From 00d6175aa58326e7c050215cd0adaff23e11b75c Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 8 Oct 2022 22:12:19 -0400 Subject: [PATCH] Fixes for 5.19 Signed-off-by: Sasha Levin --- ...x-the-converter-reuse-for-the-silent.patch | 42 +++++ ...-stack-non-executable-to-fix-a-binut.patch | 85 +++++++++ ...-sdio-compatible-remove-sdhci-misnom.patch | 77 ++++++++ ...hip-fix-upper-usb-port-on-bpi-r2-pro.patch | 40 ++++ ...se-__kernel_write-on-kmap_local_page.patch | 160 ++++++++++++++++ ..._dma-cleanup-for-fetching-xlnx-num-f.patch | 35 ++++ ..._dma-fix-devm_platform_ioremap_resou.patch | 67 +++++++ ..._dma-report-error-in-case-of-dma_set.patch | 47 +++++ ...assume-an-lttpr-is-always-present-on.patch | 49 +++++ ...fix-double-cursor-on-non-video-rgb-m.patch | 81 ++++++++ ...fix-dp-mst-timeslot-issue-when-fallb.patch | 52 ++++++ ...increase-dcn315-pstate-change-latenc.patch | 100 ++++++++++ ...skip-audio-setup-when-audio-stream-i.patch | 54 ++++++ ...update-gamut-remap-if-plane-has-chan.patch | 43 +++++ ...ero-the-sdma_hqd_mask-of-2nd-sdma-en.patch | 39 ++++ ...mi-add-scmi-pm-driver-remove-routine.patch | 81 ++++++++ ...i-harden-accesses-to-the-sensor-doma.patch | 105 +++++++++++ ...i-improve-checks-in-the-info_get-ope.patch | 84 +++++++++ ...pio-ftgpio010-make-irqchip-immutable.patch | 93 ++++++++++ ...pm-disable-depth-imbalance-in-davinc.patch | 46 +++++ ...-pass-initialized-arg-even-if-unused.patch | 88 +++++++++ ...-potential-memory-leak-in-aq_ndev_cl.patch | 42 +++++ ...ix-uninit-value-bug-in-dgram_sendmsg.patch | 173 ++++++++++++++++++ ...prestera-add-support-for-for-aldrin2.patch | 37 ++++ ...ix-unchecked-msr-access-error-for-al.patch | 163 +++++++++++++++++ ...i-qedf-fix-a-uaf-bug-in-__qedf_probe.patch | 76 ++++++++ queue-5.19/series | 29 +++ ...iler-warning-in-arch-x86-um-tls_32.c.patch | 70 +++++++ ...call_handler_t-cast-in-syscalls_32.h.patch | 41 +++++ ...-don-t-spam-logs-with-nss-2-messages.patch | 44 +++++ 30 files changed, 2143 insertions(+) create mode 100644 queue-5.19/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch create mode 100644 queue-5.19/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch create mode 100644 queue-5.19/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch create mode 100644 queue-5.19/arm64-dts-rockchip-fix-upper-usb-port-on-bpi-r2-pro.patch create mode 100644 queue-5.19/coredump-don-t-use-__kernel_write-on-kmap_local_page.patch create mode 100644 queue-5.19/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch create mode 100644 queue-5.19/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch create mode 100644 queue-5.19/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch create mode 100644 queue-5.19/drm-amd-display-assume-an-lttpr-is-always-present-on.patch create mode 100644 queue-5.19/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch create mode 100644 queue-5.19/drm-amd-display-fix-dp-mst-timeslot-issue-when-fallb.patch create mode 100644 queue-5.19/drm-amd-display-increase-dcn315-pstate-change-latenc.patch create mode 100644 queue-5.19/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch create mode 100644 queue-5.19/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch create mode 100644 queue-5.19/drm-amdgpu-mes-zero-the-sdma_hqd_mask-of-2nd-sdma-en.patch create mode 100644 queue-5.19/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch create mode 100644 queue-5.19/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch create mode 100644 queue-5.19/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch create mode 100644 queue-5.19/gpio-ftgpio010-make-irqchip-immutable.patch create mode 100644 queue-5.19/i2c-davinci-fix-pm-disable-depth-imbalance-in-davinc.patch create mode 100644 queue-5.19/kvm-s390-pass-initialized-arg-even-if-unused.patch create mode 100644 queue-5.19/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch create mode 100644 queue-5.19/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch create mode 100644 queue-5.19/net-marvell-prestera-add-support-for-for-aldrin2.patch create mode 100644 queue-5.19/perf-x86-intel-fix-unchecked-msr-access-error-for-al.patch create mode 100644 queue-5.19/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch create mode 100644 queue-5.19/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch create mode 100644 queue-5.19/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch create mode 100644 queue-5.19/wifi-iwlwifi-don-t-spam-logs-with-nss-2-messages.patch diff --git a/queue-5.19/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch b/queue-5.19/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch new file mode 100644 index 00000000000..21f53f8daf2 --- /dev/null +++ b/queue-5.19/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch @@ -0,0 +1,42 @@ +From 93403388b99a479ac59190a35638097014d29ab8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 09:02:16 +0200 +Subject: ALSA: hda/hdmi: Fix the converter reuse for the silent stream + +From: Jaroslav Kysela + +[ Upstream commit 5f80d6bd2b01de4cafac3302f58456bf860322fc ] + +When the user space pcm stream uses the silent stream converter, +it is no longer allocated for the silent stream. Clear the appropriate +flag in the hdmi_pcm_open() function. The silent stream setup may +be applied in hdmi_pcm_close() (and the error path - open fcn) again. + +If the flag is not cleared, the reuse conditions for the silent +stream converter in hdmi_choose_cvt() may improperly share +this converter. + +Cc: Kai Vehmanen +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20220913070216.3233974-1-perex@perex.cz +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index c9d9aa6351ec..c239d9dbbaef 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1278,6 +1278,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo, + set_bit(pcm_idx, &spec->pcm_in_use); + per_pin = get_pin(spec, pin_idx); + per_pin->cvt_nid = per_cvt->cvt_nid; ++ per_pin->silent_stream = false; + hinfo->nid = per_cvt->cvt_nid; + + /* flip stripe flag for the assigned stream if supported */ +-- +2.35.1 + diff --git a/queue-5.19/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch b/queue-5.19/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch new file mode 100644 index 00000000000..7717246901d --- /dev/null +++ b/queue-5.19/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch @@ -0,0 +1,85 @@ +From 4011884d5b8e28132b58293ae950dd42b2169aaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 14:48:55 +0800 +Subject: arch: um: Mark the stack non-executable to fix a binutils warning + +From: David Gow + +[ Upstream commit bd71558d585ac61cfd799db7f25e78dca404dd7a ] + +Since binutils 2.39, ld will print a warning if any stack section is +executable, which is the default for stack sections on files without a +.note.GNU-stack section. + +This was fixed for x86 in commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"), +but remained broken for UML, resulting in several warnings: + +/usr/bin/ld: warning: arch/x86/um/vdso/vdso.o: missing .note.GNU-stack section implies executable stack +/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1.o: missing .note.GNU-stack section implies executable stack +/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2 has a LOAD segment with RWX permissions +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2.o: missing .note.GNU-stack section implies executable stack +/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker +/usr/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions + +Link both the VDSO and vmlinux with -z noexecstack, fixing the warnings +about .note.GNU-stack sections. In addition, pass --no-warn-rwx-segments +to dodge the remaining warnings about LOAD segments with RWX permissions +in the kallsyms objects. (Note that this flag is apparently not +available on lld, so hide it behind a test for BFD, which is what the +x86 patch does.) + +Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffcf9c5700e49c0aee42dcba9a12ba21338e8136 +Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 +Signed-off-by: David Gow +Reviewed-by: Lukas Straub +Tested-by: Lukas Straub +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/Makefile | 8 ++++++++ + arch/x86/um/vdso/Makefile | 2 +- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/um/Makefile b/arch/um/Makefile +index f2fe63bfd819..f1d4d67157be 100644 +--- a/arch/um/Makefile ++++ b/arch/um/Makefile +@@ -132,10 +132,18 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT) + # The wrappers will select whether using "malloc" or the kernel allocator. + LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc + ++# Avoid binutils 2.39+ warnings by marking the stack non-executable and ++# ignorning warnings for the kallsyms sections. ++LDFLAGS_EXECSTACK = -z noexecstack ++ifeq ($(CONFIG_LD_IS_BFD),y) ++LDFLAGS_EXECSTACK += $(call ld-option,--no-warn-rwx-segments) ++endif ++ + LD_FLAGS_CMDLINE = $(foreach opt,$(KBUILD_LDFLAGS),-Wl,$(opt)) + + # Used by link-vmlinux.sh which has special support for um link + export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE) ++export LDFLAGS_vmlinux := $(LDFLAGS_EXECSTACK) + + # When cleaning we don't include .config, so we don't include + # TT or skas makefiles and don't clean skas_ptregs.h. +diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile +index 5943387e3f35..5ca366e15c76 100644 +--- a/arch/x86/um/vdso/Makefile ++++ b/arch/x86/um/vdso/Makefile +@@ -62,7 +62,7 @@ quiet_cmd_vdso = VDSO $@ + -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \ + sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' + +-VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv ++VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv -z noexecstack + GCOV_PROFILE := n + + # +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch b/queue-5.19/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch new file mode 100644 index 