; ++ u8 id, ext_id; ++ unsigned int match_len; ++ ++ non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, ++ subie, subie_len); ++ ++ /* We copy the elements one by one from the parent to the generated ++ * elements. ++ * If they are not inherited (included in subie or in the non ++ * inheritance element), then we copy all occurrences the first time ++ * we see this element type. + */ +- tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); +- tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie; +- +- while (tmp_old + 2 - ie <= ielen && +- tmp_old + tmp_old[1] + 2 - ie <= ielen) { +- if (tmp_old[0] == 0) { +- tmp_old++; ++ for_each_element(parent, ie, ielen) { ++ if (parent->id == WLAN_EID_FRAGMENT) + continue; ++ ++ if (parent->id == WLAN_EID_EXTENSION) { ++ if (parent->datalen < 1) ++ continue; ++ ++ id = WLAN_EID_EXTENSION; ++ ext_id = parent->data[0]; ++ match_len = 1; ++ } else { ++ id = parent->id; ++ match_len = 0; + } + +- if (tmp_old[0] == WLAN_EID_EXTENSION) +- tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy, +- subie_len); +- else +- tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy, +- subie_len); ++ /* Find first occurrence in subie */ ++ sub = cfg80211_find_elem_match(id, subie, subie_len, ++ &ext_id, match_len, 0); + +- if (!tmp) { +- const struct element *old_elem = (void *)tmp_old; ++ /* Copy from parent if not in subie and inherited */ ++ if (!sub && ++ cfg80211_is_element_inherited(parent, non_inherit_elem)) { ++ if (!cfg80211_copy_elem_with_frags(parent, ++ ie, ielen, ++ &pos, new_ie, ++ new_ie_len)) ++ return 0; + +- /* ie in old ie but not in subelement */ +- if (cfg80211_is_element_inherited(old_elem, +- non_inherit_elem)) { +- memcpy(pos, tmp_old, tmp_old[1] + 2); +- pos += tmp_old[1] + 2; +- } +- } else { +- /* ie in transmitting ie also in subelement, +- * copy from subelement and flag the ie in subelement +- * as copied (by setting eid field to WLAN_EID_SSID, +- * which is skipped anyway). +- * For vendor ie, compare OUI + type + subType to +- * determine if they are the same ie. +- */ +- if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { +- if (tmp_old[1] >= 5 && tmp[1] >= 5 && +- !memcmp(tmp_old + 2, tmp + 2, 5)) { +- /* same vendor ie, copy from +- * subelement +- */ +- memcpy(pos, tmp, tmp[1] + 2); +- pos += tmp[1] + 2; +- tmp[0] = WLAN_EID_SSID; +- } else { +- memcpy(pos, tmp_old, tmp_old[1] + 2); +- pos += tmp_old[1] + 2; +- } +- } else { +- /* copy ie from subelement into new ie */ +- memcpy(pos, tmp, tmp[1] + 2); +- pos += tmp[1] + 2; +- tmp[0] = WLAN_EID_SSID; +- } ++ continue; + } + +- if (tmp_old + tmp_old[1] + 2 - ie == ielen) +- break; ++ /* Already copied if an earlier element had the same type */ ++ if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie, ++ &ext_id, match_len, 0)) ++ continue; + +- tmp_old += tmp_old[1] + 2; ++ /* Not inheriting, copy all similar elements from subie */ ++ while (sub) { ++ if (!cfg80211_copy_elem_with_frags(sub, ++ subie, subie_len, ++ &pos, new_ie, ++ new_ie_len)) ++ return 0; ++ ++ sub = cfg80211_find_elem_match(id, ++ sub->data + sub->datalen, ++ subie_len + subie - ++ (sub->data + ++ sub->datalen), ++ &ext_id, match_len, 0); ++ } + } + +- /* go through subelement again to check if there is any ie not +- * copied to new ie, skip ssid, capability, bssid-index ie ++ /* The above misses elements that are included in subie but not in the ++ * parent, so do a pass over subie and append those. ++ * Skip the non-tx BSSID caps and non-inheritance element. + */ +- tmp_new = sub_copy; +- while (tmp_new + 2 - sub_copy <= subie_len && +- tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) { +- if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP || +- tmp_new[0] == WLAN_EID_SSID)) { +- memcpy(pos, tmp_new, tmp_new[1] + 2); +- pos += tmp_new[1] + 2; ++ for_each_element(sub, subie, subie_len) { ++ if (sub->id == WLAN_EID_NON_TX_BSSID_CAP) ++ continue; ++ ++ if (sub->id == WLAN_EID_FRAGMENT) ++ continue; ++ ++ if (sub->id == WLAN_EID_EXTENSION) { ++ if (sub->datalen < 1) ++ continue; ++ ++ id = WLAN_EID_EXTENSION; ++ ext_id = sub->data[0]; ++ match_len = 1; ++ ++ if (ext_id == WLAN_EID_EXT_NON_INHERITANCE) ++ continue; ++ } else { ++ id = sub->id; ++ match_len = 0; + } +- if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len) +- break; +- tmp_new += tmp_new[1] + 2; ++ ++ /* Processed if one was included in the parent */ ++ if (cfg80211_find_elem_match(id, ie, ielen, ++ &ext_id, match_len, 0)) ++ continue; ++ ++ if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len, ++ &pos, new_ie, new_ie_len)) ++ return 0; + } + +- kfree(sub_copy); + return pos - new_ie; + } + +@@ -2224,7 +2259,7 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, + new_ie_len = cfg80211_gen_new_ie(ie, ielen, + profile, + profile_len, new_ie, +- gfp); ++ IEEE80211_MAX_DATA_LEN); + if (!new_ie_len) + continue; + +-- +2.39.2 + diff --git a/queue-6.1/wifi-ieee80211-fix-the-common-size-calculation-for-r.patch b/queue-6.1/wifi-ieee80211-fix-the-common-size-calculation-for-r.patch new file mode 100644 index 00000000000..cebb45a838c --- /dev/null +++ b/queue-6.1/wifi-ieee80211-fix-the-common-size-calculation-for-r.patch @@ -0,0 +1,47 @@ +From b0b2a462d2de9cb2fa01554aaed326deddb9cc5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 21:49:45 +0300 +Subject: wifi: ieee80211: Fix the common size calculation for reconfiguration + ML + +From: Ilan Peer + +[ Upstream commit ce6e1f600b0cfc563a7d607de702262a58cd835d ] + +The common information length is found in the first octet of the common +information. + +Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element") +Signed-off-by: Ilan Peer +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230618214435.3c7ed4817338.I42ef706cb827b4dade6e4ffbb6e7f341eaccd398@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/linux/ieee80211.h | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index 470fafce2e707..870ae4cd82029 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -4575,15 +4575,12 @@ static inline u8 ieee80211_mle_common_size(const u8 *data) + case IEEE80211_ML_CONTROL_TYPE_BASIC: + case IEEE80211_ML_CONTROL_TYPE_PREQ: + case IEEE80211_ML_CONTROL_TYPE_TDLS: ++ case IEEE80211_ML_CONTROL_TYPE_RECONF: + /* + * The length is the first octet pointed by mle->variable so no + * need to add anything + */ + break; +- case IEEE80211_ML_CONTROL_TYPE_RECONF: +- if (control & IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR) +- common += ETH_ALEN; +- return common; + case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: + if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR) + common += ETH_ALEN; +-- +2.39.2 + diff --git a/queue-6.1/wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch