From: Greg Kroah-Hartman Date: Wed, 13 Sep 2023 19:23:29 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.10.195~56 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f750f82c992a1e6fa13db82785ecf5a702480c92;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: arm64-dts-renesas-rzg2l-fix-txdv-skew-psec-typos.patch asoc-tegra-fix-sfc-conversion-for-few-rates.patch bus-mhi-host-skip-mhi-reset-if-device-is-in-rddm.patch cifs-update-desired-access-while-requesting-for-directory-lease.patch clk-imx-pll14xx-align-pdiv-with-reference-manual.patch clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch clk-qcom-camcc-sc7180-fix-async-resume-during-probe.patch clk-qcom-dispcc-sm8450-fix-runtime-pm-imbalance-on-probe-errors.patch clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch clk-qcom-lpasscc-sc7280-fix-missing-resume-during-probe.patch clk-qcom-mss-sc7180-fix-missing-resume-during-probe.patch clk-qcom-q6sstop-qcs404-fix-missing-resume-during-probe.patch clk-qcom-turingcc-qcs404-fix-missing-resume-during-probe.patch drm-ast-fix-dram-init-on-ast2200.patch dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch lib-test_meminit-allocate-pages-up-to-order-max_order.patch memcg-drop-kmem.limit_in_bytes.patch mm-hugetlb_vmemmap-fix-a-race-between-vmemmap-pmd-split.patch nfs-fix-a-potential-data-corruption.patch nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch null_blk-fix-poll-request-timeout-handling.patch parisc-led-fix-lan-receive-and-transmit-leds.patch parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch pinctrl-cherryview-fix-address_space_handler-argument.patch send-channel-sequence-number-in-smb3-requests-after-reconnects.patch soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch --- diff --git a/queue-6.1/arm64-dts-renesas-rzg2l-fix-txdv-skew-psec-typos.patch b/queue-6.1/arm64-dts-renesas-rzg2l-fix-txdv-skew-psec-typos.patch new file mode 100644 index 00000000000..96188502b29 --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-rzg2l-fix-txdv-skew-psec-typos.patch @@ -0,0 +1,85 @@ +From db67345716a52abb750ec8f76d6a5675218715f9 Mon Sep 17 00:00:00 2001 +From: Chris Paterson +Date: Fri, 9 Jun 2023 23:11:36 +0100 +Subject: arm64: dts: renesas: rzg2l: Fix txdv-skew-psec typos + +From: Chris Paterson + +commit db67345716a52abb750ec8f76d6a5675218715f9 upstream. + +It looks like txdv-skew-psec is a typo from a copy+paste. txdv-skew-psec +is not present in the PHY bindings nor is it in the driver. + +Correct to txen-skew-psec which is clearly what it was meant to be. + +Given that the default for txen-skew-psec is 0, and the device tree is +only trying to set it to 0 anyway, there should not be any functional +change from this fix. + +Fixes: 361b0dcbd7f9 ("arm64: dts: renesas: rzg2l-smarc-som: Enable Ethernet") +Fixes: 6494e4f90503 ("arm64: dts: renesas: rzg2ul-smarc-som: Enable Ethernet on SMARC platform") +Fixes: ce0c63b6a5ef ("arm64: dts: renesas: Add initial device tree for RZ/G2LC SMARC EVK") +Cc: stable@vger.kernel.org # 6.1.y +Reported-by: Tomohiro Komagata +Signed-off-by: Chris Paterson +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230609221136.7431-1-chris.paterson2@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi | 4 ++-- + arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi | 2 +- + arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi +@@ -100,7 +100,7 @@ + rxc-skew-psec = <2400>; + txc-skew-psec = <2400>; + rxdv-skew-psec = <0>; +- txdv-skew-psec = <0>; ++ txen-skew-psec = <0>; + rxd0-skew-psec = <0>; + rxd1-skew-psec = <0>; + rxd2-skew-psec = <0>; +@@ -128,7 +128,7 @@ + rxc-skew-psec = <2400>; + txc-skew-psec = <2400>; + rxdv-skew-psec = <0>; +- txdv-skew-psec = <0>; ++ txen-skew-psec = <0>; + rxd0-skew-psec = <0>; + rxd1-skew-psec = <0>; + rxd2-skew-psec = <0>; +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi +@@ -77,7 +77,7 @@ + rxc-skew-psec = <2400>; + txc-skew-psec = <2400>; + rxdv-skew-psec = <0>; +- txdv-skew-psec = <0>; ++ txen-skew-psec = <0>; + rxd0-skew-psec = <0>; + rxd1-skew-psec = <0>; + rxd2-skew-psec = <0>; +--- a/arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi +@@ -80,7 +80,7 @@ + rxc-skew-psec = <2400>; + txc-skew-psec = <2400>; + rxdv-skew-psec = <0>; +- txdv-skew-psec = <0>; ++ txen-skew-psec = <0>; + rxd0-skew-psec = <0>; + rxd1-skew-psec = <0>; + rxd2-skew-psec = <0>; +@@ -107,7 +107,7 @@ + rxc-skew-psec = <2400>; + txc-skew-psec = <2400>; + rxdv-skew-psec = <0>; +- txdv-skew-psec = <0>; ++ txen-skew-psec = <0>; + rxd0-skew-psec = <0>; + rxd1-skew-psec = <0>; + rxd2-skew-psec = <0>; diff --git a/queue-6.1/asoc-tegra-fix-sfc-conversion-for-few-rates.patch b/queue-6.1/asoc-tegra-fix-sfc-conversion-for-few-rates.patch new file mode 100644 index 00000000000..d7d2eb3f582 --- /dev/null +++ b/queue-6.1/asoc-tegra-fix-sfc-conversion-for-few-rates.patch @@ -0,0 +1,194 @@ +From d900d9a435ca95a386f49424f3689cd17ec201da Mon Sep 17 00:00:00 2001 +From: Sheetal +Date: Thu, 22 Jun 2023 17:04:09 +0530 +Subject: ASoC: tegra: Fix SFC conversion for few rates + +From: Sheetal + +commit d900d9a435ca95a386f49424f3689cd17ec201da upstream. + +Sample rate conversions for rates greater than 48kHz are found to be +failing. It means x->y conversions fail when either x or y is greater +than 48kHz. + +This happens because, tegra210_sfc_rate_to_idx() returns incorrect +index for rates greater than 48kHz. This actually depends on the +tegra210_sfc_rates[] array and it is not in sync with frequency +values of SFC TX/RX register. To be precise, 64kHz entry is missing +in above array defined in the driver. Due to this wrong index is +returned and this results in incorrect programming of coefficients. + +To fix this, align the tegra210_sfc_rates[] array with SFC register +specification and thus add 64kHz entry to it. Also, the coefficient +table is updated to reflect that none of the conversions are supported +for 64kHz. + +Fixes: b2f74ec53a6c ("ASoC: tegra: Add Tegra210 based SFC driver") +Cc: stable@vger.kernel.org +Signed-off-by: Sheetal +Reviewed-by: Mohan Kumar D +Reviewed-by: Sameer Pujar +Link: https://lore.kernel.org/r/Message-Id: <1687433656-7892-2-git-send-email-spujar@nvidia.com> +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/tegra/tegra210_sfc.c | 31 ++++++++++++++++++++++++++++++- + sound/soc/tegra/tegra210_sfc.h | 4 ++-- + 2 files changed, 32 insertions(+), 3 deletions(-) + +--- a/sound/soc/tegra/tegra210_sfc.c ++++ b/sound/soc/tegra/tegra210_sfc.c +@@ -2,7 +2,7 @@ + // + // tegra210_sfc.c - Tegra210 SFC driver + // +-// Copyright (c) 2021 NVIDIA CORPORATION. All rights reserved. ++// Copyright (c) 2021-2023 NVIDIA CORPORATION. All rights reserved. + + #include + #include +@@ -42,6 +42,7 @@ static const int tegra210_sfc_rates[TEGR + 32000, + 44100, + 48000, ++ 64000, + 88200, + 96000, + 176400, +@@ -2857,6 +2858,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_8to32, + coef_8to44, + coef_8to48, ++ UNSUPP_CONV, + coef_8to88, + coef_8to96, + UNSUPP_CONV, +@@ -2872,6 +2874,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_11to32, + coef_11to44, + coef_11to48, ++ UNSUPP_CONV, + coef_11to88, + coef_11to96, + UNSUPP_CONV, +@@ -2887,6 +2890,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_16to32, + coef_16to44, + coef_16to48, ++ UNSUPP_CONV, + coef_16to88, + coef_16to96, + coef_16to176, +@@ -2902,6 +2906,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_22to32, + coef_22to44, + coef_22to48, ++ UNSUPP_CONV, + coef_22to88, + coef_22to96, + coef_22to176, +@@ -2917,6 +2922,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_24to32, + coef_24to44, + coef_24to48, ++ UNSUPP_CONV, + coef_24to88, + coef_24to96, + coef_24to176, +@@ -2932,6 +2938,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + BYPASS_CONV, + coef_32to44, + coef_32to48, ++ UNSUPP_CONV, + coef_32to88, + coef_32to96, + coef_32to176, +@@ -2947,6 +2954,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_44to32, + BYPASS_CONV, + coef_44to48, ++ UNSUPP_CONV, + coef_44to88, + coef_44to96, + coef_44to176, +@@ -2962,11 +2970,28 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_48to32, + coef_48to44, + BYPASS_CONV, ++ UNSUPP_CONV, + coef_48to88, + coef_48to96, + coef_48to176, + coef_48to192, + }, ++ /* Convertions from 64 kHz */ ++ { ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ UNSUPP_CONV, ++ }, + /* Convertions from 88.2 kHz */ + { + coef_88to8, +@@ -2977,6 +3002,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_88to32, + coef_88to44, + coef_88to48, ++ UNSUPP_CONV, + BYPASS_CONV, + coef_88to96, + coef_88to176, +@@ -2991,6 +3017,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_96to32, + coef_96to44, + coef_96to48, ++ UNSUPP_CONV, + coef_96to88, + BYPASS_CONV, + coef_96to176, +@@ -3006,6 +3033,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_176to32, + coef_176to44, + coef_176to48, ++ UNSUPP_CONV, + coef_176to88, + coef_176to96, + BYPASS_CONV, +@@ -3021,6 +3049,7 @@ static s32 *coef_addr_table[TEGRA210_SFC + coef_192to32, + coef_192to44, + coef_192to48, ++ UNSUPP_CONV, + coef_192to88, + coef_192to96, + coef_192to176, +--- a/sound/soc/tegra/tegra210_sfc.h ++++ b/sound/soc/tegra/tegra210_sfc.h +@@ -2,7 +2,7 @@ + /* + * tegra210_sfc.h - Definitions for Tegra210 SFC driver + * +- * Copyright (c) 2021 NVIDIA CORPORATION. All rights reserved. ++ * Copyright (c) 2021-2023 NVIDIA CORPORATION. All rights reserved. + * + */ + +@@ -47,7 +47,7 @@ + #define TEGRA210_SFC_EN_SHIFT 0 + #define TEGRA210_SFC_EN (1 << TEGRA210_SFC_EN_SHIFT) + +-#define TEGRA210_SFC_NUM_RATES 12 ++#define TEGRA210_SFC_NUM_RATES 13 + + /* Fields in TEGRA210_SFC_COEF_RAM */ + #define TEGRA210_SFC_COEF_RAM_EN BIT(0) diff --git a/queue-6.1/bus-mhi-host-skip-mhi-reset-if-device-is-in-rddm.patch b/queue-6.1/bus-mhi-host-skip-mhi-reset-if-device-is-in-rddm.patch new file mode 100644 index 00000000000..49452722658 --- /dev/null +++ b/queue-6.1/bus-mhi-host-skip-mhi-reset-if-device-is-in-rddm.patch @@ -0,0 +1,47 @@ +From cabce92dd805945a090dc6fc73b001bb35ed083a Mon Sep 17 00:00:00 2001 +From: Qiang Yu +Date: Thu, 18 May 2023 14:22:39 +0800 +Subject: bus: mhi: host: Skip MHI reset if device is in RDDM + +From: Qiang Yu + +commit cabce92dd805945a090dc6fc73b001bb35ed083a upstream. + +In RDDM EE, device can not process MHI reset issued by host. In case of MHI +power off, host is issuing MHI reset and polls for it to get cleared until +it times out. Since this timeout can not be avoided in case of RDDM, skip +the MHI reset in this scenarios. + +Cc: +Fixes: a6e2e3522f29 ("bus: mhi: core: Add support for PM state transitions") +Signed-off-by: Qiang Yu +Reviewed-by: Jeffrey Hugo +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/1684390959-17836-1-git-send-email-quic_qianyu@quicinc.com +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/pm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/bus/mhi/host/pm.c ++++ b/drivers/bus/mhi/host/pm.c +@@ -470,6 +470,10 @@ static void mhi_pm_disable_transition(st + + /* Trigger MHI RESET so that the device will not access host memory */ + if (!MHI_PM_IN_FATAL_STATE(mhi_cntrl->pm_state)) { ++ /* Skip MHI RESET if in RDDM state */ ++ if (mhi_cntrl->rddm_image && mhi_get_exec_env(mhi_cntrl) == MHI_EE_RDDM) ++ goto skip_mhi_reset; ++ + dev_dbg(dev, "Triggering MHI Reset in device\n"); + mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET); + +@@ -495,6 +499,7 @@ static void mhi_pm_disable_transition(st + } + } + ++skip_mhi_reset: + dev_dbg(dev, + "Waiting for all pending event ring processing to complete\n"); + mhi_event = mhi_cntrl->mhi_event; diff --git a/queue-6.1/cifs-update-desired-access-while-requesting-for-directory-lease.patch b/queue-6.1/cifs-update-desired-access-while-requesting-for-directory-lease.patch new file mode 100644 index 00000000000..46393a949a3 --- /dev/null +++ b/queue-6.1/cifs-update-desired-access-while-requesting-for-directory-lease.patch @@ -0,0 +1,33 @@ +From b6d44d42313baa45a81ce9b299aeee2ccf3d0ee1 Mon Sep 17 00:00:00 2001 +From: Bharath SM +Date: Wed, 16 Aug 2023 19:38:45 +0000 +Subject: cifs: update desired access while requesting for directory lease + +From: Bharath SM + +commit b6d44d42313baa45a81ce9b299aeee2ccf3d0ee1 upstream. + +We read and cache directory contents when we get directory +lease, so we should ask for read permission to read contents +of directory. + +Signed-off-by: Bharath SM +Reviewed-by: Shyam Prasad N +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cached_dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/smb/client/cached_dir.c ++++ b/fs/smb/client/cached_dir.c +@@ -218,7 +218,7 @@ int open_cached_dir(unsigned int xid, st + .tcon = tcon, + .path = path, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE), +- .desired_access = FILE_READ_ATTRIBUTES, ++ .desired_access = FILE_READ_DATA | FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .fid = pfid, + }; diff --git a/queue-6.1/clk-imx-pll14xx-align-pdiv-with-reference-manual.patch b/queue-6.1/clk-imx-pll14xx-align-pdiv-with-reference-manual.patch new file mode 100644 index 00000000000..3ecb31d93d3 --- /dev/null +++ b/queue-6.1/clk-imx-pll14xx-align-pdiv-with-reference-manual.patch @@ -0,0 +1,59 @@ +From 37cfd5e457cbdcd030f378127ff2d62776f641e7 Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Mon, 7 Aug 2023 10:47:43 +0200 +Subject: clk: imx: pll14xx: align pdiv with reference manual + +From: Marco Felsch + +commit 37cfd5e457cbdcd030f378127ff2d62776f641e7 upstream. + +The PLL14xx hardware can be found on i.MX8M{M,N,P} SoCs and always come +with a 6-bit pre-divider. Neither the reference manuals nor the +datasheets of these SoCs do mention any restrictions. Furthermore the +current code doesn't respect the restrictions from the comment too. + +Therefore drop the restriction and align the max pre-divider (pdiv) +value to 63 to get more accurate frequencies. + +Fixes: b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates") +Cc: stable@vger.kernel.org +Signed-off-by: Marco Felsch +Reviewed-by: Abel Vesa +Reviewed-by: Adam Ford +Signed-off-by: Philipp Zabel +Acked-by: Sascha Hauer +Tested-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20230807084744.1184791-1-m.felsch@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/imx/clk-pll14xx.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -135,11 +135,10 @@ static void imx_pll14xx_calc_settings(st + /* + * Fractional PLL constrains: + * +- * a) 6MHz <= prate <= 25MHz +- * b) 1 <= p <= 63 (1 <= p <= 4 prate = 24MHz) +- * c) 64 <= m <= 1023 +- * d) 0 <= s <= 6 +- * e) -32768 <= k <= 32767 ++ * a) 1 <= p <= 63 ++ * b) 64 <= m <= 1023 ++ * c) 0 <= s <= 6 ++ * d) -32768 <= k <= 32767 + * + * fvco = (m * 65536 + k) * prate / (p * 65536) + */ +@@ -182,7 +181,7 @@ static void imx_pll14xx_calc_settings(st + } + + /* Finally calculate best values */ +- for (pdiv = 1; pdiv <= 7; pdiv++) { ++ for (pdiv = 1; pdiv <= 63; pdiv++) { + for (sdiv = 0; sdiv <= 6; sdiv++) { + /* calc mdiv = round(rate * pdiv * 2^sdiv) / prate) */ + mdiv = DIV_ROUND_CLOSEST(rate * (pdiv << sdiv), prate); diff --git a/queue-6.1/clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch b/queue-6.1/clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch new file mode 100644 index 00000000000..a60e3270981 --- /dev/null +++ b/queue-6.1/clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch @@ -0,0 +1,72 @@ +From 72d00e560d10665e6139c9431956a87ded6e9880 Mon Sep 17 00:00:00 2001 +From: Ahmad Fatoum +Date: Mon, 7 Aug 2023 10:47:44 +0200 +Subject: clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz + +From: Ahmad Fatoum + +commit 72d00e560d10665e6139c9431956a87ded6e9880 