00000000000..f381b0d730d --- /dev/null +++ b/queue-5.19/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch @@ -0,0 +1,77 @@ +From 365dd33fc4231f2d0316643022df457686f3fc77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 20:53:41 +0300 +Subject: ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer + +From: Sergei Antonov + +[ Upstream commit 02181e68275d28cab3c3f755852770367f1bc229 ] + +Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc". + +But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt +contain compatible = "moxa,moxart-sdhci". + +Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver. + +Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different +controller from FTSDC010. + +Suggested-by: Arnd Bergmann +Signed-off-by: Sergei Antonov +Cc: Jonas Jensen +Link: https://lore.kernel.org/r/20220907175341.1477383-1-saproj@gmail.com' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt | 4 ++-- + arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- + arch/arm/boot/dts/moxart.dtsi | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt +index 8a9f3559335b..7e14e26676ec 100644 +--- a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt ++++ b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt +@@ -34,8 +34,8 @@ Example: + Use specific request line passing from dma + For example, MMC request line is 5 + +- sdhci: sdhci@98e00000 { +- compatible = "moxa,moxart-sdhci"; ++ mmc: mmc@98e00000 { ++ compatible = "moxa,moxart-mmc"; + reg = <0x98e00000 0x5C>; + interrupts = <5 0>; + clocks = <&clk_apb>; +diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts +index eb5291b0ee3a..e07b807b4cec 100644 +--- a/arch/arm/boot/dts/moxart-uc7112lx.dts ++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts +@@ -79,7 +79,7 @@ &clk_pll { + clocks = <&ref12>; + }; + +-&sdhci { ++&mmc { + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi +index f5f070a87482..764832ddfa78 100644 +--- a/arch/arm/boot/dts/moxart.dtsi ++++ b/arch/arm/boot/dts/moxart.dtsi +@@ -93,8 +93,8 @@ watchdog: watchdog@98500000 { + clock-names = "PCLK"; + }; + +- sdhci: sdhci@98e00000 { +- compatible = "moxa,moxart-sdhci"; ++ mmc: mmc@98e00000 { ++ compatible = "moxa,moxart-mmc"; + reg = <0x98e00000 0x5C>; + interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clk_apb>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-fix-upper-usb-port-on-bpi-r2-pro.patch b/queue-5.19/arm64-dts-rockchip-fix-upper-usb-port-on-bpi-r2-pro.patch new file mode 100644 index 00000000000..a55f1dfa676 --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-fix-upper-usb-port-on-bpi-r2-pro.patch @@ -0,0 +1,40 @@ +From 0efef8d2fc246f598fe38b8240d87c3d913bf05d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 14:19:29 +0200 +Subject: arm64: dts: rockchip: fix upper usb port on BPI-R2-Pro + +From: Frank Wunderlich + +[ Upstream commit 388f9f0a7ff84b7890a24499a3a1fea0cad21373 ] + +- extcon is no more needed in 5.19 - so drop it + commit 51a9b2c03dd3 ("phy: rockchip-inno-usb2: Handle ID IRQ") +- dr_mode was changed from host to otg in rk356x.dtsi + commit bc405bb3eeee ("arm64: dts: rockchip: enable otg/drd + operation of usb_host0_xhci in rk356x") + change it back on board level as id-pin on r2pro is not connected + +Signed-off-by: Frank Wunderlich +Link: https://lore.kernel.org/r/20220821121929.244112-1-linux@fw-web.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts +index 40cf2236c0b6..ca48d9a54939 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts +@@ -558,7 +558,7 @@ &usb_host0_ohci { + }; + + &usb_host0_xhci { +- extcon = <&usb2phy0>; ++ dr_mode = "host"; + status = "okay"; + }; + +-- +2.35.1 + diff --git a/queue-5.19/coredump-don-t-use-__kernel_write-on-kmap_local_page.patch b/queue-5.19/coredump-don-t-use-__kernel_write-on-kmap_local_page.patch new file mode 100644 index 00000000000..0b8bec31210 --- /dev/null +++ b/queue-5.19/coredump-don-t-use-__kernel_write-on-kmap_local_page.patch @@ -0,0 +1,160 @@ +From d22c9cd39b144348d351ddf7bac3803a1c45d24c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 11:59:14 -0400 +Subject: [coredump] don't use __kernel_write() on kmap_local_page() + +From: Al Viro + +[ Upstream commit 06bbaa6dc53cb72040db952053432541acb9adc7 ] + +passing kmap_local_page() result to __kernel_write() is unsafe - +random ->write_iter() might (and 9p one does) get unhappy when +passed ITER_KVEC with pointer that came from kmap_local_page(). + +Fix by providing a variant of __kernel_write() that takes an iov_iter +from caller (__kernel_write() becomes a trivial wrapper) and adding +dump_emit_page() that parallels dump_emit(), except that instead of +__kernel_write() it uses __kernel_write_iter() with ITER_BVEC source. + +Fixes: 3159ed57792b "fs/coredump: use kmap_local_page()" +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/coredump.c | 38 +++++++++++++++++++++++++++++++++----- + fs/internal.h | 3 +++ + fs/read_write.c | 22 ++++++++++++++-------- + 3 files changed, 50 insertions(+), 13 deletions(-) + +diff --git a/fs/coredump.c b/fs/coredump.c +index ebc43f960b64..f1355e52614a 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -832,6 +832,38 @@ static int __dump_skip(struct coredump_params *cprm, size_t nr) + } + } + ++static int dump_emit_page(struct coredump_params *cprm, struct page *page) ++{ ++ struct bio_vec bvec = { ++ .bv_page = page, ++ .bv_offset = 0, ++ .bv_len = PAGE_SIZE, ++ }; ++ struct iov_iter iter; ++ struct file *file = cprm->file; ++ loff_t pos = file->f_pos; ++ ssize_t n; ++ ++ if (cprm->to_skip) { ++ if (!__dump_skip(cprm, cprm->to_skip)) ++ return 0; ++ cprm->to_skip = 0; ++ } ++ if (cprm->written + PAGE_SIZE > cprm->limit) ++ return 0; ++ if (dump_interrupted()) ++ return 0; ++ iov_iter_bvec(&iter, WRITE, &bvec, 1, PAGE_SIZE); ++ n = __kernel_write_iter(cprm->file, &iter, &pos); ++ if (n != PAGE_SIZE) ++ return 0; ++ file->f_pos = pos; ++ cprm->written += PAGE_SIZE; ++ cprm->pos += PAGE_SIZE; ++ ++ return 1; ++} ++ + int dump_emit(struct coredump_params *cprm, const void *addr, int nr) + { + if (cprm->to_skip) { +@@ -863,7 +895,6 @@ int dump_user_range(struct coredump_params *cprm, unsigned long start, + + for (addr = start; addr < start + len; addr += PAGE_SIZE) { + struct page *page; +- int stop; + + /* + * To avoid having to allocate page tables for virtual address +@@ -874,10 +905,7 @@ int dump_user_range(struct coredump_params *cprm, unsigned long start, + */ + page = get_dump_page(addr); + if (page) { +- void *kaddr = kmap_local_page(page); +- +- stop = !dump_emit(cprm, kaddr, PAGE_SIZE); +- kunmap_local(kaddr); ++ int stop = !dump_emit_page(cprm, page); + put_page(page); + if (stop) + return 0; +diff --git a/fs/internal.h b/fs/internal.h +index 87e96b9024ce..3e206d3e317c 100644 +--- a/fs/internal.h ++++ b/fs/internal.h +@@ -16,6 +16,7 @@ struct shrink_control; + struct fs_context; + struct user_namespace; + struct pipe_inode_info; ++struct iov_iter; + + /* + * block/bdev.c +@@ -221,3 +222,5 @@ ssize_t do_getxattr(struct user_namespace *mnt_userns, + int setxattr_copy(const char __user *name, struct xattr_ctx *ctx); + int do_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry, + struct xattr_ctx *ctx); ++ ++ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *pos); +diff --git a/fs/read_write.c b/fs/read_write.c +index 397da0236607..a0a3d35e2c0f 100644 +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -509,14 +509,9 @@ static ssize_t new_sync_write(struct file *filp, const char __user *buf, size_t + } + + /* caller is responsible for file_start_write/file_end_write */ +-ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos) ++ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *pos) + { +- struct kvec iov = { +- .iov_base = (void *)buf, +- .iov_len = min_t(size_t, count, MAX_RW_COUNT), +- }; + struct kiocb kiocb; +- struct iov_iter iter; + ssize_t ret; + + if (WARN_ON_ONCE(!(file->f_mode & FMODE_WRITE))) +@@ -532,8 +527,7 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t + + init_sync_kiocb(&kiocb, file); + kiocb.ki_pos = pos ? *pos : 0; +- iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len); +- ret = file->f_op->write_iter(&kiocb, &iter); ++ ret = file->f_op->write_iter(&kiocb, from); + if (ret > 0) { + if (pos) + *pos = kiocb.ki_pos; +@@ -543,6 +537,18 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t + inc_syscw(current); + return ret; + } ++ ++/* caller is responsible for file_start_write/file_end_write */ ++ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos) ++{ ++ struct kvec iov = { ++ .iov_base = (void *)buf, ++ .iov_len = min_t(size_t, count, MAX_RW_COUNT), ++ }; ++ struct iov_iter iter; ++ iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len); ++ return __kernel_write_iter(file, &iter, pos); ++} + /* + * This "EXPORT_SYMBOL_GPL()" is more of a "EXPORT_SYMBOL_DONTUSE()", + * but autofs is one of the few internal kernel users that actually +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch b/queue-5.19/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch new file mode 100644 index 00000000000..11e6a43c199 --- /dev/null +++ b/queue-5.19/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch @@ -0,0 +1,35 @@ +From 2ec3fbd3686c28ee2bb9d6207f03c30459a806e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:24 +0530 +Subject: dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property + +From: Swati Agarwal + +[ Upstream commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 ] + +Free the allocated resources for missing xlnx,num-fstores property. + +Signed-off-by: Swati Agarwal +Link: https://lore.kernel.org/r/20220817061125.4720-3-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index ba0dccaa8cf1..f63ec9d862ff 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3191,7 +3191,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + if (err < 0) { + dev_err(xdev->dev, + "missing xlnx,num-fstores property\n"); +- return err; ++ goto disable_clks; + } + + err = of_property_read_u32(node, "xlnx,flush-fsync", +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch b/queue-5.19/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch new file mode 100644 index 00000000000..98e8e6130f1 --- /dev/null +++ b/queue-5.19/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch @@ -0,0 +1,67 @@ +From fb7dba02c9953b526fb9cad7f7e2b6b337290ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:23 +0530 +Subject: dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error + handling + +From: Swati Agarwal + +[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ] + +Add missing cleanup in devm_platform_ioremap_resource(). +When probe fails remove dma channel resources and disable clocks in +accordance with the order of resources allocated . + +Signed-off-by: Swati Agarwal +Link: https://lore.kernel.org/r/20220817061125.4720-2-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index cd62bbb50e8b..ba0dccaa8cf1 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3160,9 +3160,10 @@ static int xilinx_dma_probe(struct platform_device *pdev) + + /* Request and map I/O memory */ + xdev->regs = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(xdev->regs)) +- return PTR_ERR(xdev->regs); +- ++ if (IS_ERR(xdev->regs)) { ++ err = PTR_ERR(xdev->regs); ++ goto disable_clks; ++ } + /* Retrieve the DMA engine properties from the device tree */ + xdev->max_buffer_len = GENMASK(XILINX_DMA_MAX_TRANS_LEN_MAX - 1, 0); + xdev->s2mm_chan_id = xdev->dma_config->max_channels / 2; +@@ -3259,7 +3260,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + for_each_child_of_node(node, child) { + err = xilinx_dma_child_probe(xdev, child); + if (err < 0) +- goto disable_clks; ++ goto error; + } + + if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) { +@@ -3294,12 +3295,12 @@ static int xilinx_dma_probe(struct platform_device *pdev) + + return 0; + +-disable_clks: +- xdma_disable_allclks(xdev); + error: + for (i = 0; i < xdev->dma_config->max_channels; i++) + if (xdev->chan[i]) + xilinx_dma_chan_remove(xdev->chan[i]); ++disable_clks: ++ xdma_disable_allclks(xdev); + + return err; + } +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch b/queue-5.19/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch new file mode 100644 index 00000000000..b5b319222e6 --- /dev/null +++ b/queue-5.19/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch @@ -0,0 +1,47 @@ +From dc08246055d9edf68ca583cdb661cbdb6cb1f343 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:25 +0530 +Subject: dmaengine: xilinx_dma: Report error in case of + dma_set_mask_and_coherent API failure + +From: Swati Agarwal + +[ Upstream commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 ] + +The driver does not handle the failure case while calling +dma_set_mask_and_coherent API. + +In case of failure, capture the return value of API and then report an +error. + +Addresses-coverity: Unchecked return value (CHECKED_RETURN) + +Signed-off-by: Swati Agarwal +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20220817061125.4720-4-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index f63ec9d862ff..7ce8bb160a59 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3211,7 +3211,11 @@ static int xilinx_dma_probe(struct platform_device *pdev) + xdev->ext_addr = false; + + /* Set the dma mask bits */ +- dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width)); ++ err = dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width)); ++ if (err < 0) { ++ dev_err(xdev->dev, "DMA mask error %d\n", err); ++ goto disable_clks; ++ } + + /* Initialize the DMA engine */ + xdev->common.dev = &pdev->dev; +-- +2.35.1 + diff --git a/queue-5.19/drm-amd-display-assume-an-lttpr-is-always-present-on.patch b/queue-5.19/drm-amd-display-assume-an-lttpr-is-always-present-on.patch new file mode 100644 index 00000000000..4d189e31e9b --- /dev/null +++ b/queue-5.19/drm-amd-display-assume-an-lttpr-is-always-present-on.patch @@ -0,0 +1,49 @@ +From e99d62f410fd47b5784fed11d531ae157630a5e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 15:10:43 -0400 +Subject: drm/amd/display: Assume an LTTPR is always present on fixed_vs links + +From: Michael Strauss + +[ Upstream commit 29956d0fded036a570bd8e7d4ea4b1a1730307d2 ] + +[WHY] +LTTPRs can in very rare instsances fail to increment DPCD LTTPR count. +This results in aux-i LTTPR requests to be sent to the wrong DPCD +address, which causes link training failure. + +[HOW] +Override internal repeater count if fixed_vs flag is set for a given link + +Reviewed-by: George Shen +Acked-by: Wayne Lin +Signed-off-by: Michael Strauss +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index a4fc9a6c850e..0c52506b367d 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -5211,6 +5211,14 @@ bool dp_retrieve_lttpr_cap(struct dc_link *link) + lttpr_dpcd_data[DP_PHY_REPEATER_128B132B_RATES - + DP_LT_TUNABLE_PHY_REPEATER_FIELD_DATA_STRUCTURE_REV]; + ++ /* If this chip cap is set, at least one retimer must exist in the chain ++ * Override count to 1 if we receive a known bad count (0 or an invalid value) */ ++ if (link->chip_caps & EXT_DISPLAY_PATH_CAPS__DP_FIXED_VS_EN && ++ (dp_convert_to_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt) == 0)) { ++ ASSERT(0); ++ link->dpcd_caps.lttpr_caps.phy_repeater_cnt = 0x80; ++ } ++ + /* Attempt to train in LTTPR transparent mode if repeater count exceeds 8. */ + is_lttpr_present = (link->dpcd_caps.lttpr_caps.max_lane_count > 0 && + link->dpcd_caps.lttpr_caps.max_lane_count <= 4 && +-- +2.35.1 + diff --git a/queue-5.19/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch b/queue-5.19/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch new file mode 100644 index 00000000000..8b3b6ffb874 --- /dev/null +++ b/queue-5.19/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch @@ -0,0 +1,81 @@ +From d442b4a525cf89de1364c0befb6989ad90b7e73f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 16:38:16 -0400 +Subject: drm/amd/display: Fix double cursor on non-video RGB MPO + +From: Leo Li + +[ Upstream commit b261509952bc19d1012cf732f853659be6ebc61e ] + +[Why] + +DC makes use of layer_index (zpos) when picking the HW plane to enable +HW cursor on. However, some compositors will not attach zpos information +to each DRM plane. Consequently, in amdgpu, we default layer_index to 0 +and do not update it. + +This causes said DC logic to enable HW cursor on all planes of the same +layer_index, which manifests as a double cursor issue if one of the +planes is scaled (and hence scaling the cursor as well). + +[How] + +Use DRM core helpers to calculate a normalized_zpos value for each +drm_plane_state under each crtc, within the atomic state. + +This helper will first consider existing zpos values, and if +identical/unset, fallback to plane ID ordering. + +The normalized_zpos is then passed to dc_plane_info during atomic check +for later use by the cursor logic. + +Reviewed-by: Bhawanpreet Lakha +Acked-by: Wayne Lin +Signed-off-by: Leo Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 0424570c736f..c781f92db959 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5629,7 +5629,7 @@ fill_dc_plane_info_and_addr(struct amdgpu_device *adev, + plane_info->visible = true; + plane_info->stereo_format = PLANE_STEREO_FORMAT_NONE; + +- plane_info->layer_index = 0; ++ plane_info->layer_index = plane_state->normalized_zpos; + + ret = fill_plane_color_attributes(plane_state, plane_info->format, + &plane_info->color_space); +@@ -5697,7 +5697,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, + dc_plane_state->global_alpha = plane_info.global_alpha; + dc_plane_state->global_alpha_value = plane_info.global_alpha_value; + dc_plane_state->dcc = plane_info.dcc; +- dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0 ++ dc_plane_state->layer_index = plane_info.layer_index; + dc_plane_state->flip_int_enabled = true; + + /* +@@ -11147,6 +11147,14 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, + } + } + ++ /* ++ * DC consults the zpos (layer_index in DC terminology) to determine the ++ * hw plane on which to enable the hw cursor (see ++ * `dcn10_can_pipe_disable_cursor`). By now, all modified planes are in ++ * atomic state, so call drm helper to normalize zpos. ++ */ ++ drm_atomic_normalize_zpos(dev, state); ++ + /* Remove exiting planes if they are modified */ + for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) { + ret = dm_update_plane_state(dc, state, plane, +-- +2.35.1 + diff --git a/queue-5.19/drm-amd-display-fix-dp-mst-timeslot-issue-when-fallb.patch b/queue-5.19/drm-amd-display-fix-dp-mst-timeslot-issue-when-fallb.patch new file mode 100644 index 00000000000..c64e6ee3063 --- /dev/null +++ b/queue-5.19/drm-amd-display-fix-dp-mst-timeslot-issue-when-fallb.patch @@ -0,0 +1,52 @@ +From 426328c1ce000b762bb03b5e2b6ded75c6e67f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 22:04:09 +0800 +Subject: drm/amd/display: Fix DP MST timeslot issue when fallback happened + +From: Cruise Hung + +[ Upstream commit 20c6168b3c8aadef7d2853c925d99eb546bd5e1c ] + +[Why] +When USB4 DP link training failed and fell back to lower link rate, +the time slot calculation uses the verified_link_cap. +And the verified_link_cap was not updated to the new one. +It caused the wrong VC payload time-slot was allocated. + +[How] +Updated verified_link_cap with the new one from cur_link_settings +after the LT completes successfully. + +Reviewed-by: Jun Lei +Acked-by: Wayne Lin +Signed-off-by: Cruise Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 0c52506b367d..b4203a812c4b 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2857,8 +2857,14 @@ bool perform_link_training_with_retries( + skip_video_pattern); + + /* Transmit idle pattern once training successful. */ +- if (status == LINK_TRAINING_SUCCESS && !is_link_bw_low) ++ if (status == LINK_TRAINING_SUCCESS && !is_link_bw_low) { + dp_set_hw_test_pattern(link, &pipe_ctx->link_res, DP_TEST_PATTERN_VIDEO_MODE, NULL, 