b/queue-6.1/wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch new file mode 100644 index 00000000000..0c95c597ae3 --- /dev/null +++ b/queue-6.1/wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch @@ -0,0 +1,60 @@ +From ed9b085aa3e0231daab016e369d62cb9227208e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:04:01 +0300 +Subject: wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection + +From: Johannes Berg + +[ Upstream commit 2db72b8a700943aa54dce0aabe6ff1b72b615162 ] + +We've already done the 'decryption' here, so tell +mac80211 it need not do it again. + +Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230620125813.a50cf68fbf2e.Ieceacbe3789d81ea02ae085ad8d1f8813a33c31b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index 02c2a06301076..f268a31ce26d9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -296,7 +296,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm, + static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta, + struct ieee80211_hdr *hdr, + struct iwl_rx_mpdu_desc *desc, +- u32 status) ++ u32 status, ++ struct ieee80211_rx_status *stats) + { + struct iwl_mvm_sta *mvmsta; + struct iwl_mvm_vif *mvmvif; +@@ -325,8 +326,10 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta, + + /* good cases */ + if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK && +- !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) ++ !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) { ++ stats->flag |= RX_FLAG_DECRYPTED; + return 0; ++ } + + if (!sta) + return -1; +@@ -395,7 +398,7 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + + if (unlikely(ieee80211_is_mgmt(hdr->frame_control) && + !ieee80211_has_protected(hdr->frame_control))) +- return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status); ++ return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status, stats); + + if (!ieee80211_has_protected(hdr->frame_control) || + (status & IWL_RX_MPDU_STATUS_SEC_MASK) == +-- +2.39.2 + diff --git a/queue-6.1/wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch b/queue-6.1/wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch new file mode 100644 index 00000000000..a66d64eb343 --- /dev/null +++ b/queue-6.1/wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch @@ -0,0 +1,57 @@ +From 520946028e9e2e48e32e4a6aa6aca2e31a9db922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 12:41:32 +0300 +Subject: wifi: iwlwifi: pcie: fix NULL pointer dereference in + iwl_pcie_irq_rx_msix_handler() + +From: Anjaneyulu + +[ Upstream commit 1902f1953b8ba100ee8705cb8a6f1a9795550eca ] + +rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry +is zero. For the case when entry->entry is not equal to 0, rxq +won't be NULL even if trans_pcie->rxq is NULL. Modify checker to +check for trans_pcie->rxq. + +Fixes: abc599efa67b ("iwlwifi: pcie: don't crash when rx queues aren't allocated in interrupt") +Signed-off-by: Anjaneyulu +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230614123446.5a5eb3889a4a.I375a1d58f16b48cd2044e7b7caddae512d7c86fd@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index 9c9f87fe83777..b455e981faa1f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1620,14 +1620,14 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) + struct msix_entry *entry = dev_id; + struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry); + struct iwl_trans *trans = trans_pcie->trans; +- struct iwl_rxq *rxq = &trans_pcie->rxq[entry->entry]; ++ struct iwl_rxq *rxq; + + trace_iwlwifi_dev_irq_msix(trans->dev, entry, false, 0, 0); + + if (WARN_ON(entry->entry >= trans->num_rx_queues)) + return IRQ_NONE; + +- if (!rxq) { ++ if (!trans_pcie->rxq) { + if (net_ratelimit()) + IWL_ERR(trans, + "[%d] Got MSI-X interrupt before we have Rx queues\n", +@@ -1635,6 +1635,7 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) + return IRQ_NONE; + } + ++ rxq = &trans_pcie->rxq[entry->entry]; + lock_map_acquire(&trans->sync_cmd_lockdep_map); + IWL_DEBUG_ISR(trans, "[%d] Got interrupt\n", entry->entry); + +-- +2.39.2 + diff --git a/queue-6.1/wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch b/queue-6.1/wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch new file mode 100644 index 00000000000..554b746b373 --- /dev/null +++ b/queue-6.1/wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch @@ -0,0 +1,47 @@ +From d16afe657d8d1dca0c3864389594c856910c58f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 12:41:22 +0300 +Subject: wifi: iwlwifi: pull from TXQs with softirqs disabled + +From: Johannes Berg + +[ Upstream commit 96fb6f47db24a712d650b0a9b9074873f273fb0e ] + +In mac80211, it's required that we pull from TXQs by calling +ieee80211_tx_dequeue() only with softirqs disabled. However, +in iwl_mvm_queue_state_change() we're often called with them +enabled, e.g. from flush if anything was flushed, triggering +a mac80211 warning. + +Fix that by disabling the softirqs across the TX call. + +Fixes: cfbc6c4c5b91 ("iwlwifi: mvm: support mac80211 TXQs model") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230614123446.0feef7fa81db.I4dd62542d955b40dd8f0af34fa4accb9d0d17c7e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index 994f597a7102a..864f5fb260409 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -1686,8 +1686,11 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode, + else + set_bit(IWL_MVM_TXQ_STATE_STOP_FULL, &mvmtxq->state); + +- if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) ++ if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) { ++ local_bh_disable(); + iwl_mvm_mac_itxq_xmit(mvm->hw, txq); ++ local_bh_enable(); ++ } + } + + out: +-- +2.39.2 + diff --git a/queue-6.1/wifi-mac80211-fix-permissions-for-valid_links-debugf.patch b/queue-6.1/wifi-mac80211-fix-permissions-for-valid_links-debugf.patch new file mode 100644 index 00000000000..9391ab75628 --- /dev/null +++ b/queue-6.1/wifi-mac80211-fix-permissions-for-valid_links-debugf.patch @@ -0,0 +1,38 @@ +From 98f34c2163c86ff015e2e4a055cef5f91ee018c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 12:14:28 +0300 +Subject: wifi: mac80211: Fix permissions for valid_links debugfs entry + +From: Ilan Peer + +[ Upstream commit 4cacadc0dbd8013e6161aa8843d8e9d8ad435b47 ] + +The entry should be a read only one and not a write only one. Fix it. + +Fixes: 3d9011029227 ("wifi: mac80211: implement link switching") +Signed-off-by: Ilan Peer +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230611121219.c75316990411.I1565a7fcba8a37f83efffb0cc6b71c572b896e94@changeid +[remove x16 change since it doesn't work yet] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/debugfs_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index 5b014786fd2d0..08a1d7564b7f2 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -694,7 +694,7 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata) + DEBUGFS_ADD_MODE(uapsd_queues, 0600); + DEBUGFS_ADD_MODE(uapsd_max_sp_len, 0600); + DEBUGFS_ADD_MODE(tdls_wider_bw, 0600); +- DEBUGFS_ADD_MODE(valid_links, 0200); ++ DEBUGFS_ADD_MODE(valid_links, 0400); + DEBUGFS_ADD_MODE(active_links, 0600); + } + +-- +2.39.2 + diff --git a/queue-6.1/wifi-mac80211-recalc-min-chandef-for-new-sta-links.patch b/queue-6.1/wifi-mac80211-recalc-min-chandef-for-new-sta-links.patch new file mode 100644 index 00000000000..a1f784ebd34 --- /dev/null +++ b/queue-6.1/wifi-mac80211-recalc-min-chandef-for-new-sta-links.patch @@ -0,0 +1,40 @@ +From fbc0bb7990ddc2c70fed9aa99fde8c864c22612b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 12:11:20 +0300 +Subject: wifi: mac80211: recalc min chandef for new STA links + +From: Johannes Berg + +[ Upstream commit ba7af2654e3b7b810c750b3c6106f6f20b81cc88 ] + +When adding a new link to a station, this needs to cause a +recalculation of the minimum chandef since otherwise we can +have a higher bandwidth station connected on that link than +the link is operating at. Do the appropriate recalc. + +Fixes: cb71f1d136a6 ("wifi: mac80211: add sta link addition/removal") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230604120651.377adf3c789a.I91bf28f399e16e6ac1f83bacd1029a698b4e6685@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 30efa26f977f6..b8c6f6a668fc9 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2861,6 +2861,8 @@ int ieee80211_sta_activate_link(struct sta_info *sta, unsigned int link_id) + if (!test_sta_flag(sta, WLAN_STA_INSERTED)) + goto hash; + ++ ieee80211_recalc_min_chandef(sdata, link_id); ++ + /* Ensure the values are updated for the driver, + * redone by sta_remove_link on failure. + */ +-- +2.39.2 + diff --git a/queue-6.1/wifi-mac80211-remove-missing-iftype-sband-data-eht-c.patch b/queue-6.1/wifi-mac80211-remove-missing-iftype-sband-data-eht-c.patch new file mode 100644 index 00000000000..206efdb9440 --- /dev/null +++ b/queue-6.1/wifi-mac80211-remove-missing-iftype-sband-data-eht-c.patch @@ -0,0 +1,49 @@ +From fdde0e8e7d5b745d5cbed5e676f067976a07ce25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 15:26:48 +0200 +Subject: wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam + +From: Nicolas Cavallari + +[ Upstream commit 6e21e7b8cd897193cee3c2649640efceb3004ba5 ] + +In mesh mode, ieee80211_chandef_he_6ghz_oper() is called by +mesh_matches_local() for every received mesh beacon. + +On a 6 GHz mesh of a HE-only phy, this spams that the hardware does not +have EHT capabilities, even if the received mesh beacon does not have an +EHT element. + +Unlike HE, not supporting EHT in the 6 GHz band is not an error so do +not print anything in this case. + +Fixes: 5dca295dd767 ("mac80211: Add initial support for EHT and 320 MHz channels") + +Signed-off-by: Nicolas Cavallari +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230614132648.28995-1-nicolas.cavallari@green-communications.fr +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/util.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 784b9ba61581e..98806c359b173 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -3599,10 +3599,8 @@ bool ieee80211_chandef_he_6ghz_oper(struct ieee80211_sub_if_data *sdata, + } + + eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype); +- if (!eht_cap) { +- sdata_info(sdata, "Missing iftype sband data/EHT cap"); ++ if (!eht_cap) + eht_oper = NULL; +- } + + he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper); + +-- +2.39.2 + diff --git a/queue-6.1/wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch b/queue-6.1/wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch new file mode 100644 index 00000000000..4fad0e3dc46 --- /dev/null +++ b/queue-6.1/wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch @@ -0,0 +1,48 @@ +From fa8adf2bced6722c52e3be7353beabe157fec3bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 May 2023 15:53:15 +0200 +Subject: wifi: mwifiex: Fix the size of a memory allocation in + mwifiex_ret_802_11_scan() + +From: Christophe JAILLET + +[ Upstream commit d9aef04fcfa81ee4fb2804a21a3712b7bbd936af ] + +The type of "mwifiex_adapter->nd_info" is "struct cfg80211_wowlan_nd_info", +not "struct cfg80211_wowlan_nd_match". + +Use struct_size() to ease the computation of the needed size. + +The current code over-allocates some memory, so is safe. +But it wastes 32 bytes. + +Fixes: 7d7f07d8c5d3 ("mwifiex: add wowlan net-detect support") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/7a6074fb056d2181e058a3cc6048d8155c20aec7.1683371982.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/scan.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index ac8001c842935..644b1e134b01c 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -2187,9 +2187,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, + + if (nd_config) { + adapter->nd_info = +- kzalloc(sizeof(struct cfg80211_wowlan_nd_match) + +- sizeof(struct cfg80211_wowlan_nd_match *) * +- scan_rsp->number_of_sets, GFP_ATOMIC); ++ kzalloc(struct_size(adapter->nd_info, matches, ++ scan_rsp->number_of_sets), ++ GFP_ATOMIC); + + if (adapter->nd_info) + adapter->nd_info->n_matches = scan_rsp->number_of_sets; +-- +2.39.2 + diff --git a/queue-6.1/wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch b/queue-6.1/wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch new file mode 100644 index 00000000000..ee2c182cf42 --- /dev/null +++ b/queue-6.1/wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch @@ -0,0 +1,58 @@ +From 4872281dd6488e4149adb62fca6eb43f572c8807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:38:22 +0200 +Subject: wifi: orinoco: Fix an error handling path in orinoco_cs_probe() + +From: Christophe JAILLET + +[ Upstream commit 67a81d911c01225f426cc6bee2373df044c1a9b7 ] + +Should orinoco_cs_config() fail, some resources need to be released as +already done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +orinoco_cs_probe(), not orinoco_cs_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/e24735ce4d82901d5f7ea08419eea53bfdde3d65.1684568286.