upstream. + +Since commit b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates"), +the driver has the ability to dynamically compute PLL parameters to +approximate the requested rates. This is not always used, because the +logic is as follows: + + - Check if the target rate is hardcoded in the frequency table + - Check if varying only kdiv is possible, so switch over is glitch free + - Compute rate dynamically by iterating over pdiv range + +If we skip the frequency table for the 1443x PLL, we find that the +computed values differ to the hardcoded ones. This can be valid if the +hardcoded values guarantee for example an earlier lock-in or if the +divisors are chosen, so that other important rates are more likely to +be reached glitch-free. + +For rates (393216000 and 361267200, this doesn't seem to be the case: +They are only approximated by existing parameters (393215995 and +361267196 Hz, respectively) and they aren't reachable glitch-free from +other hardcoded frequencies. Dropping them from the table allows us +to lock-in to these frequencies exactly. + +This is immediately noticeable because they are the assigned-clock-rates +for IMX8MN_AUDIO_PLL1 and IMX8MN_AUDIO_PLL2, respectively and a look +into clk_summary so far showed that they were a few Hz short of the target: + +imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary +audio_pll2_out 0 0 0 361267196 0 0 50000 N +audio_pll1_out 1 1 0 393215995 0 0 50000 Y + +and afterwards: + +imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary +audio_pll2_out 0 0 0 361267200 0 0 50000 N +audio_pll1_out 1 1 0 393216000 0 0 50000 Y + +This change is equivalent to adding following hardcoded values: + + /* rate mdiv pdiv sdiv kdiv */ + PLL_1443X_RATE(393216000, 655, 5, 3, 23593), + PLL_1443X_RATE(361267200, 497, 33, 0, -16882), + +Fixes: 053a4ffe2988 ("clk: imx: imx8mm: fix audio pll setting") +Cc: stable@vger.kernel.org # v5.18+ +Signed-off-by: Ahmad Fatoum +Signed-off-by: Marco Felsch +Link: https://lore.kernel.org/r/20230807084744.1184791-2-m.felsch@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/imx/clk-pll14xx.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -62,8 +62,6 @@ static const struct imx_pll14xx_rate_tab + PLL_1443X_RATE(650000000U, 325, 3, 2, 0), + PLL_1443X_RATE(594000000U, 198, 2, 2, 0), + PLL_1443X_RATE(519750000U, 173, 2, 2, 16384), +- PLL_1443X_RATE(393216000U, 262, 2, 3, 9437), +- PLL_1443X_RATE(361267200U, 361, 3, 3, 17511), + }; + + struct imx_pll14xx_clk imx_1443x_pll = { diff --git a/queue-6.1/clk-qcom-camcc-sc7180-fix-async-resume-during-probe.patch b/queue-6.1/clk-qcom-camcc-sc7180-fix-async-resume-during-probe.patch new file mode 100644 index 00000000000..fb325b84a3a --- /dev/null +++ b/queue-6.1/clk-qcom-camcc-sc7180-fix-async-resume-during-probe.patch @@ -0,0 +1,35 @@ +From c948ff727e25297f3a703eb5349dd66aabf004e4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 18 Jul 2023 15:28:55 +0200 +Subject: clk: qcom: camcc-sc7180: fix async resume during probe + +From: Johan Hovold + +commit c948ff727e25297f3a703eb5349dd66aabf004e4 upstream. + +To make sure that the controller is runtime resumed and its power domain +is enabled before accessing its registers during probe, the synchronous +runtime PM interface must be used. + +Fixes: 8d4025943e13 ("clk: qcom: camcc-sc7180: Use runtime PM ops instead of clk ones") +Cc: stable@vger.kernel.org # 5.11 +Cc: Stephen Boyd +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230718132902.21430-2-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/camcc-sc7180.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/camcc-sc7180.c ++++ b/drivers/clk/qcom/camcc-sc7180.c +@@ -1664,7 +1664,7 @@ static int cam_cc_sc7180_probe(struct pl + return ret; + } + +- ret = pm_runtime_get(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret) + return ret; + diff --git a/queue-6.1/clk-qcom-dispcc-sm8450-fix-runtime-pm-imbalance-on-probe-errors.patch b/queue-6.1/clk-qcom-dispcc-sm8450-fix-runtime-pm-imbalance-on-probe-errors.patch new file mode 100644 index 00000000000..a90b12498aa --- /dev/null +++ b/queue-6.1/clk-qcom-dispcc-sm8450-fix-runtime-pm-imbalance-on-probe-errors.patch @@ -0,0 +1,55 @@ +From b0f3d01bda6c3f6f811e70f76d2040ae81f64565 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 18 Jul 2023 15:28:56 +0200 +Subject: clk: qcom: dispcc-sm8450: fix runtime PM imbalance on probe errors + +From: Johan Hovold + +commit b0f3d01bda6c3f6f811e70f76d2040ae81f64565 upstream. + +Make sure to decrement the runtime PM usage count before returning in +case regmap initialisation fails. + +Fixes: 16fb89f92ec4 ("clk: qcom: Add support for Display Clock Controller on SM8450") +Cc: stable@vger.kernel.org # 6.1 +Cc: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230718132902.21430-3-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/dispcc-sm8450.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/clk/qcom/dispcc-sm8450.c ++++ b/drivers/clk/qcom/dispcc-sm8450.c +@@ -1783,8 +1783,10 @@ static int disp_cc_sm8450_probe(struct p + return ret; + + regmap = qcom_cc_map(pdev, &disp_cc_sm8450_desc); +- if (IS_ERR(regmap)) +- return PTR_ERR(regmap); ++ if (IS_ERR(regmap)) { ++ ret = PTR_ERR(regmap); ++ goto err_put_rpm; ++ } + + clk_lucid_evo_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config); + clk_lucid_evo_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config); +@@ -1799,9 +1801,16 @@ static int disp_cc_sm8450_probe(struct p + regmap_update_bits(regmap, 0xe05c, BIT(0), BIT(0)); + + ret = qcom_cc_really_probe(pdev, &disp_cc_sm8450_desc, regmap); ++ if (ret) ++ goto err_put_rpm; + + pm_runtime_put(&pdev->dev); + ++ return 0; ++ ++err_put_rpm: ++ pm_runtime_put_sync(&pdev->dev); ++ + return ret; + } + diff --git a/queue-6.1/clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch b/queue-6.1/clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch new file mode 100644 index 00000000000..38cc4427ec8 --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch @@ -0,0 +1,35 @@ +From 1583694bb4eaf186f17131dbc1b83d6057d2749b Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sat, 13 May 2023 00:17:23 +0300 +Subject: clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock + +From: Dmitry Baryshkov + +commit 1583694bb4eaf186f17131dbc1b83d6057d2749b upstream. + +The pll0_vote clock definitely should have pll0 as a parent (instead of +pll8). + +Fixes: 7792a8d6713c ("clk: mdm9615: Add support for MDM9615 Clock Controllers") +Cc: stable@kernel.org +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230512211727.3445575-7-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/gcc-mdm9615.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/gcc-mdm9615.c ++++ b/drivers/clk/qcom/gcc-mdm9615.c +@@ -58,7 +58,7 @@ static struct clk_regmap pll0_vote = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "pll0_vote", +- .parent_names = (const char *[]){ "pll8" }, ++ .parent_names = (const char *[]){ "pll0" }, + .num_parents = 1, + .ops = &clk_pll_vote_ops, + }, diff --git a/queue-6.1/clk-qcom-lpasscc-sc7280-fix-missing-resume-during-probe.patch b/queue-6.1/clk-qcom-lpasscc-sc7280-fix-missing-resume-during-probe.patch new file mode 100644 index 00000000000..7c35212e97b --- /dev/null +++ b/queue-6.1/clk-qcom-lpasscc-sc7280-fix-missing-resume-during-probe.patch @@ -0,0 +1,68 @@ +From 66af5339d4f8e20c6d89a490570bd94d40f1a7f6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 18 Jul 2023 15:28:59 +0200 +Subject: clk: qcom: lpasscc-sc7280: fix missing resume during probe + +From: Johan Hovold + +commit 66af5339d4f8e20c6d89a490570bd94d40f1a7f6 upstream. + +Drivers that enable runtime PM must make sure that the controller is +runtime resumed before accessing its registers to prevent the power +domain from being disabled. + +Fixes: 4ab43d171181 ("clk: qcom: Add lpass clock controller driver for SC7280") +Cc: stable@vger.kernel.org # 5.16 +Cc: Taniya Das +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230718132902.21430-6-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/lpasscc-sc7280.