0); ++ /* Update verified link settings to current one ++ * Because DPIA LT might fallback to lower link setting. ++ */ ++ link->verified_link_cap.link_rate = link->cur_link_settings.link_rate; ++ link->verified_link_cap.lane_count = link->cur_link_settings.lane_count; ++ } + } else { + status = dc_link_dp_perform_link_training(link, + &pipe_ctx->link_res, +-- +2.35.1 + diff --git a/queue-5.19/drm-amd-display-increase-dcn315-pstate-change-latenc.patch b/queue-5.19/drm-amd-display-increase-dcn315-pstate-change-latenc.patch new file mode 100644 index 00000000000..4bd8e2fbe52 --- /dev/null +++ b/queue-5.19/drm-amd-display-increase-dcn315-pstate-change-latenc.patch @@ -0,0 +1,100 @@ +From 92acdee9d4b7df1a2ed2c0476b2263fa9cd9ae45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 13:02:44 -0400 +Subject: drm/amd/display: increase dcn315 pstate change latency + +From: Dmytro Laktyushkin + +[ Upstream commit dcc2527df918edfe297c5074ccc1f05eae361ca6 ] + +[Why & How] +Update after new measurment came in + +Reviewed-by: Jun Lei +Acked-by: Wayne Lin +Signed-off-by: Dmytro Laktyushkin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 22 ++++++++++++------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +index f4381725b210..c3d7712e9fd0 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +@@ -46,6 +46,9 @@ + #define TO_CLK_MGR_DCN315(clk_mgr)\ + container_of(clk_mgr, struct clk_mgr_dcn315, base) + ++#define UNSUPPORTED_DCFCLK 10000000 ++#define MIN_DPP_DISP_CLK 100000 ++ + static int dcn315_get_active_display_cnt_wa( + struct dc *dc, + struct dc_state *context) +@@ -146,6 +149,9 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + } + } + ++ /* Lock pstate by requesting unsupported dcfclk if change is unsupported */ ++ if (!new_clocks->p_state_change_support) ++ new_clocks->dcfclk_khz = UNSUPPORTED_DCFCLK; + if (should_set_clock(safe_to_lower, new_clocks->dcfclk_khz, clk_mgr_base->clks.dcfclk_khz)) { + clk_mgr_base->clks.dcfclk_khz = new_clocks->dcfclk_khz; + dcn315_smu_set_hard_min_dcfclk(clk_mgr, clk_mgr_base->clks.dcfclk_khz); +@@ -159,10 +165,10 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base, + + // workaround: Limit dppclk to 100Mhz to avoid lower eDP panel switch to plus 4K monitor underflow. + if (!IS_DIAG_DC(dc->ctx->dce_environment)) { +- if (new_clocks->dppclk_khz < 100000) +- new_clocks->dppclk_khz = 100000; +- if (new_clocks->dispclk_khz < 100000) +- new_clocks->dispclk_khz = 100000; ++ if (new_clocks->dppclk_khz < MIN_DPP_DISP_CLK) ++ new_clocks->dppclk_khz = MIN_DPP_DISP_CLK; ++ if (new_clocks->dispclk_khz < MIN_DPP_DISP_CLK) ++ new_clocks->dispclk_khz = MIN_DPP_DISP_CLK; + } + + if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) { +@@ -272,7 +278,7 @@ static struct wm_table ddr5_wm_table = { + { + .wm_inst = WM_A, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 64.0, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -280,7 +286,7 @@ static struct wm_table ddr5_wm_table = { + { + .wm_inst = WM_B, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 64.0, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -288,7 +294,7 @@ static struct wm_table ddr5_wm_table = { + { + .wm_inst = WM_C, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 64.0, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -296,7 +302,7 @@ static struct wm_table ddr5_wm_table = { + { + .wm_inst = WM_D, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 64.0, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +-- +2.35.1 + diff --git a/queue-5.19/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch b/queue-5.19/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch new file mode 100644 index 00000000000..3eed8acdc89 --- /dev/null +++ b/queue-5.19/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch @@ -0,0 +1,54 @@ +From cd533c7a802ce684e4e2dd4177fc5771ac999bf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 19:44:50 +0800 +Subject: drm/amd/display: skip audio setup when audio stream is enabled + +From: zhikzhai + +[ Upstream commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 ] + +[why] +We have minimal pipe split transition method to avoid pipe +allocation outage.However, this method will invoke audio setup +which cause audio output stuck once pipe reallocate. + +[how] +skip audio setup for pipelines which audio stream has been enabled + +Reviewed-by: Charlene Liu +Acked-by: Wayne Lin +Signed-off-by: zhikzhai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index aee31c785aa9..4f0ea50eaa83 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -2165,7 +2165,8 @@ static void dce110_setup_audio_dto( + continue; + if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A) + continue; +- if (pipe_ctx->stream_res.audio != NULL) { ++ if (pipe_ctx->stream_res.audio != NULL && ++ pipe_ctx->stream_res.audio->enabled == false) { + struct audio_output audio_output; + + build_audio_output(context, pipe_ctx, &audio_output); +@@ -2207,7 +2208,8 @@ static void dce110_setup_audio_dto( + if (!dc_is_dp_signal(pipe_ctx->stream->signal)) + continue; + +- if (pipe_ctx->stream_res.audio != NULL) { ++ if (pipe_ctx->stream_res.audio != NULL && ++ pipe_ctx->stream_res.audio->enabled == false) { + struct audio_output audio_output; + + build_audio_output(context, pipe_ctx, &audio_output); +-- +2.35.1 + diff --git a/queue-5.19/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch b/queue-5.19/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch new file mode 100644 index 00000000000..fb219a00ed3 --- /dev/null +++ b/queue-5.19/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch @@ -0,0 +1,43 @@ +From c7f7d63718fdfd7b8480c62df80ffa802ded4501 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 10:08:35 +0800 +Subject: drm/amd/display: update gamut remap if plane has changed + +From: Hugo Hu + +[ Upstream commit 52bb21499cf54fa65b56d97cd0d68579c90207dd ] + +[Why] +The desktop plane and full-screen game plane may have different +gamut remap coefficients, if switching between desktop and +full-screen game without updating the gamut remap will cause +incorrect color. + +[How] +Update gamut remap if planes change. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Wayne Lin +Signed-off-by: Hugo Hu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index ec6aa8d8b251..213a02a769d4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1520,6 +1520,7 @@ static void dcn20_update_dchubp_dpp( + /* Any updates are handled in dc interface, just need + * to apply existing for plane enable / opp change */ + if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.opp_changed ++ || pipe_ctx->update_flags.bits.plane_changed + || pipe_ctx->stream->update_flags.bits.gamut_remap + || pipe_ctx->stream->update_flags.bits.out_csc) { + /* dpp/cm gamut remap*/ +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-mes-zero-the-sdma_hqd_mask-of-2nd-sdma-en.patch b/queue-5.19/drm-amdgpu-mes-zero-the-sdma_hqd_mask-of-2nd-sdma-en.patch new file mode 100644 index 00000000000..0b3236d4450 --- /dev/null +++ b/queue-5.19/drm-amdgpu-mes-zero-the-sdma_hqd_mask-of-2nd-sdma-en.patch @@ -0,0 +1,39 @@ +From c28ddcd3c77181f56e9dc62b2a8aa5df344fd7b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 23:18:47 +0800 +Subject: drm/amdgpu/mes: zero the sdma_hqd_mask of 2nd SDMA engine for SDMA + 6.0.1 + +From: Yifan Zhang + +[ Upstream commit 0af4ed0c329ebb4cef95fda4fcdbfcdea0255442 ] + +there is only one SDMA engine in SDMA 6.0.1, the sdma_hqd_mask has to be +zeroed for the 2nd engine, otherwise MES scheduler will consider 2nd +engine exists and map/unmap SDMA queues to the non-existent engine. + +Signed-off-by: Yifan Zhang +Reviewed-by: Tim Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +index 69a70a0aaed9..6ab062c63da1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +@@ -169,6 +169,9 @@ int amdgpu_mes_init(struct amdgpu_device *adev) + for (i = 0; i < AMDGPU_MES_MAX_SDMA_PIPES; i++) { + if (adev->ip_versions[SDMA0_HWIP][0] < IP_VERSION(6, 0, 0)) + adev->mes.sdma_hqd_mask[i] = i ? 0 : 0x3fc; ++ /* zero sdma_hqd_mask for non-existent engine */ ++ else if (adev->sdma.num_instances == 1) ++ adev->mes.sdma_hqd_mask[i] = i ? 0 : 0xfc; + else + adev->mes.sdma_hqd_mask[i] = 0xfc; + } +-- +2.35.1 + diff --git a/queue-5.19/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch b/queue-5.19/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch new file mode 100644 index 00000000000..05bf20cbc15 --- /dev/null +++ b/queue-5.19/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch @@ -0,0 +1,81 @@ +From 8ab3cf6befa3d9dc00c3344d54948e3cbfa1f75c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:31 +0100 +Subject: firmware: arm_scmi: Add SCMI PM driver remove routine + +From: Cristian Marussi + +[ Upstream commit dea796fcab0a219830831c070b8dc367d7e0f708 ] + +Currently, when removing the SCMI PM driver not all the resources +registered with genpd subsystem are properly de-registered. + +As a side effect of this after a driver unload/load cycle you get a +splat with a few warnings like this: + + | debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present! + | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present! + | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present! + | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present! + | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present! + +Add a proper scmi_pm_domain_remove callback to the driver in order to +take care of all the needed cleanups not handled by devres framework. + +Link: https://lore.kernel.org/r/20220817172731.1185305-7-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c +index d5dee625de78..0e05a79de82d 100644 +--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c ++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c +@@ -112,9 +112,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) + scmi_pd_data->domains = domains; + scmi_pd_data->num_domains = num_domains; + ++ dev_set_drvdata(dev, scmi_pd_data); ++ + return of_genpd_add_provider_onecell(np, scmi_pd_data); + } + ++static void scmi_pm_domain_remove(struct scmi_device *sdev) ++{ ++ int i; ++ struct genpd_onecell_data *scmi_pd_data; ++ struct device *dev = &sdev->dev; ++ struct device_node *np = dev->of_node; ++ ++ of_genpd_del_provider(np); ++ ++ scmi_pd_data = dev_get_drvdata(dev); ++ for (i = 0; i < scmi_pd_data->num_domains; i++) { ++ if (!scmi_pd_data->domains[i]) ++ continue; ++ pm_genpd_remove(scmi_pd_data->domains[i]); ++ } ++} ++ + static const struct scmi_device_id scmi_id_table[] = { + { SCMI_PROTOCOL_POWER, "genpd" }, + { }, +@@ -124,6 +143,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table); + static struct scmi_driver scmi_power_domain_driver = { + .name = "scmi-power-domain", + .probe = scmi_pm_domain_probe, ++ .remove = scmi_pm_domain_remove, + .id_table = scmi_id_table, + }; + module_scmi_driver(scmi_power_domain_driver); +-- +2.35.1 + diff --git a/queue-5.19/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch b/queue-5.19/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch new file mode 100644 index 00000000000..550041951ca --- /dev/null +++ b/queue-5.19/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch @@ -0,0 +1,105 @@ +From b2160d4d907eab80df64cb72311a23cf33a16fd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:28 +0100 +Subject: firmware: arm_scmi: Harden accesses to the sensor domains + +From: Cristian Marussi + +[ Upstream commit 76f89c954788763db575fb512a40bd483864f1e9 ] + +Accessing sensor domains descriptors by the index upon the SCMI drivers +requests through the SCMI sensor operations interface can potentially +lead to out-of-bound violations if the SCMI driver misbehave. + +Add an internal consistency check before any such domains descriptors +accesses. + +Link: https://lore.kernel.org/r/20220817172731.1185305-4-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/sensors.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c +index 7d0c7476d206..0b5853fa9d87 100644 +--- a/drivers/firmware/arm_scmi/sensors.c ++++ b/drivers/firmware/arm_scmi/sensors.c +@@ -762,6 +762,10 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph, + { + int ret; + struct scmi_xfer *t; ++ struct sensors_info *si = ph->get_priv(ph); ++ ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; + + ret = ph->xops->xfer_get_init(ph, SENSOR_CONFIG_GET, + sizeof(__le32), sizeof(__le32), &t); +@@ -771,7 +775,6 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph, + put_unaligned_le32(sensor_id, t->tx.buf); + ret = ph->xops->do_xfer(ph, t); + if (!ret) { +- struct sensors_info *si = ph->get_priv(ph); + struct scmi_sensor_info *s = si->sensors + sensor_id; + + *sensor_config = get_unaligned_le64(t->rx.buf); +@@ -788,6 +791,10 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph, + int ret; + struct scmi_xfer *t; + struct scmi_msg_sensor_config_set *msg; ++ struct sensors_info *si = ph->get_priv(ph); ++ ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; + + ret = ph->xops->xfer_get_init(ph, SENSOR_CONFIG_SET, + sizeof(*msg), 0, &t); +@@ -800,7 +807,6 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph, + + ret = ph->xops->do_xfer(ph, t); + if (!ret) { +- struct sensors_info *si = ph->get_priv(ph); + struct scmi_sensor_info *s = si->sensors + sensor_id; + + s->sensor_config = sensor_config; +@@ -831,8 +837,11 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph, + int ret; + struct scmi_xfer *t; + struct scmi_msg_sensor_reading_get *sensor; ++ struct scmi_sensor_info *s; + struct sensors_info *si = ph->get_priv(ph); +- struct scmi_sensor_info *s = si->sensors + sensor_id; ++ ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; + + ret = ph->xops->xfer_get_init(ph, SENSOR_READING_GET, + sizeof(*sensor), 0, &t); +@@ -841,6 +850,7 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph, + + sensor = t->tx.buf; + sensor->id = cpu_to_le32(sensor_id); ++ s = si->sensors + sensor_id; + if (s->async) { + sensor->flags = cpu_to_le32(SENSOR_READ_ASYNC); + ret = ph->xops->do_xfer_with_response(ph, t); +@@ -895,9 +905,13 @@ scmi_sensor_reading_get_timestamped(const struct scmi_protocol_handle *ph, + int ret; + struct scmi_xfer *t; + struct scmi_msg_sensor_reading_get *sensor; ++ struct scmi_sensor_info *s; + struct sensors_info *si = ph->get_priv(ph); +- struct scmi_sensor_info *s = si->sensors + sensor_id; + ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; ++ ++ s = si->sensors + sensor_id; + if (!count || !readings || + (!s->num_axis && count > 1) || (s->num_axis && count > s->num_axis)) + return -EINVAL; +-- +2.35.1 + diff --git a/queue-5.19/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch b/queue-5.19/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch new file mode 100644 index 00000000000..b8201ab6d21 --- /dev/null +++ b/queue-5.19/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch @@ -0,0 +1,84 @@ +From fbe7de31f8b9171a71a4bf08220acf88684591f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:27 +0100 +Subject: firmware: arm_scmi: Improve checks in the info_get operations + +From: Cristian Marussi + +[ Upstream commit 1ecb7d27b1af6705e9a4e94415b4d8cc8cf2fbfb ] + +SCMI protocols abstract and expose a number of protocol specific +resources like clocks, sensors and so on. Information about such +specific domain resources are generally exposed via an `info_get` +protocol operation. + +Improve the sanity check on these operations where needed. + +Link: https://lore.kernel.org/r/20220817172731.1185305-3-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/clock.c | 6 +++++- + drivers/firmware/arm_scmi/sensors.c | 3 +++ + include/linux/scmi_protocol.h | 4 ++-- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c +index 3ed7ae0d6781..96060bf90a24 100644 +--- a/drivers/firmware/arm_scmi/clock.c ++++ b/drivers/firmware/arm_scmi/clock.c +@@ -450,9 +450,13 @@ static int scmi_clock_count_get(const struct scmi_protocol_handle *ph) + static const struct scmi_clock_info * + scmi_clock_info_get(const struct scmi_protocol_handle *ph, u32 clk_id) + { ++ struct scmi_clock_info *clk; + struct clock_info *ci = ph->get_priv(ph); +- struct scmi_clock_info *clk = ci->clk + clk_id; + ++ if (clk_id >= ci->num_clocks) ++ return NULL; ++ ++ clk = ci->clk + clk_id; + if (!clk->name[0]) + return NULL; + +diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c +index 7288c6117838..7d0c7476d206 100644 +--- a/drivers/firmware/arm_scmi/sensors.c ++++ b/drivers/firmware/arm_scmi/sensors.c +@@ -948,6 +948,9 @@ scmi_sensor_info_get(const struct scmi_protocol_handle *ph, u32 sensor_id) + { + struct sensors_info *si = ph->get_priv(ph); + ++ if (sensor_id >= si->num_sensors) ++ return NULL; ++ + return si->sensors + sensor_id; + } + +diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h +index 704111f63993..6dd50ac82d10 100644 +--- a/include/linux/scmi_protocol.h ++++ b/include/linux/scmi_protocol.h +@@ -78,7 +78,7 @@ struct scmi_protocol_handle; + struct scmi_clk_proto_ops { + int (*count_get)(const struct scmi_protocol_handle *ph); + +- const struct scmi_clock_info *(*info_get) ++ const struct scmi_clock_info __must_check *(*info_get) + (const struct scmi_protocol_handle *ph, u32 clk_id); + int (*rate_get)(const struct scmi_protocol_handle *ph, u32 clk_id, + u64 *rate); +@@ -460,7 +460,7 @@ enum scmi_sensor_class { + */ + struct scmi_sensor_proto_ops { + int (*count_get)(const struct scmi_protocol_handle *ph); +- const struct scmi_sensor_info *(*info_get) ++ const struct scmi_sensor_info __must_check *(*info_get) + (const struct scmi_protocol_handle *ph, u32 sensor_id); + int (*trip_point_config)(const struct scmi_protocol_handle *ph, + u32 sensor_id, u8 trip_id, u64 trip_value); +-- +2.35.1 + diff --git a/queue-5.19/gpio-ftgpio010-make-irqchip-immutable.patch b/queue-5.19/gpio-ftgpio010-make-irqchip-immutable.patch new file mode 100644 index 00000000000..4c31707c18f --- /dev/null +++ b/queue-5.19/gpio-ftgpio010-make-irqchip-immutable.patch @@ -0,0 +1,93 @@ +From 7f3ba31aa2328d3cba79ff7a4fc1daf6611f9a17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 22:32:54 +0200 +Subject: gpio: ftgpio010: Make irqchip immutable + +From: Linus Walleij + +[ Upstream commit ab637d48363d7b8ee67ae089808a8bc6051d53c4 ] + +This turns the FTGPIO010 irqchip immutable. + +Tested on the D-Link DIR-685. + +Cc: Marc Zyngier +Signed-off-by: Linus Walleij +Acked-by: Marc Zyngier +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-ftgpio010.