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/orinoco/orinoco_cs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c +index a956f965a1e5e..03bfd2482656c 100644 +--- a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c ++++ b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c +@@ -96,6 +96,7 @@ orinoco_cs_probe(struct pcmcia_device *link) + { + struct orinoco_private *priv; + struct orinoco_pccard *card; ++ int ret; + + priv = alloc_orinocodev(sizeof(*card), &link->dev, + orinoco_cs_hard_reset, NULL); +@@ -107,8 +108,16 @@ orinoco_cs_probe(struct pcmcia_device *link) + card->p_dev = link; + link->priv = priv; + +- return orinoco_cs_config(link); +-} /* orinoco_cs_attach */ ++ ret = orinoco_cs_config(link); ++ if (ret) ++ goto err_free_orinocodev; ++ ++ return 0; ++ ++err_free_orinocodev: ++ free_orinocodev(priv); ++ return ret; ++} + + static void orinoco_cs_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-6.1/wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch b/queue-6.1/wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch new file mode 100644 index 00000000000..8adcc8f1733 --- /dev/null +++ b/queue-6.1/wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch @@ -0,0 +1,59 @@ +From d170b4694b14cb2516b983b59a6b2f6668cc8683 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:29:46 +0200 +Subject: wifi: orinoco: Fix an error handling path in spectrum_cs_probe() + +From: Christophe JAILLET + +[ Upstream commit 925244325159824385209e3e0e3f91fa6bf0646c ] + +Should spectrum_cs_config() fail, some resources need to be released as +already done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +spectrum_cs_probe(), not spectrum_cs_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/c0bc0c21c58ca477fc5521607615bafbf2aef8eb.1684567733.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/orinoco/spectrum_cs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c +index 291ef97ed45ec..841d623c621ac 100644 +--- a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c ++++ b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c +@@ -157,6 +157,7 @@ spectrum_cs_probe(struct pcmcia_device *link) + { + struct orinoco_private *priv; + struct orinoco_pccard *card; ++ int ret; + + priv = alloc_orinocodev(sizeof(*card), &link->dev, + spectrum_cs_hard_reset, +@@ -169,8 +170,16 @@ spectrum_cs_probe(struct pcmcia_device *link) + card->p_dev = link; + link->priv = priv; + +- return spectrum_cs_config(link); +-} /* spectrum_cs_attach */ ++ ret = spectrum_cs_config(link); ++ if (ret) ++ goto err_free_orinocodev; ++ ++ return 0; ++ ++err_free_orinocodev: ++ free_orinocodev(priv); ++ return ret; ++} + + static void spectrum_cs_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-6.1/wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch b/queue-6.1/wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch new file mode 100644 index 00000000000..fbed87ea554 --- /dev/null +++ b/queue-6.1/wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch @@ -0,0 +1,69 @@ +From f25d01de9736c2123a556e9e9ba266199d225e1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 10:13:22 +0200 +Subject: wifi: ray_cs: Fix an error handling path in ray_probe() + +From: Christophe JAILLET + +[ Upstream commit 4f8d66a9fb2edcd05c1e563456a55a08910bfb37 ] + +Should ray_config() fail, some resources need to be released as already +done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +ray_probe(), not ray_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/8c544d18084f8b37dd108e844f7e79e85ff708ff.1684570373.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ray_cs.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index 1f57a0055bbd8..38782d4c4694a 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -270,13 +270,14 @@ static int ray_probe(struct pcmcia_device *p_dev) + { + ray_dev_t *local; + struct net_device *dev; ++ int ret; + + dev_dbg(&p_dev->dev, "ray_attach()\n"); + + /* Allocate space for private device-specific data */ + dev = alloc_etherdev(sizeof(ray_dev_t)); + if (!dev) +- goto fail_alloc_dev; ++ return -ENOMEM; + + local = netdev_priv(dev); + local->finder = p_dev; +@@ -313,11 +314,16 @@ static int ray_probe(struct pcmcia_device *p_dev) + timer_setup(&local->timer, NULL, 0); + + this_device = p_dev; +- return ray_config(p_dev); ++ ret = ray_config(p_dev); ++ if (ret) ++ goto err_free_dev; ++ ++ return 0; + +-fail_alloc_dev: +- return -ENOMEM; +-} /* ray_attach */ ++err_free_dev: ++ free_netdev(dev); ++ return ret; ++} + + static void ray_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-6.1/wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch b/queue-6.1/wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch new file mode 100644 index 00000000000..37495055863 --- /dev/null +++ b/queue-6.1/wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch @@ -0,0 +1,52 @@ +From 13e7c6d22371e4bbeff51b261155596150a79b1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 00:28:33 +0200 +Subject: wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled + +From: Marek Vasut + +[ Upstream commit b241e260820b68c09586e8a0ae0fc23c0e3215bd ] + +In case WoWlan was never configured during the operation of the system, +the hw->wiphy->wowlan_config will be NULL. rsi_config_wowlan() checks +whether wowlan_config is non-NULL and if it is not, then WARNs about it. +The warning is valid, as during normal operation the rsi_config_wowlan() +should only ever be called with non-NULL wowlan_config. In shutdown this +rsi_config_wowlan() should only ever be called if WoWlan was configured +before by the user. + +Add checks for non-NULL wowlan_config into the shutdown hook. While at it, +check whether the wiphy is also non-NULL before accessing wowlan_config . +Drop the single-use wowlan_config variable, just inline it into function +call. + +Fixes: 16bbc3eb8372 ("rsi: fix null pointer dereference during rsi_shutdown()") +Signed-off-by: Marek Vasut +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230527222833.273741-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c +index d09998796ac08..6e33a2563fdbd 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -1463,10 +1463,8 @@ static void rsi_shutdown(struct device *dev) + + rsi_dbg(ERR_ZONE, "SDIO Bus shutdown =====>\n"); + +- if (hw) { +- struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config; +- +- if (rsi_config_wowlan(adapter, wowlan)) ++ if (hw && hw->wiphy && hw->wiphy->wowlan_config) { ++ if (rsi_config_wowlan(adapter, hw->wiphy->wowlan_config)) + rsi_dbg(ERR_ZONE, "Failed to configure WoWLAN\n"); + } + +-- +2.39.2 + diff --git a/queue-6.1/wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch b/queue-6.1/wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch new file mode 100644 index 00000000000..3738fdfbacf --- /dev/null +++ b/queue-6.1/wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch @@ -0,0 +1,41 @@ +From bb743190b0b80d807d85017b96c7e9e92bee1fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 00:28:59 +0200 +Subject: wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown + +From: Marek Vasut + +[ Upstream commit e74f562328b03fbe9cf438f958464dff3a644dfc ] + +It makes no sense to set MMC_PM_KEEP_POWER in shutdown. The flag +indicates to the MMC subsystem to keep the slot powered on during +suspend, but in shutdown the slot should actually be powered off. +Drop this call. + +Fixes: 063848c3e155 ("rsi: sdio: Add WOWLAN support for S5 shutdown state") +Signed-off-by: Marek Vasut +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230527222859.273768-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c +index 6e33a2563fdbd..1911fef3bbad6 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -1479,9 +1479,6 @@ static void rsi_shutdown(struct device *dev) + if (sdev->write_fail) + rsi_dbg(INFO_ZONE, "###### Device is not ready #######\n"); + +- if (rsi_set_sdio_pm_caps(adapter)) +- rsi_dbg(INFO_ZONE, "Setting power management caps failed\n"); +- + rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n"); + } + +-- +2.39.2 + diff --git a/queue-6.1/wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch b/queue-6.1/wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch new file mode 100644 index 00000000000..7620eadcebd --- /dev/null +++ b/queue-6.1/wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch @@ -0,0 +1,55 @@ +From 0b1c4f0c5f31e05b3cb8fb4554b9b76a5e9c66e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 18:10:20 +0000 +Subject: wifi: wilc1000: fix for absent RSN capabilities WFA testcase + +From: Amisha Patel + +[ Upstream commit 9ce4bb09123e9754996e358bd808d39f5d112899 ] + +Mandatory WFA testcase +CT_Security_WPA2Personal_STA_RSNEBoundsVerification-AbsentRSNCap, +performs bounds verfication on Beacon and/or Probe response frames. It +failed and observed the reason to be absence of cipher suite and AKM +suite in RSN information. To fix this, enable the RSN flag before extracting RSN +capabilities. + +Fixes: cd21d99e595e ("wifi: wilc1000: validate pairwise and authentication suite offsets") +Signed-off-by: Amisha Patel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230421181005.4865-1-amisha.patel@microchip.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/microchip/wilc1000/hif.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c +index 67df8221b5aeb..a1b75feec6edf 100644 +--- a/drivers/net/wireless/microchip/wilc1000/hif.c ++++ b/drivers/net/wireless/microchip/wilc1000/hif.c +@@ -485,6 +485,9 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; + int offset = 8; + ++ param->mode_802_11i = 2; ++ param->rsn_found = true; ++ + /* extract RSN capabilities */ + if (offset < rsn_ie_len) { + /* skip over pairwise suites */ +@@ -494,11 +497,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + /* skip over authentication suites */ + offset += (rsn_ie[offset] * 4) + 2; + +- if (offset + 1 < rsn_ie_len) { +- param->mode_802_11i = 2; +- param->rsn_found = true; ++ if (offset + 1 < rsn_ie_len) + memcpy(param->rsn_cap, &rsn_ie[offset], 2); +- } + } + } + } +-- +2.39.2 + diff --git a/queue-6.1/wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch b/queue-6.1/wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch new file mode 100644 index 00000000000..366407d9238 --- /dev/null +++ b/queue-6.1/wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch @@ -0,0 +1,66 @@ +From 31905dd9792205bcca60997d3f95badeb5f34206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 10:05:08 +0200 +Subject: wifi: wl3501_cs: Fix an error handling path in wl3501_probe() + +From: Christophe JAILLET + +[ Upstream commit 391af06a02e7642039ac5f6c4b2c034ab0992b5d ] + +Should wl3501_config() fail, some resources need to be released as already +done in the remove function. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/7cc9c9316489b7d69b36aeb0edd3123538500b41.1684569865.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/wl3501_cs.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 7fb2f95134760..c45c4b7cbbaf1 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1862,6 +1862,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev) + { + struct net_device *dev; + struct wl3501_card *this; ++ int ret; + + /* The io structure describes IO port mapping */ + p_dev->resource[0]->end = 16; +@@ -1873,8 +1874,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev) + + dev = alloc_etherdev(sizeof(struct wl3501_card)); + if (!dev) +- goto out_link; +- ++ return -ENOMEM; + + dev->netdev_ops = &wl3501_netdev_ops; + dev->watchdog_timeo = 5 * HZ; +@@ -1887,9 +1887,15 @@ static int wl3501_probe(struct pcmcia_device *p_dev) + netif_stop_queue(dev); + p_dev->priv = dev; + +- return wl3501_config(p_dev); +-out_link: +- return -ENOMEM; ++ ret = wl3501_config(p_dev); ++ if (ret) ++ goto out_free_etherdev; ++ ++ return 0; ++ ++out_free_etherdev: ++ free_netdev(dev); ++ return ret; + } + + static int wl3501_config(struct pcmcia_device *link) +-- +2.39.2 + diff --git a/queue-6.1/x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch b/queue-6.1/x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch new file mode 100644 index 00000000000..2f82dca4026 --- /dev/null +++ b/queue-6.1/x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch @@ -0,0 +1,65 @@ +From 73a7788a3288bd71ad780326a7320681482a03be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 21:35:19 +0200 +Subject: x86/efi: Make efi_set_virtual_address_map IBT safe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Gleixner + +[ Upstream commit 0303c9729afc4094ef53e552b7b8cff7436028d6 ] + +Niklāvs reported a boot regression on an Alderlake machine and bisected it +to commit 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier"). + +By moving the invocation of arch_cpu_finalize_init() further down he +identified that efi_enter_virtual_mode() is the function which causes the +boot hang. + +The main difference of the earlier invocation is that the boot CPU is +already fully initialized and mitigations and alternatives are applied. + +But the only really interesting change turned out to be IBT, which is now +enabled before efi_enter_virtual_mode(). "ibt=off" on the kernel command +line cured the problem. + +Inspection of the involved calls in efi_enter_virtual_mode() unearthed that +efi_set_virtual_address_map() is the only place in the kernel which invokes +an EFI call without the IBT safe wrapper. This went obviously unnoticed so +far as IBT was enabled later. + +Use arch_efi_call_virt() instead of efi_call() to cure that. + +Fixes: fe379fa4d199 ("x86/ibt: Disable IBT around firmware") +Fixes: 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier") +Reported-by: Niklāvs Koļesņikovs +Signed-off-by: Thomas Gleixner +Reviewed-by: Ard Biesheuvel +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217602 +Link: https://lore.kernel.org/r/87jzvm12q0.ffs@tglx +Signed-off-by: Sasha Levin +--- + arch/x86/platform/efi/efi_64.