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/clk/qcom/lpasscc-sc7280.c ++++ b/drivers/clk/qcom/lpasscc-sc7280.c +@@ -115,9 +115,13 @@ static int lpass_cc_sc7280_probe(struct + ret = pm_clk_add(&pdev->dev, "iface"); + if (ret < 0) { + dev_err(&pdev->dev, "failed to acquire iface clock\n"); +- goto destroy_pm_clk; ++ goto err_destroy_pm_clk; + } + ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret) ++ goto err_destroy_pm_clk; ++ + if (!of_property_read_bool(pdev->dev.of_node, "qcom,adsp-pil-mode")) { + lpass_regmap_config.name = "qdsp6ss"; + lpass_regmap_config.max_register = 0x3f; +@@ -125,7 +129,7 @@ static int lpass_cc_sc7280_probe(struct + + ret = qcom_cc_probe_by_index(pdev, 0, desc); + if (ret) +- goto destroy_pm_clk; ++ goto err_put_rpm; + } + + lpass_regmap_config.name = "top_cc"; +@@ -134,11 +138,15 @@ static int lpass_cc_sc7280_probe(struct + + ret = qcom_cc_probe_by_index(pdev, 1, desc); + if (ret) +- goto destroy_pm_clk; ++ goto err_put_rpm; ++ ++ pm_runtime_put(&pdev->dev); + + return 0; + +-destroy_pm_clk: ++err_put_rpm: ++ pm_runtime_put_sync(&pdev->dev); ++err_destroy_pm_clk: + pm_clk_destroy(&pdev->dev); + + disable_pm_runtime: diff --git a/queue-6.1/clk-qcom-mss-sc7180-fix-missing-resume-during-probe.patch b/queue-6.1/clk-qcom-mss-sc7180-fix-missing-resume-during-probe.patch new file mode 100644 index 00000000000..d9d20635646 --- /dev/null +++ b/queue-6.1/clk-qcom-mss-sc7180-fix-missing-resume-during-probe.patch @@ -0,0 +1,50 @@ +From e2349da0fa7ca822cda72f427345b95795358fe7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 18 Jul 2023 15:29:01 +0200 +Subject: clk: qcom: mss-sc7180: fix missing resume during probe + +From: Johan Hovold + +commit e2349da0fa7ca822cda72f427345b95795358fe7 upstream. + +Drivers that enable runtime PM must make sure that the controller is +runtime resumed before accessing its registers to prevent the power +domain from being disabled. + +Fixes: 8def929c4097 ("clk: qcom: Add modem clock controller driver for SC7180") +Cc: stable@vger.kernel.org # 5.7 +Cc: Taniya Das +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230718132902.21430-8-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/mss-sc7180.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/clk/qcom/mss-sc7180.c ++++ b/drivers/clk/qcom/mss-sc7180.c +@@ -87,11 +87,22 @@ static int mss_sc7180_probe(struct platf + return ret; + } + ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret) ++ return ret; ++ + ret = qcom_cc_probe(pdev, &mss_sc7180_desc); + if (ret < 0) +- return ret; ++ goto err_put_rpm; ++ ++ pm_runtime_put(&pdev->dev); + + return 0; ++ ++err_put_rpm: ++ pm_runtime_put_sync(&pdev->dev); ++ ++ return ret; + } + + static const struct dev_pm_ops mss_sc7180_pm_ops = { diff --git a/queue-6.1/clk-qcom-q6sstop-qcs404-fix-missing-resume-during-probe.patch b/queue-6.1/clk-qcom-q6sstop-qcs404-fix-missing-resume-during-probe.patch new file mode 100644 index 00000000000..4f8b8b7705d --- /dev/null +++ b/queue-6.1/clk-qcom-q6sstop-qcs404-fix-missing-resume-during-probe.patch @@ -0,0 +1,60 @@ +From 97112c83f4671a4a722f99a53be4e91fac4091bc Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 18 Jul 2023 15:29:00 +0200 +Subject: clk: qcom: q6sstop-qcs404: fix missing resume during probe + +From: Johan Hovold + +commit 97112c83f4671a4a722f99a53be4e91fac4091bc upstream. + +Drivers that enable runtime PM must make sure that the controller is +runtime resumed before accessing its registers to prevent the power +domain from being disabled. + +Fixes: 6cdef2738db0 ("clk: qcom: Add Q6SSTOP clock controller for QCS404") +Cc: stable@vger.kernel.org # 5.5 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230718132902.21430-7-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/q6sstop-qcs404.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/clk/qcom/q6sstop-qcs404.c ++++ b/drivers/clk/qcom/q6sstop-qcs404.c +@@ -174,21 +174,32 @@ static int q6sstopcc_qcs404_probe(struct + return ret; + } + ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret) ++ return ret; ++ + q6sstop_regmap_config.name = "q6sstop_tcsr"; + desc = &tcsr_qcs404_desc; + + ret = qcom_cc_probe_by_index(pdev, 1, desc); + if (ret) +- return ret; ++ goto err_put_rpm; + + q6sstop_regmap_config.name = "q6sstop_cc"; + desc = &q6sstop_qcs404_desc; + + ret = qcom_cc_probe_by_index(pdev, 0, desc); + if (ret) +- return ret; ++ goto err_put_rpm; ++ ++ pm_runtime_put(&pdev->dev); + + return 0; ++ ++err_put_rpm: ++ pm_runtime_put_sync(&pdev->dev); ++ ++ return ret; + } + + static const struct dev_pm_ops q6sstopcc_pm_ops = { diff --git a/queue-6.1/clk-qcom-turingcc-qcs404-fix-missing-resume-during-probe.patch b/queue-6.1/clk-qcom-turingcc-qcs404-fix-missing-resume-during-probe.patch new file mode 100644 index 00000000000..e578c07418d --- /dev/null +++ b/queue-6.1/clk-qcom-turingcc-qcs404-fix-missing-resume-during-probe.patch @@ -0,0 +1,50 @@ +From a9f71a033587c9074059132d34c74eabbe95ef26 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 18 Jul 2023 15:29:02 +0200 +Subject: clk: qcom: turingcc-qcs404: fix missing resume during probe + +From: Johan Hovold + +commit a9f71a033587c9074059132d34c74eabbe95ef26 upstream. + +Drivers that enable runtime PM must make sure that the controller is +runtime resumed before accessing its registers to prevent the power +domain from being disabled. + +Fixes: 892df0191b29 ("clk: qcom: Add QCS404 TuringCC") +Cc: stable@vger.kernel.org # 5.2 +Cc: Bjorn Andersson +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230718132902.21430-9-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/turingcc-qcs404.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/clk/qcom/turingcc-qcs404.c ++++ b/drivers/clk/qcom/turingcc-qcs404.c +@@ -125,11 +125,22 @@ static int turingcc_probe(struct platfor + return ret; + } + ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret) ++ return ret; ++ + ret = qcom_cc_probe(pdev, &turingcc_desc); + if (ret < 0) +- return ret; ++ goto err_put_rpm; ++ ++ pm_runtime_put(&pdev->dev); + + return 0; ++ ++err_put_rpm: ++ pm_runtime_put_sync(&pdev->dev); ++ ++ return ret; + } + + static const struct dev_pm_ops turingcc_pm_ops = { diff --git a/queue-6.1/drm-ast-fix-dram-init-on-ast2200.patch b/queue-6.1/drm-ast-fix-dram-init-on-ast2200.patch new file mode 100644 index 00000000000..4fa04c62e53 --- /dev/null +++ b/queue-6.1/drm-ast-fix-dram-init-on-ast2200.patch @@ -0,0 +1,41 @@ +From 4cfe75f0f14f044dae66ad0e6eea812d038465d9 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Wed, 21 Jun 2023 14:53:35 +0200 +Subject: drm/ast: Fix DRAM init on AST2200 + +From: Thomas Zimmermann + +commit 4cfe75f0f14f044dae66ad0e6eea812d038465d9 upstream. + +Fix the test for the AST2200 in the DRAM initialization. The value +in ast->chip has to be compared against an enum constant instead of +a numerical value. + +This bug got introduced when the driver was first imported into the +kernel. + +Signed-off-by: Thomas Zimmermann +Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") +Cc: Dave Airlie +Cc: dri-devel@lists.freedesktop.org +Cc: # v3.5+ +Reviewed-by: Sui Jingfeng +Reviewed-by: Jocelyn Falempe +Tested-by: Jocelyn Falempe # AST2600 +Link: https://patchwork.freedesktop.org/patch/msgid/20230621130032.3568-2-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ast/ast_post.