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpio/gpio-ftgpio010.c b/drivers/gpio/gpio-ftgpio010.c +index f422c3e129a0..f77a965f5780 100644 +--- a/drivers/gpio/gpio-ftgpio010.c ++++ b/drivers/gpio/gpio-ftgpio010.c +@@ -41,14 +41,12 @@ + * struct ftgpio_gpio - Gemini GPIO state container + * @dev: containing device for this instance + * @gc: gpiochip for this instance +- * @irq: irqchip for this instance + * @base: remapped I/O-memory base + * @clk: silicon clock + */ + struct ftgpio_gpio { + struct device *dev; + struct gpio_chip gc; +- struct irq_chip irq; + void __iomem *base; + struct clk *clk; + }; +@@ -70,6 +68,7 @@ static void ftgpio_gpio_mask_irq(struct irq_data *d) + val = readl(g->base + GPIO_INT_EN); + val &= ~BIT(irqd_to_hwirq(d)); + writel(val, g->base + GPIO_INT_EN); ++ gpiochip_disable_irq(gc, irqd_to_hwirq(d)); + } + + static void ftgpio_gpio_unmask_irq(struct irq_data *d) +@@ -78,6 +77,7 @@ static void ftgpio_gpio_unmask_irq(struct irq_data *d) + struct ftgpio_gpio *g = gpiochip_get_data(gc); + u32 val; + ++ gpiochip_enable_irq(gc, irqd_to_hwirq(d)); + val = readl(g->base + GPIO_INT_EN); + val |= BIT(irqd_to_hwirq(d)); + writel(val, g->base + GPIO_INT_EN); +@@ -221,6 +221,16 @@ static int ftgpio_gpio_set_config(struct gpio_chip *gc, unsigned int offset, + return 0; + } + ++static const struct irq_chip ftgpio_irq_chip = { ++ .name = "FTGPIO010", ++ .irq_ack = ftgpio_gpio_ack_irq, ++ .irq_mask = ftgpio_gpio_mask_irq, ++ .irq_unmask = ftgpio_gpio_unmask_irq, ++ .irq_set_type = ftgpio_gpio_set_irq_type, ++ .flags = IRQCHIP_IMMUTABLE, ++ GPIOCHIP_IRQ_RESOURCE_HELPERS, ++}; ++ + static int ftgpio_gpio_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -277,14 +287,8 @@ static int ftgpio_gpio_probe(struct platform_device *pdev) + if (!IS_ERR(g->clk)) + g->gc.set_config = ftgpio_gpio_set_config; + +- g->irq.name = "FTGPIO010"; +- g->irq.irq_ack = ftgpio_gpio_ack_irq; +- g->irq.irq_mask = ftgpio_gpio_mask_irq; +- g->irq.irq_unmask = ftgpio_gpio_unmask_irq; +- g->irq.irq_set_type = ftgpio_gpio_set_irq_type; +- + girq = &g->gc.irq; +- girq->chip = &g->irq; ++ gpio_irq_chip_set_chip(girq, &ftgpio_irq_chip); + girq->parent_handler = ftgpio_gpio_irq_handler; + girq->num_parents = 1; + girq->parents = devm_kcalloc(dev, 1, sizeof(*girq->parents), +-- +2.35.1 + diff --git a/queue-5.19/i2c-davinci-fix-pm-disable-depth-imbalance-in-davinc.patch b/queue-5.19/i2c-davinci-fix-pm-disable-depth-imbalance-in-davinc.patch new file mode 100644 index 00000000000..b8eb4efcdcf --- /dev/null +++ b/queue-5.19/i2c-davinci-fix-pm-disable-depth-imbalance-in-davinc.patch @@ -0,0 +1,46 @@ +From 2b6b591d997c9bacaf3067e6e681f5768e13b994 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 22:30:38 +0800 +Subject: i2c: davinci: fix PM disable depth imbalance in davinci_i2c_probe + +From: Zhang Qilong + +[ Upstream commit e2062df704dea47efe16edcaa2316d7b5ecca64f ] + +The pm_runtime_enable will increase power disable depth. Thus a +pairing decrement is needed on the error handling path to keep +it balanced according to context. + +Fixes: 17f88151ff190 ("i2c: davinci: Add PM Runtime Support") +Signed-off-by: Zhang Qilong +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-davinci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c +index 9e09db31a937..5343c82c8594 100644 +--- a/drivers/i2c/busses/i2c-davinci.c ++++ b/drivers/i2c/busses/i2c-davinci.c +@@ -823,7 +823,7 @@ static int davinci_i2c_probe(struct platform_device *pdev) + r = pm_runtime_resume_and_get(dev->dev); + if (r < 0) { + dev_err(dev->dev, "failed to runtime_get device: %d\n", r); +- return r; ++ goto err_pm; + } + + i2c_davinci_init(dev); +@@ -882,6 +882,7 @@ static int davinci_i2c_probe(struct platform_device *pdev) + err_unuse_clocks: + pm_runtime_dont_use_autosuspend(dev->dev); + pm_runtime_put_sync(dev->dev); ++err_pm: + pm_runtime_disable(dev->dev); + + return r; +-- +2.35.1 + diff --git a/queue-5.19/kvm-s390-pass-initialized-arg-even-if-unused.patch b/queue-5.19/kvm-s390-pass-initialized-arg-even-if-unused.patch new file mode 100644 index 00000000000..51585dcb6cc --- /dev/null +++ b/queue-5.19/kvm-s390-pass-initialized-arg-even-if-unused.patch @@ -0,0 +1,88 @@ +From 679ad9207c7273d495d653f7ccf2b0f3e7c71fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 21:25:40 +0200 +Subject: KVM: s390: Pass initialized arg even if unused + +From: Janis Schoetterl-Glausch + +[ Upstream commit b3cefd6bf16e7234ffbd4209f6083060f4e35f59 ] + +This silences smatch warnings reported by kbuild bot: +arch/s390/kvm/gaccess.c:859 guest_range_to_gpas() error: uninitialized symbol 'prot'. +arch/s390/kvm/gaccess.c:1064 access_guest_with_key() error: uninitialized symbol 'prot'. + +This is because it cannot tell that the value is not used in this case. +The trans_exc* only examine prot if code is PGM_PROTECTION. +Pass a dummy value for other codes. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Janis Schoetterl-Glausch +Reviewed-by: Claudio Imbrenda +Link: https://lore.kernel.org/r/20220825192540.1560559-1-scgl@linux.ibm.com +Signed-off-by: Christian Borntraeger +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/gaccess.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c +index 227ed0009354..0e82bf85e59b 100644 +--- a/arch/s390/kvm/gaccess.c ++++ b/arch/s390/kvm/gaccess.c +@@ -489,6 +489,8 @@ enum prot_type { + PROT_TYPE_ALC = 2, + PROT_TYPE_DAT = 3, + PROT_TYPE_IEP = 4, ++ /* Dummy value for passing an initialized value when code != PGM_PROTECTION */ ++ PROT_NONE, + }; + + static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar, +@@ -504,6 +506,10 @@ static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, + switch (code) { + case PGM_PROTECTION: + switch (prot) { ++ case PROT_NONE: ++ /* We should never get here, acts like termination */ ++ WARN_ON_ONCE(1); ++ break; + case PROT_TYPE_IEP: + tec->b61 = 1; + fallthrough; +@@ -968,8 +974,10 @@ static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, + return rc; + } else { + gpa = kvm_s390_real_to_abs(vcpu, ga); +- if (kvm_is_error_gpa(vcpu->kvm, gpa)) ++ if (kvm_is_error_gpa(vcpu->kvm, gpa)) { + rc = PGM_ADDRESSING; ++ prot = PROT_NONE; ++ } + } + if (rc) + return trans_exc(vcpu, rc, ga, ar, mode, prot); +@@ -1112,8 +1120,6 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, + if (rc == PGM_PROTECTION && try_storage_prot_override) + rc = access_guest_page_with_key(vcpu->kvm, mode, gpas[idx], + data, fragment_len, PAGE_SPO_ACC); +- if (rc == PGM_PROTECTION) +- prot = PROT_TYPE_KEYC; + if (rc) + break; + len -= fragment_len; +@@ -1123,6 +1129,10 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, + if (rc > 0) { + bool terminate = (mode == GACC_STORE) && (idx > 0); + ++ if (rc == PGM_PROTECTION) ++ prot = PROT_TYPE_KEYC; ++ else ++ prot = PROT_NONE; + rc = trans_exc_ending(vcpu, rc, ga, ar, mode, prot, terminate); + } + out_unlock: +-- +2.35.1 + diff --git a/queue-5.19/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch b/queue-5.19/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch new file mode 100644 index 00000000000..f252c607dcb --- /dev/null +++ b/queue-5.19/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch @@ -0,0 +1,42 @@ +From f80bf7c854e6d01a4b715727b31b2e96aff566bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 09:42:38 +0800 +Subject: net: atlantic: fix potential memory leak in aq_ndev_close() + +From: Jianglei Nie + +[ Upstream commit 65e5d27df61283e5390f04b09dc79cd832f95607 ] + +If aq_nic_stop() fails, aq_ndev_close() returns err without calling +aq_nic_deinit() to release the relevant memory and resource, which +will lead to a memory leak. + +We can fix it by deleting the if condition judgment and goto statement to +call aq_nic_deinit() directly after aq_nic_stop() to fix the memory leak. + +Signed-off-by: Jianglei Nie +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +index 88595863d8bc..8a0af371e7dc 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +@@ -94,11 +94,8 @@ static int aq_ndev_close(struct net_device *ndev) + int err = 0; + + err = aq_nic_stop(aq_nic); +- if (err < 0) +- goto err_exit; + aq_nic_deinit(aq_nic, true); + +-err_exit: + return err; + } + +-- +2.35.1 + diff --git a/queue-5.19/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch b/queue-5.19/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch new file mode 100644 index 00000000000..2cf5aceca5e --- /dev/null +++ b/queue-5.19/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch @@ -0,0 +1,173 @@ +From 12e87c3d736d88d53a10ee678451ab1796b1e964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 20:19:27 +0800 +Subject: net/ieee802154: fix uninit value bug in dgram_sendmsg + +From: Haimin Zhang + +[ Upstream commit 94160108a70c8af17fa1484a37e05181c0e094af ] + +There is uninit value bug in dgram_sendmsg function in +net/ieee802154/socket.c when the length of valid data pointed by the +msg->msg_name isn't verified. + +We introducing a helper function ieee802154_sockaddr_check_size to +check namelen. First we check there is addr_type in ieee802154_addr_sa. +Then, we check namelen according to addr_type. + +Also fixed in raw_bind, dgram_bind, dgram_connect. + +Signed-off-by: Haimin Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ieee802154_netdev.h | 37 +++++++++++++++++++++++++++++ + net/ieee802154/socket.c | 42 ++++++++++++++++++--------------- + 2 files changed, 60 insertions(+), 19 deletions(-) + +diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h +index d0d188c3294b..a8994f307fc3 100644 +--- a/include/net/ieee802154_netdev.h ++++ b/include/net/ieee802154_netdev.h +@@ -15,6 +15,22 @@ + #ifndef IEEE802154_NETDEVICE_H + #define IEEE802154_NETDEVICE_H + ++#define IEEE802154_REQUIRED_SIZE(struct_type, member) \ ++ (offsetof(typeof(struct_type), member) + \ ++ sizeof(((typeof(struct_type) *)(NULL))->member)) ++ ++#define IEEE802154_ADDR_OFFSET \ ++ offsetof(typeof(struct sockaddr_ieee802154), addr) ++ ++#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \ ++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type)) ++ ++#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \ ++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr)) ++ ++#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \ ++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr)) ++ + #include + #include + #include +@@ -165,6 +181,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr) + memcpy(raw, &temp, IEEE802154_ADDR_LEN); + } + ++static inline int ++ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len) ++{ ++ struct ieee802154_addr_sa *sa; ++ ++ sa = &daddr->addr; ++ if (len < IEEE802154_MIN_NAMELEN) ++ return -EINVAL; ++ switch (sa->addr_type) { ++ case IEEE802154_ADDR_SHORT: ++ if (len < IEEE802154_NAMELEN_SHORT) ++ return -EINVAL; ++ break; ++ case IEEE802154_ADDR_LONG: ++ if (len < IEEE802154_NAMELEN_LONG) ++ return -EINVAL; ++ break; ++ } ++ return 0; ++} ++ + static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a, + const struct ieee802154_addr_sa *sa) + { +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index 718fb77bb372..7889e1ef7fad 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -200,8 +200,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len) + int err = 0; + struct net_device *dev = NULL; + +- if (len < sizeof(*uaddr)) +- return -EINVAL; ++ err = ieee802154_sockaddr_check_size(uaddr, len); ++ if (err < 0) ++ return err; + + uaddr = (struct sockaddr_ieee802154 *)_uaddr; + if (uaddr->family != AF_IEEE802154) +@@ -493,7 +494,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len) + + ro->bound = 0; + +- if (len < sizeof(*addr)) ++ err = ieee802154_sockaddr_check_size(addr, len); ++ if (err < 0) + goto out; + + if (addr->family != AF_IEEE802154) +@@ -564,8 +566,9 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr, + struct dgram_sock *ro = dgram_sk(sk); + int err = 0; + +- if (len < sizeof(*addr)) +- return -EINVAL; ++ err = ieee802154_sockaddr_check_size(addr, len); ++ if (err < 0) ++ return err; + + if (addr->family != AF_IEEE802154) + return -EINVAL; +@@ -604,6 +607,7 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + struct ieee802154_mac_cb *cb; + struct dgram_sock *ro = dgram_sk(sk); + struct ieee802154_addr dst_addr; ++ DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name); + int hlen, tlen; + int err; + +@@ -612,10 +616,20 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + return -EOPNOTSUPP; + } + +- if (!ro->connected && !msg->msg_name) +- return -EDESTADDRREQ; +- else if (ro->connected && msg->msg_name) +- return -EISCONN; ++ if (msg->msg_name) { ++ if (ro->connected) ++ return -EISCONN; ++ if (msg->msg_namelen < IEEE802154_MIN_NAMELEN) ++ return -EINVAL; ++ err = ieee802154_sockaddr_check_size(daddr, msg->msg_namelen); ++ if (err < 0) ++ return err; ++ ieee802154_addr_from_sa(&dst_addr, &daddr->addr); ++ } else { ++ if (!ro->connected) ++ return -EDESTADDRREQ; ++ dst_addr = ro->dst_addr; ++ } + + if (!ro->bound) + dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154); +@@ -651,16 +665,6 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + cb = mac_cb_init(skb); + cb->type = IEEE802154_FC_TYPE_DATA; + cb->ackreq = ro->want_ack; +- +- if (msg->msg_name) { +- DECLARE_SOCKADDR(struct sockaddr_ieee802154*, +- daddr, msg->msg_name); +- +- ieee802154_addr_from_sa(&dst_addr, &daddr->addr); +- } else { +- dst_addr = ro->dst_addr; +- } +- + cb->secen = ro->secen; + cb->secen_override = ro->secen_override; + cb->seclevel = ro->seclevel; +-- +2.35.1 + diff --git a/queue-5.19/net-marvell-prestera-add-support-for-for-aldrin2.patch b/queue-5.19/net-marvell-prestera-add-support-for-for-aldrin2.patch new file mode 100644 index 00000000000..296536a1134 --- /dev/null +++ b/queue-5.19/net-marvell-prestera-add-support-for-for-aldrin2.patch @@ -0,0 +1,37 @@ +From df75a9f131a105def7adae40545a9459b4368c29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 16:14:46 +0300 +Subject: net: marvell: prestera: add support for for Aldrin2 + +From: Oleksandr Mazur + +[ Upstream commit 9124dbcc2dd6c51e81f97f63f7807118c4eb140a ] + +Aldrin2 (98DX8525) is a Marvell Prestera PP, with 100G support. + +Signed-off-by: Oleksandr Mazur + +V2: + - retarget to net tree instead of net-next; + - fix missed colon in patch subject ('net marvell' vs 'net: mavell'); +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/prestera/prestera_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_pci.c b/drivers/net/ethernet/marvell/prestera/prestera_pci.c +index f538a749ebd4..59470d99f522 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_pci.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_pci.c +@@ -872,6 +872,7 @@ static void prestera_pci_remove(struct pci_dev *pdev) + static const struct pci_device_id prestera_pci_devices[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xC804) }, + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xC80C) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xCC1E) }, + { } + }; + MODULE_DEVICE_TABLE(pci, prestera_pci_devices); +-- +2.35.1 + diff --git a/queue-5.19/perf-x86-intel-fix-unchecked-msr-access-error-for-al.patch b/queue-5.19/perf-x86-intel-fix-unchecked-msr-access-error-for-al.patch new file mode 100644 index 00000000000..8532e429c89 --- /dev/null +++ b/queue-5.19/perf-x86-intel-fix-unchecked-msr-access-error-for-al.patch @@ -0,0 +1,163 @@ +From 18f238fa2e428ab127ce1177799e96f9ddcd7930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 07:27:02 -0700 +Subject: perf/x86/intel: Fix unchecked MSR access error for Alder Lake N + +From: Kan Liang + +[ Upstream commit 24919fdea6f8b31d7cdf32ac291bc5dd0b023878 ] + +For some Alder Lake N machine, the below unchecked MSR access error may be +triggered. + +[ 0.088017] rcu: Hierarchical SRCU implementation. +[ 0.088017] unchecked MSR access error: WRMSR to 0x38f (tried to write +0x0001000f0000003f) at rIP: 0xffffffffb5684de8 (native_write_msr+0x8/0x30) +[ 0.088017] Call Trace: +[ 0.088017] +[ 0.088017] __intel_pmu_enable_all.constprop.46+0x4a/0xa0 + +The Alder Lake N only has e-cores. The X86_FEATURE_HYBRID_CPU flag is +not set. The perf cannot retrieve the correct CPU type via +get_this_hybrid_cpu_type(). The model specific get_hybrid_cpu_type() is +hardcode to p-core. The wrong CPU type is given to the PMU of the +Alder Lake N. + +Since Alder Lake N isn't in fact a hybrid CPU, remove ALDERLAKE_N from +the rest of {ALDER,RAPTOP}LAKE and create a non-hybrid PMU setup. + +The differences between Gracemont and the previous Tremont are, +- Number of GP counters +- Load and store latency Events +- PEBS event_constraints +- Instruction Latency support +- Data source encoding +- Memory access latency encoding + +Fixes: c2a960f7c574 ("perf/x86: Add new Alder Lake and Raptor Lake support") +Reported-by: Jianfeng Gao +Suggested-by: Peter Zijlstra (Intel) +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220831142702.153110-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 40 +++++++++++++++++++++++++++++++++++- + arch/x86/events/intel/ds.c | 9 ++++++-- + arch/x86/events/perf_event.h | 2 ++ + 3 files changed, 48 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index bd8b98857609..8d6befb24b8e 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -2101,6 +2101,15 @@ static struct extra_reg intel_tnt_extra_regs[] __read_mostly = { + EVENT_EXTRA_END + }; + ++EVENT_ATTR_STR(mem-loads, mem_ld_grt, "event=0xd0,umask=0x5,ldlat=3"); ++EVENT_ATTR_STR(mem-stores, mem_st_grt, "event=0xd0,umask=0x6"); ++ ++static struct attribute *grt_mem_attrs[] = { ++ EVENT_PTR(mem_ld_grt), ++ EVENT_PTR(mem_st_grt), ++ NULL ++}; ++ + static struct extra_reg intel_grt_extra_regs[] __read_mostly = { + /* must define OFFCORE_RSP_X first, see intel_fixup_er() */ + INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0), +@@ -5874,6 +5883,36 @@ __init int intel_pmu_init(void) + name = "Tremont"; + break; + ++ case INTEL_FAM6_ALDERLAKE_N: ++ x86_pmu.mid_ack = true; ++ memcpy(hw_cache_event_ids, glp_hw_cache_event_ids, ++ sizeof(hw_cache_event_ids)); ++ memcpy(hw_cache_extra_regs, tnt_hw_cache_extra_regs, ++ sizeof(hw_cache_extra_regs)); ++ hw_cache_event_ids[C(ITLB)][C(OP_READ)][C(RESULT_ACCESS)] = -1; ++ ++ x86_pmu.event_constraints = intel_slm_event_constraints; ++ x86_pmu.pebs_constraints = intel_grt_pebs_event_constraints; ++ x86_pmu.extra_regs = intel_grt_extra_regs; ++ ++ x86_pmu.pebs_aliases = NULL; ++ x86_pmu.pebs_prec_dist = true; ++ x86_pmu.pebs_block = true; ++ x86_pmu.lbr_pt_coexist = true; ++ x86_pmu.flags |= PMU_FL_HAS_RSP_1; ++ x86_pmu.flags |= PMU_FL_INSTR_LATENCY; ++ ++ intel_pmu_pebs_data_source_grt(); ++ x86_pmu.pebs_latency_data = adl_latency_data_small; ++ x86_pmu.get_event_constraints = tnt_get_event_constraints; ++ x86_pmu.limit_period = spr_limit_period; ++ td_attr = tnt_events_attrs; ++ mem_attr = grt_mem_attrs; ++ extra_attr = nhm_format_attr; ++ pr_cont("Gracemont events, "); ++ name = "gracemont"; ++ break; ++ + case INTEL_FAM6_WESTMERE: + case INTEL_FAM6_WESTMERE_EP: + case INTEL_FAM6_WESTMERE_EX: +@@ -6216,7 +6255,6 @@ __init int intel_pmu_init(void) + + case INTEL_FAM6_ALDERLAKE: + case INTEL_FAM6_ALDERLAKE_L: +- case INTEL_FAM6_ALDERLAKE_N: + case INTEL_FAM6_RAPTORLAKE: + case INTEL_FAM6_RAPTORLAKE_P: + /* +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 9b48d957d2b3..139204aea94e 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -110,13 +110,18 @@ void __init intel_pmu_pebs_data_source_skl(bool pmem) + __intel_pmu_pebs_data_source_skl(pmem, pebs_data_source); + } + +-static void __init intel_pmu_pebs_data_source_grt(u64 *data_source) ++static void __init __intel_pmu_pebs_data_source_grt(u64 *data_source) + { + data_source[0x05] = OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HIT); + data_source[0x06] = OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HITM); + data_source[0x08] = OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOPX, FWD); + } + ++void __init intel_pmu_pebs_data_source_grt(void) ++{ ++ __intel_pmu_pebs_data_source_grt(pebs_data_source); ++} ++ + void __init intel_pmu_pebs_data_source_adl(void) + { + u64 *data_source; +@@ -127,7 +132,7 @@ void __init intel_pmu_pebs_data_source_adl(void) + + data_source = x86_pmu.hybrid_pmu[X86_HYBRID_PMU_ATOM_IDX].pebs_data_source; + memcpy(data_source, pebs_data_source, sizeof(pebs_data_source)); +- intel_pmu_pebs_data_source_grt(data_source); ++ __intel_pmu_pebs_data_source_grt(data_source); + } + + static u64 precise_store_data(u64 status) +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index 821098aebf78..84f6f947ddef 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -1513,6 +1513,8 @@ void intel_pmu_pebs_data_source_skl(bool pmem); + + void intel_pmu_pebs_data_source_adl(void); + ++void intel_pmu_pebs_data_source_grt(void); ++ + int intel_pmu_setup_lbr_filter(struct perf_event *event); + + void intel_pt_interrupt(void); +-- +2.35.1 + diff --git a/queue-5.19/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch b/queue-5.19/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch new file mode 100644 index 00000000000..03d33409f89 --- /dev/null +++ b/queue-5.19/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch @@ -0,0 +1,76 @@ +From 