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c +index b36596bf0fc38..601908bdbeadc 100644 +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -847,9 +847,9 @@ efi_set_virtual_address_map(unsigned long memory_map_size, + + /* Disable interrupts around EFI calls: */ + local_irq_save(flags); +- status = efi_call(efi.runtime->set_virtual_address_map, +- memory_map_size, descriptor_size, +- descriptor_version, virtual_map); ++ status = arch_efi_call_virt(efi.runtime, set_virtual_address_map, ++ memory_map_size, descriptor_size, ++ descriptor_version, virtual_map); + local_irq_restore(flags); + + efi_fpu_end(); +-- +2.39.2 + diff --git a/queue-6.1/x86-mm-allow-guest.enc_status_change_prepare-to-fail.patch b/queue-6.1/x86-mm-allow-guest.enc_status_change_prepare-to-fail.patch new file mode 100644 index 00000000000..4eec06dc0af --- /dev/null +++ b/queue-6.1/x86-mm-allow-guest.enc_status_change_prepare-to-fail.patch @@ -0,0 +1,93 @@ +From 53cb1bf92c13f0131705d4ab075f3a658585234d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:56:20 +0300 +Subject: x86/mm: Allow guest.enc_status_change_prepare() to fail + +From: Kirill A. Shutemov + +[ Upstream commit 3f6819dd192ef4f0c568ec3e9d6d408b3fa1ad3d ] + +TDX code is going to provide guest.enc_status_change_prepare() that is +able to fail. TDX will use the call to convert the GPA range from shared +to private. This operation can fail. + +Add a way to return an error from the callback. + +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Dave Hansen +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://lore.kernel.org/all/20230606095622.1939-2-kirill.shutemov%40linux.intel.com +Stable-dep-of: 195edce08b63 ("x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad()") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/x86_init.h | 2 +- + arch/x86/kernel/x86_init.c | 2 +- + arch/x86/mm/mem_encrypt_amd.c | 4 +++- + arch/x86/mm/pat/set_memory.c | 3 ++- + 4 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h +index c1c8c581759d6..034e62838b284 100644 +--- a/arch/x86/include/asm/x86_init.h ++++ b/arch/x86/include/asm/x86_init.h +@@ -150,7 +150,7 @@ struct x86_init_acpi { + * @enc_cache_flush_required Returns true if a cache flush is needed before changing page encryption status + */ + struct x86_guest { +- void (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc); ++ bool (*enc_status_change_prepare)(unsigned long vaddr, int npages, bool enc); + bool (*enc_status_change_finish)(unsigned long vaddr, int npages, bool enc); + bool (*enc_tlb_flush_required)(bool enc); + bool (*enc_cache_flush_required)(void); +diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c +index 10622cf2b30f4..41e5b4cb898c3 100644 +--- a/arch/x86/kernel/x86_init.c ++++ b/arch/x86/kernel/x86_init.c +@@ -130,7 +130,7 @@ struct x86_cpuinit_ops x86_cpuinit = { + + static void default_nmi_init(void) { }; + +-static void enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { } ++static bool enc_status_change_prepare_noop(unsigned long vaddr, int npages, bool enc) { return true; } + static bool enc_status_change_finish_noop(unsigned long vaddr, int npages, bool enc) { return false; } + static bool enc_tlb_flush_required_noop(bool enc) { return false; } + static bool enc_cache_flush_required_noop(void) { return false; } +diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c +index 9c4d8dbcb1296..ff6c0462beee7 100644 +--- a/arch/x86/mm/mem_encrypt_amd.c ++++ b/arch/x86/mm/mem_encrypt_amd.c +@@ -319,7 +319,7 @@ static void enc_dec_hypercall(unsigned long vaddr, int npages, bool enc) + #endif + } + +-static void amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc) ++static bool amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool enc) + { + /* + * To maintain the security guarantees of SEV-SNP guests, make sure +@@ -327,6 +327,8 @@ static void amd_enc_status_change_prepare(unsigned long vaddr, int npages, bool + */ + if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP) && !enc) + snp_set_memory_shared(vaddr, npages); ++ ++ return true; + } + + /* Return true unconditionally: return value doesn't matter for the SEV side */ +diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c +index 2e5a045731dec..5f0ce77a259d8 100644 +--- a/arch/x86/mm/pat/set_memory.c ++++ b/arch/x86/mm/pat/set_memory.c +@@ -2096,7 +2096,8 @@ static int __set_memory_enc_pgtable(unsigned long addr, int numpages, bool enc) + cpa_flush(&cpa, x86_platform.guest.enc_cache_flush_required()); + + /* Notify hypervisor that we are about to set/clr encryption attribute. */ +- x86_platform.guest.enc_status_change_prepare(addr, numpages, enc); ++ if (!x86_platform.guest.enc_status_change_prepare(addr, numpages, enc)) ++ return -EIO; + + ret = __change_page_attr_set_clr(&cpa, 1); + +-- +2.39.2 + diff --git a/queue-6.1/x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch b/queue-6.1/x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch new file mode 100644 index 00000000000..b4c40915e16 --- /dev/null +++ b/queue-6.1/x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch @@ -0,0 +1,47 @@ +From 8e6c372f5adb72d55b8a43e616c23f0b3a29aee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 13:32:59 +0100 +Subject: x86/mm: Fix __swp_entry_to_pte() for Xen PV guests + +From: Juergen Gross + +[ Upstream commit 0f88130e8a6fd185b0aeb5d8e286083735f2585a ] + +Normally __swp_entry_to_pte() is never called with a value translating +to a valid PTE. The only known exception is pte_swap_tests(), resulting +in a WARN splat in Xen PV guests, as __pte_to_swp_entry() did +translate the PFN of the valid PTE to a guest local PFN, while +__swp_entry_to_pte() doesn't do the opposite translation. + +Fix that by using __pte() in __swp_entry_to_pte() instead of open +coding the native variant of it. + +For correctness do the similar conversion for __swp_entry_to_pmd(). + +Fixes: 05289402d717 ("mm/debug_vm_pgtable: add tests validating arch helpers for core MM features") +Signed-off-by: Juergen Gross +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230306123259.12461-1-jgross@suse.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/pgtable_64.