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -291,7 +291,7 @@ static void ast_init_dram_reg(struct drm + ; + } while (ast_read32(ast, 0x10100) != 0xa8); + } else {/* AST2100/1100 */ +- if (ast->chip == AST2100 || ast->chip == 2200) ++ if (ast->chip == AST2100 || ast->chip == AST2200) + dram_reg_info = ast2100_dram_table_data; + else + dram_reg_info = ast1100_dram_table_data; diff --git a/queue-6.1/dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch b/queue-6.1/dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch new file mode 100644 index 00000000000..3236dc2cfe6 --- /dev/null +++ b/queue-6.1/dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch @@ -0,0 +1,35 @@ +From 172044e30b00977784269e8ab72132a48293c654 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 28 Jul 2023 18:59:23 +0200 +Subject: dt-bindings: clock: xlnx,versal-clk: drop select:false + +From: Krzysztof Kozlowski + +commit 172044e30b00977784269e8ab72132a48293c654 upstream. + +select:false makes the schema basically ignored and not effective, which +is clearly not what we want for a device binding. + +Fixes: 352546805a44 ("dt-bindings: clock: Add bindings for versal clock driver") +Cc: +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230728165923.108589-1-krzysztof.kozlowski@linaro.org +Reviewed-by: Conor Dooley +Reviewed-by: Shubhrajyoti Datta +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 -- + 1 file changed, 2 deletions(-) + +--- a/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml ++++ b/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml +@@ -16,8 +16,6 @@ description: | + reads required input clock frequencies from the devicetree and acts as clock + provider for all clock consumers of PS clocks. + +-select: false +- + properties: + compatible: + const: xlnx,versal-clk diff --git a/queue-6.1/fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch b/queue-6.1/fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch new file mode 100644 index 00000000000..1241a9ddb58 --- /dev/null +++ b/queue-6.1/fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch @@ -0,0 +1,40 @@ +From f90a0e5265b60cdd3c77990e8105f79aa2fac994 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 13 Jun 2023 13:06:49 +0200 +Subject: fbdev/ep93xx-fb: Do not assign to struct fb_info.dev + +From: Thomas Zimmermann + +commit f90a0e5265b60cdd3c77990e8105f79aa2fac994 upstream. + +Do not assing the Linux device to struct fb_info.dev. The call to +register_framebuffer() initializes the field to the fbdev device. +Drivers should not override its value. + +Fixes a bug where the driver incorrectly decreases the hardware +device's reference counter and leaks the fbdev device. + +v2: + * add Fixes tag (Dan) + +Signed-off-by: Thomas Zimmermann +Fixes: 88017bda96a5 ("ep93xx video driver") +Cc: # v2.6.32+ +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-15-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/ep93xx-fb.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/video/fbdev/ep93xx-fb.c ++++ b/drivers/video/fbdev/ep93xx-fb.c +@@ -474,7 +474,6 @@ static int ep93xxfb_probe(struct platfor + if (!info) + return -ENOMEM; + +- info->dev = &pdev->dev; + platform_set_drvdata(pdev, info); + fbi = info->par; + fbi->mach_info = mach_info; diff --git a/queue-6.1/lib-test_meminit-allocate-pages-up-to-order-max_order.patch b/queue-6.1/lib-test_meminit-allocate-pages-up-to-order-max_order.patch new file mode 100644 index 00000000000..c590be61284 --- /dev/null +++ b/queue-6.1/lib-test_meminit-allocate-pages-up-to-order-max_order.patch @@ -0,0 +1,44 @@ +From efb78fa86e95832b78ca0ba60f3706788a818938 Mon Sep 17 00:00:00 2001 +From: Andrew Donnellan +Date: Fri, 14 Jul 2023 11:52:38 +1000 +Subject: lib/test_meminit: allocate pages up to order MAX_ORDER + +From: Andrew Donnellan + +commit efb78fa86e95832b78ca0ba60f3706788a818938 upstream. + +test_pages() tests the page allocator by calling alloc_pages() with +different orders up to order 10. + +However, different architectures and platforms support different maximum +contiguous allocation sizes. The default maximum allocation order +(MAX_ORDER) is 10, but architectures can use CONFIG_ARCH_FORCE_MAX_ORDER +to override this. On platforms where this is less than 10, test_meminit() +will blow up with a WARN(). This is expected, so let's not do that. + +Replace the hardcoded "10" with the MAX_ORDER macro so that we test +allocations up to the expected platform limit. + +Link: https://lkml.kernel.org/r/20230714015238.47931-1-ajd@linux.ibm.com +Fixes: 5015a300a522 ("lib: introduce test_meminit module") +Signed-off-by: Andrew Donnellan +Reviewed-by: Alexander Potapenko +Cc: Xiaoke Wang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + lib/test_meminit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/test_meminit.c ++++ b/lib/test_meminit.c +@@ -93,7 +93,7 @@ static int __init test_pages(int *total_ + int failures = 0, num_tests = 0; + int i; + +- for (i = 0; i < 10; i++) ++ for (i = 0; i <= MAX_ORDER; i++) + num_tests += do_alloc_pages_order(i, &failures); + + REPORT_FAILURES_IN_FN(); diff --git a/queue-6.1/memcg-drop-kmem.limit_in_bytes.patch b/queue-6.1/memcg-drop-kmem.limit_in_bytes.patch new file mode 100644 index 00000000000..752bee8e760 --- /dev/null +++ b/queue-6.1/memcg-drop-kmem.limit_in_bytes.patch @@ -0,0 +1,86 @@ +From 86327e8eb94c52eca4f93cfece2e29d1bf52acbf Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Tue, 4 Jul 2023 13:52:40 +0200 +Subject: memcg: drop kmem.limit_in_bytes + +From: Michal Hocko + +commit 86327e8eb94c52eca4f93cfece2e29d1bf52acbf upstream. + +kmem.limit_in_bytes (v1 way to limit kernel memory usage) has been +deprecated since 58056f77502f ("memcg, kmem: further deprecate +kmem.limit_in_bytes") merged in 5.16. We haven't heard about any serious +users since then but it seems that the mere presence of the file is +causing more harm thatn good. We (SUSE) have had several bug reports from +customers where Docker based containers started to fail because a write to +kmem.limit_in_bytes has failed. + +This was unexpected because runc code only expects ENOENT (kmem disabled) +or EBUSY (tasks already running within cgroup). So a new error code was +unexpected and the whole container startup failed. This has been later +addressed by +https://github.com/opencontainers/runc/commit/52390d68040637dfc77f9fda6bbe70952423d380 +so current Docker runtimes do not suffer from the problem anymore. There +are still older version of Docker in use and likely hard to get rid of +completely. + +Address this by wiping out the file completely and effectively get back to +pre 4.5 era and CONFIG_MEMCG_KMEM=n configuration. + +I would recommend backporting to stable trees which have picked up +58056f77502f ("memcg, kmem: further deprecate kmem.limit_in_bytes"). + +[mhocko@suse.com: restore _KMEM switch case] + Link: https://lkml.kernel.org/r/ZKe5wxdbvPi5Cwd7@dhcp22.suse.cz +Link: https://lkml.kernel.org/r/20230704115240.14672-1-mhocko@kernel.org +Signed-off-by: Michal Hocko +Acked-by: Shakeel Butt +Acked-by: Johannes Weiner +Acked-by: Roman Gushchin +Cc: Muchun Song +Cc: Tejun Heo +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/cgroup-v1/memory.rst | 2 -- + mm/memcontrol.c | 10 ---------- + 2 files changed, 12 deletions(-) + +--- a/Documentation/admin-guide/cgroup-v1/memory.rst ++++ b/Documentation/admin-guide/cgroup-v1/memory.rst +@@ -91,8 +91,6 @@ Brief summary of control files. + memory.oom_control set/show oom controls. + memory.numa_stat show the number of memory usage per numa + node +- memory.kmem.limit_in_bytes This knob is deprecated and writing to +- it will return -ENOTSUPP. + memory.kmem.usage_in_bytes show current kernel memory allocation + memory.kmem.failcnt show the number of kernel memory usage + hits limits +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3841,10 +3841,6 @@ static ssize_t mem_cgroup_write(struct k + case _MEMSWAP: + ret = mem_cgroup_resize_max(memcg, nr_pages, true); + break; +- case _KMEM: +- /* kmem.limit_in_bytes is deprecated. */ +- ret = -EOPNOTSUPP; +- break; + case _TCP: + ret = memcg_update_tcp_max(memcg, nr_pages); + break; +@@ -5056,12 +5052,6 @@ static struct cftype mem_cgroup_legacy_f + }, + #endif + { +- .name = "kmem.limit_in_bytes", +- .private = MEMFILE_PRIVATE(_KMEM, RES_LIMIT), +- .write = mem_cgroup_write, +- .read_u64 = mem_cgroup_read_u64, +- }, +- { + .name = "kmem.usage_in_bytes", + .private = MEMFILE_PRIVATE(_KMEM, RES_USAGE), + .read_u64 = mem_cgroup_read_u64, diff --git a/queue-6.1/mm-hugetlb_vmemmap-fix-a-race-between-vmemmap-pmd-split.patch b/queue-6.1/mm-hugetlb_vmemmap-fix-a-race-between-vmemmap-pmd-split.patch new file mode 100644 index 00000000000..c3f2abd1bb1 --- /dev/null +++ b/queue-6.1/mm-hugetlb_vmemmap-fix-a-race-between-vmemmap-pmd-split.patch @@ -0,0 +1,100 @@ +From 3ce2c24cb68f228590a053d6058a5901cd31af61 Mon Sep 17 00:00:00 2001 +From: Muchun Song +Date: Fri, 7 Jul 2023 11:38:59 +0800 +Subject: mm: hugetlb_vmemmap: fix a race between vmemmap pmd split + +From: Muchun Song + +commit 3ce2c24cb68f228590a053d6058a5901cd31af61 upstream. + +The local variable @page in __split_vmemmap_huge_pmd() to obtain a pmd +page without holding page_table_lock may possiblely get the page table +page instead of a huge pmd page. + +The effect may be in set_pte_at() since we may pass an invalid page +struct, if set_pte_at() wants to access the page struct (e.g. +CONFIG_PAGE_TABLE_CHECK is enabled), it may crash the kernel. + +So fix it. And inline __split_vmemmap_huge_pmd() since it only has one +user. + +Link: https://lkml.kernel.org/r/20230707033859.16148-1-songmuchun@bytedance.com +Fixes: d8d55f5616cf ("mm: sparsemem: use page table lock to protect kernel pmd operations") +Signed-off-by: Muchun Song +Cc: Mike Kravetz +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/hugetlb_vmemmap.c | 34 ++++++++++++++-------------------- + 1 file changed, 14 insertions(+), 20 deletions(-) + +--- a/mm/hugetlb_vmemmap.c ++++ b/mm/hugetlb_vmemmap.c +@@ -36,14 +36,22 @@ struct vmemmap_remap_walk { + struct list_head *vmemmap_pages; + }; + +-static int __split_vmemmap_huge_pmd(pmd_t *pmd, unsigned long start) ++static int split_vmemmap_huge_pmd(pmd_t *pmd, unsigned long start) + { + pmd_t __pmd; + int i; + unsigned long addr = start; +- struct page *page = pmd_page(*pmd); +- pte_t *pgtable = pte_alloc_one_kernel(&init_mm); ++ struct page *head; ++ pte_t *pgtable; ++ ++ spin_lock(&init_mm.page_table_lock); ++ head = pmd_leaf(*pmd) ? pmd_page(*pmd) : NULL; ++ spin_unlock(&init_mm.page_table_lock); + ++ if (!head) ++ return 0; ++ ++ pgtable = pte_alloc_one_kernel(&init_mm); + if (!pgtable) + return -ENOMEM; + +@@ -53,7 +61,7 @@ static int __split_vmemmap_huge_pmd(pmd_ + pte_t entry, *pte; + pgprot_t pgprot = PAGE_KERNEL; + +- entry = mk_pte(page + i, pgprot); ++ entry = mk_pte(head + i, pgprot); + pte = pte_offset_kernel(&__pmd, addr); + set_pte_at(&init_mm, addr, pte, entry); + } +@@ -65,8 +73,8 @@ static int __split_vmemmap_huge_pmd(pmd_ + * be treated as indepdenent small pages (as they can be freed + * individually). + */ +- if (!PageReserved(page)) +- split_page(page, get_order(PMD_SIZE)); ++ if (!PageReserved(head)) ++ split_page(head, get_order(PMD_SIZE)); + + /* Make pte visible before pmd. See comment in pmd_install(). */ + smp_wmb(); +@@ -80,20 +88,6 @@ static int __split_vmemmap_huge_pmd(pmd_ + return 0; + } + +-static int split_vmemmap_huge_pmd(pmd_t *pmd, unsigned long start) +-{ +- int leaf; +- +- spin_lock(&init_mm.page_table_lock); +- leaf = pmd_leaf(*pmd); +- spin_unlock(&init_mm.page_table_lock); +- +- if (!leaf) +- return 0; +- +- return __split_vmemmap_huge_pmd(pmd, start); +-} +- + static void vmemmap_pte_range(pmd_t *pmd, unsigned long addr, + unsigned long end, + struct vmemmap_remap_walk *walk) diff --git a/queue-6.1/nfs-fix-a-potential-data-corruption.patch b/queue-6.1/nfs-fix-a-potential-data-corruption.patch new file mode 100644 index 00000000000..98d2db90943 --- /dev/null +++ b/queue-6.1/nfs-fix-a-potential-data-corruption.patch @@ -0,0 +1,60 @@ +From 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 19 Aug 2023 17:22:14 -0400 +Subject: NFS: Fix a potential data corruption + +From: Trond Myklebust + +commit 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 upstream. + +We must ensure that the subrequests are joined back into the head before +we can retransmit a request. If the head was not on the commit lists, +because the server wrote it synchronously, we still need to add it back +to the retransmission list. +Add a call that mirrors the effect of nfs_cancel_remove_inode() for +O_DIRECT. + +Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/direct.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -474,13 +474,31 @@ out: + return result; + } + ++static void nfs_direct_add_page_head(struct list_head *list, ++ struct nfs_page *req) ++{ ++ struct nfs_page *head = req->wb_head; ++ ++ if (!list_empty(&head->wb_list) || !nfs_lock_request(head)) ++ return; ++ if (!list_empty(&head->wb_list)) { ++ nfs_unlock_request(head); ++ return; ++ } ++ list_add(&head->wb_list, list); ++ kref_get(&head->wb_kref); ++ kref_get(&head->wb_kref); ++} ++ + static void nfs_direct_join_group(struct list_head *list, struct inode *inode) + { + struct nfs_page *req, *subreq; + + list_for_each_entry(req, list, wb_list) { +- if (req->wb_head != req) ++ if (req->wb_head != req) { ++ nfs_direct_add_page_head(&req->wb_list, req); + continue; ++ } + subreq = req->wb_this_page; + if (subreq == req) + continue; diff --git a/queue-6.1/nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch b/queue-6.1/nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch new file mode 100644 index 00000000000..69700caec68 --- /dev/null +++ b/queue-6.1/nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch @@ -0,0 +1,35 @@ +From 96562c45af5c31b89a197af28f79bfa838fb8391 Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin +Date: Thu, 20 Jul 2023 18:37:51 +0300 +Subject: NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info + +From: Fedor Pchelkin + +commit 96562c45af5c31b89a197af28f79bfa838fb8391 upstream. + +It is an almost improbable error case but when page allocating loop in +nfs4_get_device_info() fails then we should only free the already +allocated pages, as __free_page() can't deal with NULL arguments. + +Found by Linux Verification Center (linuxtesting.org). + +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/pnfs_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/pnfs_dev.c ++++ b/fs/nfs/pnfs_dev.c +@@ -154,7 +154,7 @@ nfs4_get_device_info(struct nfs_server * + set_bit(NFS_DEVICEID_NOCACHE, &d->flags); + + out_free_pages: +- for (i = 0; i < max_pages; i++) ++ while (--i >= 0) + __free_page(pages[i]); + kfree(pages); + out_free_pdev: diff --git a/queue-6.1/null_blk-fix-poll-request-timeout-handling.patch b/queue-6.1/null_blk-fix-poll-request-timeout-handling.patch new file mode 100644 index 00000000000..b1d5a93eb84 --- /dev/null +++ b/queue-6.1/null_blk-fix-poll-request-timeout-handling.patch @@ -0,0 +1,109 @@ +From 5a26e45edb4690d58406178b5a9ea4c6dcf2c105 Mon Sep 17 00:00:00 2001 +From: Chengming Zhou +Date: Fri, 1 Sep 2023 20:03:06 +0800 +Subject: null_blk: fix poll request timeout handling + +From: Chengming Zhou + +commit 5a26e45edb4690d58406178b5a9ea4c6dcf2c105 upstream. + +When doing io_uring benchmark on /dev/nullb0, it's easy to crash the +kernel if poll requests timeout triggered, as reported by David. [1] + +BUG: kernel NULL pointer dereference, address: 0000000000000008 +Workqueue: kblockd blk_mq_timeout_work +RIP: 0010:null_timeout_rq+0x4e/0x91 +Call Trace: + ? null_timeout_rq+0x4e/0x91 + blk_mq_handle_expired+0x31/0x4b + bt_iter+0x68/0x84 + ? bt_tags_iter+0x81/0x81 + __sbitmap_for_each_set.constprop.0+0xb0/0xf2 + ? __blk_mq_complete_request_remote+0xf/0xf + bt_for_each+0x46/0x64 + ? __blk_mq_complete_request_remote+0xf/0xf + ? percpu_ref_get_many+0xc/0x2a + blk_mq_queue_tag_busy_iter+0x14d/0x18e + blk_mq_timeout_work+0x95/0x127 + process_one_work+0x185/0x263 + worker_thread+0x1b5/0x227 + +This is indeed a race problem between null_timeout_rq() and null_poll(). + +null_poll() null_timeout_rq() + spin_lock(&nq->poll_lock) + list_splice_init(&nq->poll_list, &list) + spin_unlock(&nq->poll_lock) + + while (!list_empty(&list)) + req = list_first_entry() + list_del_init() + ... + blk_mq_add_to_batch() + // req->rq_next = NULL + spin_lock(&nq->poll_lock) + + // rq->queuelist->next == NULL + list_del_init(&rq->queuelist) + + spin_unlock(&nq->poll_lock) + +Fix these problems by setting requests state to MQ_RQ_COMPLETE under +nq->poll_lock protection, in which null_timeout_rq() can safely detect +this race and early return. + +Note this patch just fix the kernel panic when request timeout happen. + +[1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/ + +Fixes: 0a593fbbc245 ("null_blk: poll queue support") +Reported-by: David Howells +Tested-by: David Howells +Reviewed-by: Ming Lei +Signed-off-by: Chengming Zhou +Link: https://lore.kernel.org/r/20230901120306.170520-2-chengming.zhou@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/null_blk/main.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -1585,9 +1585,12 @@ static int null_poll(struct blk_mq_hw_ct + struct nullb_queue *nq = hctx->driver_data; + LIST_HEAD(list); + int nr = 0; ++ struct request *rq; + + spin_lock(&nq->poll_lock); + list_splice_init(&nq->poll_list, &list); ++ list_for_each_entry(rq, &list, queuelist) ++ blk_mq_set_request_complete(rq); + spin_unlock(&nq->poll_lock); + + while (!list_empty(&list)) { +@@ -1613,16 +1616,21 @@ static enum blk_eh_timer_return null_tim + struct blk_mq_hw_ctx *hctx = rq->mq_hctx; + struct nullb_cmd *cmd = blk_mq_rq_to_pdu(rq); + +- pr_info("rq %p timed out\n", rq); +- + if (hctx->type == HCTX_TYPE_POLL) { + struct nullb_queue *nq = hctx->driver_data; + + spin_lock(&nq->poll_lock); ++ /* The request may have completed meanwhile. */ ++ if (blk_mq_request_completed(rq)) { ++ spin_unlock(&nq->poll_lock); ++ return BLK_EH_DONE; ++ } + list_del_init(&rq->queuelist); + spin_unlock(&nq->poll_lock); + } + ++ pr_info("rq %p timed out\n", rq); ++ + /* + * If the device is marked as blocking (i.e. memory backed or zoned + * device), the submission path may be blocked waiting for resources diff --git a/queue-6.1/parisc-led-fix-lan-receive-and-transmit-leds.patch b/queue-6.1/parisc-led-fix-lan-receive-and-transmit-leds.patch new file mode 100644 index 00000000000..79cffe05820 --- /dev/null +++ b/queue-6.1/parisc-led-fix-lan-receive-and-transmit-leds.patch @@ -0,0 +1,32 @@ +From 4db89524b084f712a887256391fc19d9f66c8e55 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 27 Aug 2023 13:46:11 +0200 +Subject: parisc: led: Fix LAN receive and transmit LEDs + +From: Helge Deller + +commit 4db89524b084f712a887256391fc19d9f66c8e55 upstream. + +Fix the LAN receive and LAN transmit LEDs, which where swapped +up to now. + +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/include/asm/led.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/led.h ++++ b/arch/parisc/include/asm/led.h +@@ -11,8 +11,8 @@ + #define LED1 0x02 + #define LED0 0x01 /* bottom (or furthest left) LED */ + +-#define LED_LAN_TX LED0 /* for LAN transmit activity */ +-#define LED_LAN_RCV LED1 /* for LAN receive activity */ ++#define LED_LAN_RCV LED0 /* for LAN receive activity */ ++#define LED_LAN_TX LED1 /* for LAN transmit activity */ + #define LED_DISK_IO LED2 /* for disk activity */ + #define LED_HEARTBEAT LED3 /* heartbeat */ + diff --git a/queue-6.1/parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch b/queue-6.1/parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch new file mode 100644 index 00000000000..c138b435ac4 --- /dev/null +++ b/queue-6.1/parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch @@ -0,0 +1,38 @@ +From 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 25 Aug 2023 17:46:39 +0200 +Subject: parisc: led: Reduce CPU overhead for disk & lan LED computation + +From: Helge Deller + +commit 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 upstream. + +Older PA-RISC machines have LEDs which show the disk- and LAN-activity. +The computation is done in software and takes quite some time, e.g. on a +J6500 this may take up to 60% time of one CPU if the machine is loaded +via network traffic. + +Since most people don't care about the LEDs, start with LEDs disabled and +just show a CPU heartbeat LED. The disk and LAN LEDs can be turned on +manually via /proc/pdc/led. + +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/led.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/parisc/led.c ++++ b/drivers/parisc/led.c +@@ -56,8 +56,8 @@ + static int led_type __read_mostly = -1; + static unsigned char lastleds; /* LED state from most recent update */ + static unsigned int led_heartbeat __read_mostly = 1; +-static unsigned int led_diskio __read_mostly = 1; +-static unsigned int led_lanrxtx __read_mostly = 1; ++static unsigned int led_diskio __read_mostly; ++static unsigned int led_lanrxtx __read_mostly; + static char lcd_text[32] __read_mostly; + static char lcd_text_default[32] __read_mostly; + static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */ diff --git a/queue-6.1/pinctrl-cherryview-fix-address_space_handler-argument.patch b/queue-6.1/pinctrl-cherryview-fix-address_space_handler-argument.patch new file mode 100644 index 00000000000..f9274ab64ab --- /dev/null +++ b/queue-6.1/pinctrl-cherryview-fix-address_space_handler-argument.patch @@ -0,0 +1,52 @@ +From d5301c90716a8e20bc961a348182daca00c8e8f0 Mon Sep 17 00:00:00 2001 +From: Raag Jadav +Date: Tue, 22 Aug 2023 12:53:40 +0530 +Subject: pinctrl: cherryview: fix address_space_handler() argument + +From: Raag Jadav + +commit d5301c90716a8e20bc961a348182daca00c8e8f0 upstream. + +First argument of acpi_*_address_space_handler() APIs is acpi_handle of +the device, which is incorrectly passed in driver ->remove() path here. +Fix it by passing the appropriate argument and while at it, make both +API calls consistent using ACPI_HANDLE(). + +Fixes: a0b028597d59 ("pinctrl: cherryview: Add support for GMMR GPIO opregion") +Cc: stable@vger.kernel.org +Signed-off-by: Raag Jadav +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1698,7 +1698,6 @@ static int chv_pinctrl_probe(struct plat + struct intel_community_context *cctx; + struct intel_community *community; + struct device *dev = &pdev->dev; +- struct acpi_device *adev = ACPI_COMPANION(dev); + struct intel_pinctrl *pctrl; + acpi_status status; + unsigned int i; +@@ -1766,7 +1765,7 @@ static int chv_pinctrl_probe(struct plat + if (ret) + return ret; + +- status = acpi_install_address_space_handler(adev->handle, ++ status = acpi_install_address_space_handler(ACPI_HANDLE(dev), + community->acpi_space_id, + chv_pinctrl_mmio_access_handler, + NULL, pctrl); +@@ -1783,7 +1782,7 @@ static int chv_pinctrl_remove(struct pla + struct intel_pinctrl *pctrl = platform_get_drvdata(pdev); + const struct intel_community *community = &pctrl->communities[0]; + +- acpi_remove_address_space_handler(ACPI_COMPANION(&pdev->dev), ++ acpi_remove_address_space_handler(ACPI_HANDLE(&pdev->dev), + community->acpi_space_id, + chv_pinctrl_mmio_access_handler); + diff --git a/queue-6.1/send-channel-sequence-number-in-smb3-requests-after-reconnects.patch b/queue-6.1/send-channel-sequence-number-in-smb3-requests-after-reconnects.patch new file mode 100644 index 00000000000..75cb5df571e --- /dev/null +++ b/queue-6.1/send-channel-sequence-number-in-smb3-requests-after-reconnects.patch @@ -0,0 +1,124 @@ +From 09ee7a3bf866c0fa5ee1914d2c65958559eb5b4c Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Thu, 24 Aug 2023 23:29:18 -0500 +Subject: [SMB3] send channel sequence number in SMB3 requests after reconnects + +From: Steve French + +commit 09ee7a3bf866c0fa5ee1914d2c65958559eb5b4c upstream. + +The ChannelSequence field in the SMB3 header is supposed to be +increased after reconnect to allow the server to distinguish +requests from before and after the reconnect. We had always +been setting it to zero. There are cases where incrementing +ChannelSequence on requests after network reconnects can reduce +the chance of data corruptions. + +See MS-SMB2 3.2.4.1 and 3.2.7.1 + +Signed-off-by: Steve French +Cc: stable@vger.kernel.org # 5.16+ +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cifsglob.h | 1 + + fs/smb/client/connect.c | 1 + + fs/smb/client/smb2ops.c | 11 ++++++++++- + fs/smb/client/smb2pdu.c | 11 +++++++++++ + fs/smb/common/smb2pdu.h | 22 ++++++++++++++++++++++ + 5 files changed, 45 insertions(+), 1 deletion(-) + +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -734,6 +734,7 @@ struct TCP_Server_Info { + */ + #define CIFS_SERVER_IS_CHAN(server) (!!(server)->primary_server) + struct TCP_Server_Info *primary_server; ++ __u16 channel_sequence_num; /* incremented on primary channel on each chan reconnect */ + + #ifdef CONFIG_CIFS_SWN_UPCALL + bool use_swn_dstaddr; +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1725,6 +1725,7 @@ cifs_get_tcp_session(struct smb3_fs_cont + ctx->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL); + tcp_ses->session_estab = false; + tcp_ses->sequence_number = 0; ++ tcp_ses->channel_sequence_num = 0; /* only tracked for primary channel */ + tcp_ses->reconnect_instance = 1; + tcp_ses->lstrp = jiffies; + tcp_ses->compress_algorithm = cpu_to_le16(ctx->compression); +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -167,8 +167,17 @@ smb2_set_credits(struct TCP_Server_Info + + spin_lock(&server->req_lock); + server->credits = val; +- if (val == 1) ++ if (val == 1) { + server->reconnect_instance++; ++ /* ++ * ChannelSequence updated for all channels in primary channel so that consistent ++ * across SMB3 requests sent on any channel. See MS-SMB2 3.2.4.1 and 3.2.7.1 ++ */ ++ if (CIFS_SERVER_IS_CHAN(server)) ++ server->primary_server->channel_sequence_num++; ++ else ++ server->channel_sequence_num++; ++ } + scredits = server->credits; + in_flight = server->in_flight; + spin_unlock(&server->req_lock); +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -88,9 +88,20 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, + const struct cifs_tcon *tcon, + struct TCP_Server_Info *server) + { ++ struct smb3_hdr_req *smb3_hdr; + shdr->ProtocolId = SMB2_PROTO_NUMBER; + shdr->StructureSize = cpu_to_le16(64); + shdr->Command = smb2_cmd; ++ if (server->dialect >= SMB30_PROT_ID) { ++ /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ ++ smb3_hdr = (struct smb3_hdr_req *)shdr; ++ /* if primary channel is not set yet, use default channel for chan sequence num */ ++ if (CIFS_SERVER_IS_CHAN(server)) ++ smb3_hdr->ChannelSequence = ++ cpu_to_le16(server->primary_server->channel_sequence_num); ++ else ++ smb3_hdr->ChannelSequence = cpu_to_le16(server->channel_sequence_num); ++ } + if (server) { + spin_lock(&server->req_lock); + /* Request up to 10 credits but don't go over the limit. */ +--- a/fs/smb/common/smb2pdu.h ++++ b/fs/smb/common/smb2pdu.h +@@ -153,6 +153,28 @@ struct smb2_hdr { + __u8 Signature[16]; + } __packed; + ++struct smb3_hdr_req { ++ __le32 ProtocolId; /* 0xFE 'S' 'M' 'B' */ ++ __le16 StructureSize; /* 64 */ ++ __le16 CreditCharge; /* MBZ */ ++ __le16 ChannelSequence; /* See MS-SMB2 3.2.4.1 and 3.2.7.1 */ ++ __le16 Reserved; ++ __le16 Command; ++ __le16 CreditRequest; /* CreditResponse */ ++ __le32 Flags; ++ __le32 NextCommand; ++ __le64 MessageId; ++ union { ++ struct { ++ __le32 ProcessId; ++ __le32 TreeId; ++ } __packed SyncId; ++ __le64 AsyncId; ++ } __packed Id; ++ __le64 SessionId; ++ __u8 Signature[16]; ++} __packed; ++ + struct smb2_pdu { + struct smb2_hdr hdr; + __le16 StructureSize2; /* size of wct area (varies, request specific) */ diff --git a/queue-6.1/series b/queue-6.1/series index a6f44e2f8a0..fcd3362fc15 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -22,3 +22,30 @@ scsi-qla2xxx-flush-mailbox-commands-on-chip-reset.patch scsi-qla2xxx-fix-smatch-warn-for-qla_init_iocb_limit.patch scsi-qla2xxx-error-code-did-not-return-to-upper-layer.patch scsi-qla2xxx-fix-firmware-resource-tracking.patch +null_blk-fix-poll-request-timeout-handling.patch +fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch +clk-qcom-camcc-sc7180-fix-async-resume-during-probe.patch +drm-ast-fix-dram-init-on-ast2200.patch +asoc-tegra-fix-sfc-conversion-for-few-rates.patch +clk-qcom-turingcc-qcs404-fix-missing-resume-during-probe.patch +arm64-dts-renesas-rzg2l-fix-txdv-skew-psec-typos.patch +send-channel-sequence-number-in-smb3-requests-after-reconnects.patch +memcg-drop-kmem.limit_in_bytes.patch +mm-hugetlb_vmemmap-fix-a-race-between-vmemmap-pmd-split.patch +lib-test_meminit-allocate-pages-up-to-order-max_order.patch +parisc-led-fix-lan-receive-and-transmit-leds.patch +parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch +cifs-update-desired-access-while-requesting-for-directory-lease.patch +pinctrl-cherryview-fix-address_space_handler-argument.patch +dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch +clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch +clk-imx-pll14xx-align-pdiv-with-reference-manual.patch +clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch +soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch +clk-qcom-dispcc-sm8450-fix-runtime-pm-imbalance-on-probe-errors.patch +clk-qcom-lpasscc-sc7280-fix-missing-resume-during-probe.patch +clk-qcom-q6sstop-qcs404-fix-missing-resume-during-probe.patch +clk-qcom-mss-sc7180-fix-missing-resume-during-probe.patch +nfs-fix-a-potential-data-corruption.patch +nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch +bus-mhi-host-skip-mhi-reset-if-device-is-in-rddm.patch diff --git a/queue-6.1/soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch b/queue-6.1/soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch new file mode 100644 index 00000000000..08ff006e4cf --- /dev/null +++ b/queue-6.1/soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch @@ -0,0 +1,38 @@ +From 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 Mon Sep 17 00:00:00 2001 +From: Chris Lew +Date: Tue, 1 Aug 2023 12:17:12 +0530 +Subject: soc: qcom: qmi_encdec: Restrict string length in decode + +From: Chris Lew + +commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 upstream. + +The QMI TLV value for strings in a lot of qmi element info structures +account for null terminated strings with MAX_LEN + 1. If a string is +actually MAX_LEN + 1 length, this will cause an out of bounds access +when the NULL character is appended in decoding. + +Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder") +Cc: stable@vger.kernel.org +Signed-off-by: Chris Lew +Signed-off-by: Praveenkumar I +Link: https://lore.kernel.org/r/20230801064712.3590128-1-quic_ipkumar@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/qmi_encdec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/soc/qcom/qmi_encdec.c ++++ b/drivers/soc/qcom/qmi_encdec.c +@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(const + decoded_bytes += rc; + } + +- if (string_len > temp_ei->elem_len) { +- pr_err("%s: String len %d > Max Len %d\n", ++ if (string_len >= temp_ei->elem_len) { ++ pr_err("%s: String len %d >= Max Len %d\n", + __func__, string_len, temp_ei->elem_len); + return -ETOOSMALL; + } else if (string_len > tlv_len) {