74b80201f18ff3febc8a063a56254df2fcf61f93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 20:06:41 +0800 +Subject: scsi: qedf: Fix a UAF bug in __qedf_probe() + +From: Letu Ren + +[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ] + +In __qedf_probe(), if qedf->cdev is NULL which means +qed_ops->common->probe() failed, then the program will goto label err1, and +scsi_host_put() will free lport->host pointer. Because the memory qedf +points to is allocated by libfc_host_alloc(), it will be freed by +scsi_host_put(). However, the if statement below label err0 only checks +whether qedf is NULL but doesn't check whether the memory has been freed. +So a UAF bug can occur. + +There are two ways to reach the statements below err0. The first one is +described as before, "qedf" should be set to NULL. The second one is goto +"err0" directly. In the latter scenario qedf hasn't been changed and it has +the initial value NULL. As a result the if statement is not reachable in +any situation. + +The KASAN logs are as follows: + +[ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] +[ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 2.312969] Call Trace: +[ 2.312969] dump_stack_lvl+0x59/0x7b +[ 2.312969] print_address_description+0x7c/0x3b0 +[ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] __kasan_report+0x160/0x1c0 +[ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] kasan_report+0x4b/0x70 +[ 2.312969] ? kobject_put+0x25d/0x290 +[ 2.312969] kasan_check_range+0x2ca/0x310 +[ 2.312969] __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0 +[ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120 +[ 2.312969] ? rpm_resume+0xa5c/0x16e0 +[ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160 +[ 2.312969] local_pci_probe+0x13c/0x1f0 +[ 2.312969] pci_device_probe+0x37e/0x6c0 + +Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com +Reported-by: Zheyu Ma +Acked-by: Saurav Kashyap +Co-developed-by: Wende Tan +Signed-off-by: Wende Tan +Signed-off-by: Letu Ren +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 3d6b137314f3..bbc4d5890ae6 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3686,11 +3686,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) + err1: + scsi_host_put(lport->host); + err0: +- if (qedf) { +- QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n"); +- +- clear_bit(QEDF_PROBING, &qedf->flags); +- } + return rc; + } + +-- +2.35.1 + diff --git a/queue-5.19/series b/queue-5.19/series index 2926609f0df..e0ffe0a6a05 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -5,3 +5,32 @@ docs-update-mediator-information-in-coc-docs.patch xsk-inherit-need_wakeup-flag-for-shared-sockets.patch wait_on_bit-add-an-acquire-memory-barrier.patch provide-arch_test_bit_acquire-for-architectures-that-define-test_bit.patch +firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch +firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch +firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch +arm64-dts-rockchip-fix-upper-usb-port-on-bpi-r2-pro.patch +dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch +dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch +dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch +wifi-iwlwifi-don-t-spam-logs-with-nss-2-messages.patch +arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch +drm-amdgpu-mes-zero-the-sdma_hqd_mask-of-2nd-sdma-en.patch +scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch +net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch +net-marvell-prestera-add-support-for-for-aldrin2.patch +alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch +um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch +um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch +gpio-ftgpio010-make-irqchip-immutable.patch +arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch +net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch +kvm-s390-pass-initialized-arg-even-if-unused.patch +drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch +drm-amd-display-assume-an-lttpr-is-always-present-on.patch +drm-amd-display-update-gamut-remap-if-plane-has-chan.patch +drm-amd-display-skip-audio-setup-when-audio-stream-i.patch +drm-amd-display-fix-dp-mst-timeslot-issue-when-fallb.patch +drm-amd-display-increase-dcn315-pstate-change-latenc.patch +perf-x86-intel-fix-unchecked-msr-access-error-for-al.patch +coredump-don-t-use-__kernel_write-on-kmap_local_page.patch +i2c-davinci-fix-pm-disable-depth-imbalance-in-davinc.patch diff --git a/queue-5.19/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch b/queue-5.19/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch new file mode 100644 index 00000000000..d8353752c05 --- /dev/null +++ b/queue-5.19/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch @@ -0,0 +1,70 @@ +From b3aa287a9b066a474f56d45ab0dfe3e3643b8210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 15:29:31 +0000 +Subject: um: Cleanup compiler warning in arch/x86/um/tls_32.c + +From: Lukas Straub + +[ Upstream commit d27fff3499671dc23a08efd01cdb8b3764a391c4 ] + +arch.tls_array is statically allocated so checking for NULL doesn't +make sense. This causes the compiler warning below. + +Remove the checks to silence these warnings. + +../arch/x86/um/tls_32.c: In function 'get_free_idx': +../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress] + 68 | if (!t->arch.tls_array) + | ^ +In file included from ../arch/x86/um/asm/processor.h:10, + from ../include/linux/rcupdate.h:30, + from ../include/linux/rculist.h:11, + from ../include/linux/pid.h:5, + from ../include/linux/sched.h:14, + from ../arch/x86/um/tls_32.c:7: +../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here + 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES]; + | ^~~~~~~~~ +../arch/x86/um/tls_32.c: In function 'get_tls_entry': +../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress] + 243 | if (!t->arch.tls_array) + | ^ +../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here + 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES]; + | ^~~~~~~~~ + +Signed-off-by: Lukas Straub +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/x86/um/tls_32.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c +index ac8eee093f9c..66162eafd8e8 100644 +--- a/arch/x86/um/tls_32.c ++++ b/arch/x86/um/tls_32.c +@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task) + struct thread_struct *t = &task->thread; + int idx; + +- if (!t->arch.tls_array) +- return GDT_ENTRY_TLS_MIN; +- + for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++) + if (!t->arch.tls_array[idx].present) + return idx + GDT_ENTRY_TLS_MIN; +@@ -240,9 +237,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info, + { + struct thread_struct *t = &task->thread; + +- if (!t->arch.tls_array) +- goto clear; +- + if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX) + return -EINVAL; + +-- +2.35.1 + diff --git a/queue-5.19/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch b/queue-5.19/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch new file mode 100644 index 00000000000..0f75cbe8d46 --- /dev/null +++ b/queue-5.19/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch @@ -0,0 +1,41 @@ +From de0bd6fe834dcc5975b60d8249d92b8adb0ceea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 15:29:27 +0000 +Subject: um: Cleanup syscall_handler_t cast in syscalls_32.h + +From: Lukas Straub + +[ Upstream commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 ] + +Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9 +"um: Cleanup syscall_handler_t definition/cast, fix warning", +remove the cast to to fix the compiler warning. + +Signed-off-by: Lukas Straub +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/x86/um/shared/sysdep/syscalls_32.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/um/shared/sysdep/syscalls_32.h b/arch/x86/um/shared/sysdep/syscalls_32.h +index 68fd2cf526fd..f6e9f84397e7 100644 +--- a/arch/x86/um/shared/sysdep/syscalls_32.h ++++ b/arch/x86/um/shared/sysdep/syscalls_32.h +@@ -6,10 +6,9 @@ + #include + #include + +-typedef long syscall_handler_t(struct pt_regs); ++typedef long syscall_handler_t(struct syscall_args); + + extern syscall_handler_t *sys_call_table[]; + + #define EXECUTE_SYSCALL(syscall, regs) \ +- ((long (*)(struct syscall_args)) \ +- (*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs)) ++ ((*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs)) +-- +2.35.1 + diff --git a/queue-5.19/wifi-iwlwifi-don-t-spam-logs-with-nss-2-messages.patch b/queue-5.19/wifi-iwlwifi-don-t-spam-logs-with-nss-2-messages.patch new file mode 100644 index 00000000000..95b9dd8ec36 --- /dev/null +++ b/queue-5.19/wifi-iwlwifi-don-t-spam-logs-with-nss-2-messages.patch @@ -0,0 +1,44 @@ +From 6cd40120a0dbbf9a58924536230d00053f92f6db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 19:22:46 +0200 +Subject: wifi: iwlwifi: don't spam logs with NSS>2 messages + +From: Jason A. Donenfeld + +[ Upstream commit 4d8421f2dd88583cc7a4d6c2a5532c35e816a52a ] + +I get a log line like this every 4 seconds when connected to my AP: + +[15650.221468] iwlwifi 0000:09:00.0: Got NSS = 4 - trimming to 2 + +Looking at the code, this seems to be related to a hardware limitation, +and there's nothing to be done. In an effort to keep my dmesg +manageable, downgrade this error to "debug" rather than "info". + +Cc: Johannes Berg +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220905172246.105383-1-Jason@zx2c4.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index c5626ff83805..640e3786c244 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -1833,8 +1833,8 @@ static void iwl_mvm_parse_ppe(struct iwl_mvm *mvm, + * If nss < MAX: we can set zeros in other streams + */ + if (nss > MAX_HE_SUPP_NSS) { +- IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss, +- MAX_HE_SUPP_NSS); ++ IWL_DEBUG_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss, ++ MAX_HE_SUPP_NSS); + nss = MAX_HE_SUPP_NSS; + } + +-- +2.35.1 + -- 2.47.3