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h +index e479491da8d51..07cd53eeec770 100644 +--- a/arch/x86/include/asm/pgtable_64.h ++++ b/arch/x86/include/asm/pgtable_64.h +@@ -237,8 +237,8 @@ static inline void native_pgd_clear(pgd_t *pgd) + + #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) }) + #define __pmd_to_swp_entry(pmd) ((swp_entry_t) { pmd_val((pmd)) }) +-#define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val }) +-#define __swp_entry_to_pmd(x) ((pmd_t) { .pmd = (x).val }) ++#define __swp_entry_to_pte(x) (__pte((x).val)) ++#define __swp_entry_to_pmd(x) (__pmd((x).val)) + + extern int kern_addr_valid(unsigned long addr); + extern void cleanup_highmap(void); +-- +2.39.2 + diff --git a/queue-6.1/x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch b/queue-6.1/x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch new file mode 100644 index 00000000000..49dec5f5b67 --- /dev/null +++ b/queue-6.1/x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch @@ -0,0 +1,55 @@ +From e055ce0e7a15c475c14e010a1023ae33fb03d8ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 14:04:48 +0800 +Subject: x86/resctrl: Only show tasks' pid in current pid namespace + +From: Shawn Wang + +[ Upstream commit 2997d94b5dd0e8b10076f5e0b6f18410c73e28bd ] + +When writing a task id to the "tasks" file in an rdtgroup, +rdtgroup_tasks_write() treats the pid as a number in the current pid +namespace. But when reading the "tasks" file, rdtgroup_tasks_show() shows +the list of global pids from the init namespace, which is confusing and +incorrect. + +To be more robust, let the "tasks" file only show pids in the current pid +namespace. + +Fixes: e02737d5b826 ("x86/intel_rdt: Add tasks files") +Signed-off-by: Shawn Wang +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Reinette Chatre +Acked-by: Fenghua Yu +Tested-by: Reinette Chatre +Link: https://lore.kernel.org/all/20230116071246.97717-1-shawnwang@linux.alibaba.com/ +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +index c7f1c7cb1963b..15ee89ce8c68c 100644 +--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c ++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +@@ -731,11 +731,15 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of, + static void show_rdt_tasks(struct rdtgroup *r, struct seq_file *s) + { + struct task_struct *p, *t; ++ pid_t pid; + + rcu_read_lock(); + for_each_process_thread(p, t) { +- if (is_closid_match(t, r) || is_rmid_match(t, r)) +- seq_printf(s, "%d\n", t->pid); ++ if (is_closid_match(t, r) || is_rmid_match(t, r)) { ++ pid = task_pid_vnr(t); ++ if (pid) ++ seq_printf(s, "%d\n", pid); ++ } + } + rcu_read_unlock(); + } +-- +2.39.2 + diff --git a/queue-6.1/x86-sev-fix-calculation-of-end-address-based-on-numb.patch b/queue-6.1/x86-sev-fix-calculation-of-end-address-based-on-numb.patch new file mode 100644 index 00000000000..a192071fdd8 --- /dev/null +++ b/queue-6.1/x86-sev-fix-calculation-of-end-address-based-on-numb.patch @@ -0,0 +1,134 @@ +From 3f2cdcd9eb0b614e0dd46b64603c24e89581bc5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:51:22 -0500 +Subject: x86/sev: Fix calculation of end address based on number of pages + +From: Tom Lendacky + +[ Upstream commit 5dee19b6b2b194216919b99a1f5af2949a754016 ] + +When calculating an end address based on an unsigned int number of pages, +any value greater than or equal to 0x100000 that is shift PAGE_SHIFT bits +results in a 0 value, resulting in an invalid end address. Change the +number of pages variable in various routines from an unsigned int to an +unsigned long to calculate the end address correctly. + +Fixes: 5e5ccff60a29 ("x86/sev: Add helper for validating pages in early enc attribute changes") +Fixes: dc3f3d2474b8 ("x86/mm: Validate memory when changing the C-bit") +Signed-off-by: Tom Lendacky +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/6a6e4eea0e1414402bac747744984fa4e9c01bb6.1686063086.git.thomas.lendacky@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/sev.h | 16 ++++++++-------- + arch/x86/kernel/sev.c | 14 +++++++------- + 2 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h +index ebc271bb6d8ed..a0a58c4122ec3 100644 +--- a/arch/x86/include/asm/sev.h ++++ b/arch/x86/include/asm/sev.h +@@ -187,12 +187,12 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate) + } + void setup_ghcb(void); + void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, +- unsigned int npages); ++ unsigned long npages); + void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, +- unsigned int npages); ++ unsigned long npages); + void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op); +-void snp_set_memory_shared(unsigned long vaddr, unsigned int npages); +-void snp_set_memory_private(unsigned long vaddr, unsigned int npages); ++void snp_set_memory_shared(unsigned long vaddr, unsigned long npages); ++void snp_set_memory_private(unsigned long vaddr, unsigned long npages); + void snp_set_wakeup_secondary_cpu(void); + bool snp_init(struct boot_params *bp); + void __init __noreturn snp_abort(void); +@@ -207,12 +207,12 @@ static inline int pvalidate(unsigned long vaddr, bool rmp_psize, bool validate) + static inline int rmpadjust(unsigned long vaddr, bool rmp_psize, unsigned long attrs) { return 0; } + static inline void setup_ghcb(void) { } + static inline void __init +-early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned int npages) { } ++early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, unsigned long npages) { } + static inline void __init +-early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned int npages) { } ++early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, unsigned long npages) { } + static inline void __init snp_prep_memory(unsigned long paddr, unsigned int sz, enum psc_op op) { } +-static inline void snp_set_memory_shared(unsigned long vaddr, unsigned int npages) { } +-static inline void snp_set_memory_private(unsigned long vaddr, unsigned int npages) { } ++static inline void snp_set_memory_shared(unsigned long vaddr, unsigned long npages) { } ++static inline void snp_set_memory_private(unsigned long vaddr, unsigned long npages) { } + static inline void snp_set_wakeup_secondary_cpu(void) { } + static inline bool snp_init(struct boot_params *bp) { return false; } + static inline void snp_abort(void) { } +diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c +index c680ac6342bb3..afda719dd7253 100644 +--- a/arch/x86/kernel/sev.c ++++ b/arch/x86/kernel/sev.c +@@ -643,7 +643,7 @@ static u64 __init get_jump_table_addr(void) + return ret; + } + +-static void pvalidate_pages(unsigned long vaddr, unsigned int npages, bool validate) ++static void pvalidate_pages(unsigned long vaddr, unsigned long npages, bool validate) + { + unsigned long vaddr_end; + int rc; +@@ -660,7 +660,7 @@ static void pvalidate_pages(unsigned long vaddr, unsigned int npages, bool valid + } + } + +-static void __init early_set_pages_state(unsigned long paddr, unsigned int npages, enum psc_op op) ++static void __init early_set_pages_state(unsigned long paddr, unsigned long npages, enum psc_op op) + { + unsigned long paddr_end; + u64 val; +@@ -699,7 +699,7 @@ static void __init early_set_pages_state(unsigned long paddr, unsigned int npage + } + + void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long paddr, +- unsigned int npages) ++ unsigned long npages) + { + /* + * This can be invoked in early boot while running identity mapped, so +@@ -721,7 +721,7 @@ void __init early_snp_set_memory_private(unsigned long vaddr, unsigned long padd + } + + void __init early_snp_set_memory_shared(unsigned long vaddr, unsigned long paddr, +- unsigned int npages) ++ unsigned long npages) + { + /* + * This can be invoked in early boot while running identity mapped, so +@@ -877,7 +877,7 @@ static void __set_pages_state(struct snp_psc_desc *data, unsigned long vaddr, + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_PSC); + } + +-static void set_pages_state(unsigned long vaddr, unsigned int npages, int op) ++static void set_pages_state(unsigned long vaddr, unsigned long npages, int op) + { + unsigned long vaddr_end, next_vaddr; + struct snp_psc_desc *desc; +@@ -902,7 +902,7 @@ static void set_pages_state(unsigned long vaddr, unsigned int npages, int op) + kfree(desc); + } + +-void snp_set_memory_shared(unsigned long vaddr, unsigned int npages) ++void snp_set_memory_shared(unsigned long vaddr, unsigned long npages) + { + if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP)) + return; +@@ -912,7 +912,7 @@ void snp_set_memory_shared(unsigned long vaddr, unsigned int npages) + set_pages_state(vaddr, npages, SNP_PAGE_STATE_SHARED); + } + +-void snp_set_memory_private(unsigned long vaddr, unsigned int npages) ++void snp_set_memory_private(unsigned long vaddr, unsigned long npages) + { + if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP)) + return; +-- +2.39.2 + diff --git a/queue-6.1/x86-tdx-fix-race-between-set_memory_encrypted-and-lo.patch b/queue-6.1/x86-tdx-fix-race-between-set_memory_encrypted-and-lo.patch new file mode 100644 index 00000000000..b074988890e --- /dev/null +++ b/queue-6.1/x86-tdx-fix-race-between-set_memory_encrypted-and-lo.patch @@ -0,0 +1,142 @@ +From 037f4660780f57ae22f37ad939c4497f1ddff5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:56:21 +0300 +Subject: x86/tdx: Fix race between set_memory_encrypted() and + load_unaligned_zeropad() + +From: Kirill A. Shutemov + +[ Upstream commit 195edce08b63d293377f615f4f7f086715d2d212 ] + +tl;dr: There is a race in the TDX private<=>shared conversion code + which could kill the TDX guest. Fix it by changing conversion + ordering to eliminate the window. + +TDX hardware maintains metadata to track which pages are private and +shared. Additionally, TDX guests use the guest x86 page tables to +specify whether a given mapping is intended to be private or shared. +Bad things happen when the intent and metadata do not match. + +So there are two thing in play: + 1. "the page" -- the physical TDX page metadata + 2. "the mapping" -- the guest-controlled x86 page table intent + +For instance, an unrecoverable exit to VMM occurs if a guest touches a +private mapping that points to a shared physical page. + +In summary: + * Private mapping => Private Page == OK (obviously) + * Shared mapping => Shared Page == OK (obviously) + * Private mapping => Shared Page == BIG BOOM! + * Shared mapping => Private Page == OK-ish + (It will read generate a recoverable #VE via handle_mmio()) + +Enter load_unaligned_zeropad(). It can touch memory that is adjacent but +otherwise unrelated to the memory it needs to touch. It will cause one +of those unrecoverable exits (aka. BIG BOOM) if it blunders into a +shared mapping pointing to a private page. + +This is a problem when __set_memory_enc_pgtable() converts pages from +shared to private. It first changes the mapping and second modifies +the TDX page metadata. It's moving from: + + * Shared mapping => Shared Page == OK +to: + * Private mapping => Shared Page == BIG BOOM! + +This means that there is a window with a shared mapping pointing to a +private page where load_unaligned_zeropad() can strike. + +Add a TDX handler for guest.enc_status_change_prepare(). This converts +the page from shared to private *before* the page becomes private. This +ensures that there is never a private mapping to a shared page. + +Leave a guest.enc_status_change_finish() in place but only use it for +private=>shared conversions. This will delay updating the TDX metadata +marking the page private until *after* the mapping matches the metadata. +This also ensures that there is never a private mapping to a shared page. + +[ dhansen: rewrite changelog ] + +Fixes: 7dbde7631629 ("x86/mm/cpa: Add support for TDX shared memory") +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Dave Hansen +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://lore.kernel.org/all/20230606095622.1939-3-kirill.shutemov%40linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/coco/tdx/tdx.c | 51 ++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 48 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c +index b8998cf0508a6..8a1d48b8c2a3e 100644 +--- a/arch/x86/coco/tdx/tdx.c ++++ b/arch/x86/coco/tdx/tdx.c +@@ -756,6 +756,30 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc) + return true; + } + ++static bool tdx_enc_status_change_prepare(unsigned long vaddr, int numpages, ++ bool enc) ++{ ++ /* ++ * Only handle shared->private conversion here. ++ * See the comment in tdx_early_init(). ++ */ ++ if (enc) ++ return tdx_enc_status_changed(vaddr, numpages, enc); ++ return true; ++} ++ ++static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages, ++ bool enc) ++{ ++ /* ++ * Only handle private->shared conversion here. ++ * See the comment in tdx_early_init(). ++ */ ++ if (!enc) ++ return tdx_enc_status_changed(vaddr, numpages, enc); ++ return true; ++} ++ + void __init tdx_early_init(void) + { + u64 cc_mask; +@@ -780,9 +804,30 @@ void __init tdx_early_init(void) + */ + physical_mask &= cc_mask - 1; + +- x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required; +- x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required; +- x86_platform.guest.enc_status_change_finish = tdx_enc_status_changed; ++ /* ++ * The kernel mapping should match the TDX metadata for the page. ++ * load_unaligned_zeropad() can touch memory *adjacent* to that which is ++ * owned by the caller and can catch even _momentary_ mismatches. Bad ++ * things happen on mismatch: ++ * ++ * - Private mapping => Shared Page == Guest shutdown ++ * - Shared mapping => Private Page == Recoverable #VE ++ * ++ * guest.enc_status_change_prepare() converts the page from ++ * shared=>private before the mapping becomes private. ++ * ++ * guest.enc_status_change_finish() converts the page from ++ * private=>shared after the mapping becomes private. ++ * ++ * In both cases there is a temporary shared mapping to a private page, ++ * which can result in a #VE. But, there is never a private mapping to ++ * a shared page. ++ */ ++ x86_platform.guest.enc_status_change_prepare = tdx_enc_status_change_prepare; ++ x86_platform.guest.enc_status_change_finish = tdx_enc_status_change_finish; ++ ++ x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required; ++ x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required; + + pr_info("Guest detected\n"); + } +-- +2.39.2 +