From 051bfcaf11dc0a9f301c32304d44a1c4493a64b2 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 May 2024 13:04:01 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- .../acpi-disable-wstringop-truncation.patch | 48 ++ ...-call-packet_read_pending-from-tpack.patch | 49 ++ ...-races-in-unix_release_sock-unix_str.patch | 76 +++ ...fix-usage-of-device_get_named_child_.patch | 55 ++ ...-rt5645-add-cbj-sleeve-gpio-property.patch | 48 ++ ...able-route-checks-for-skylake-boards.patch | 209 ++++++++ ...kwood-fix-potential-null-dereference.patch | 41 ++ ...the-electric-noise-due-to-the-cbj-co.patch | 105 ++++ ...15-add-vendor-clear-control-register.patch | 38 ++ ...-rt715-sdca-volume-step-modification.patch | 61 +++ ...ort-snd_soc_dapm_dir_out-to-its-valu.patch | 48 ++ .../bpf-pack-struct-bpf_fib_lookup.patch | 74 +++ ...m-mmcc-msm8998-fix-venus-clock-issue.patch | 114 ++++ ...ix-possible-null-pointer-dereference.patch | 65 +++ .../cpufreq-exit-callback-is-optional.patch | 58 ++ ...rrange-locking-in-cpufreq_remove_dev.patch | 70 +++ ...reorganize-checks-in-cpufreq_offline.patch | 73 +++ .../cpufreq-split-cpufreq_offline.patch | 91 ++++ .../crypto-bcm-fix-pointer-arithmetic.patch | 40 ++ ...rypto-ccp-drop-platform-ifdef-checks.patch | 94 ++++ ...o-x86-nh-avx2-add-missing-vzeroupper.patch | 36 ++ ...6-sha256-avx2-add-missing-vzeroupper.patch | 37 ++ ...6-sha512-avx2-add-missing-vzeroupper.patch | 37 ++ ...dev_printk-add-and-use-dev_no_printk.patch | 98 ++++ ...n-fix-pfnmap-pte-checks-in-acrn_vm_r.patch | 195 +++++++ ...fix-potential-index-out-of-bounds-in.patch | 58 ++ ...set-color_mgmt_changed-to-true-on-un.patch | 37 ++ ...-the-process-wq-before-creating-a-kf.patch | 61 +++ ...ix-a-possible-null-pointer-dereferen.patch | 42 ++ ...mhdp8546-fix-possible-null-pointer-d.patch | 43 ++ ...2b-don-t-log-an-error-when-dsi-host-.patch | 49 ++ ...1-don-t-log-an-error-when-dsi-host-c.patch | 50 ++ ...775-don-t-log-an-error-when-dsi-host.patch | 49 ++ ...-add-0-size-check-to-mtk_drm_gem_obj.patch | 44 ++ ...ix-calculation-of-59.94-fractional-r.patch | 65 +++ ...-correct-return-type-for-the-dsc-fun.patch | 69 +++ ...-add-missing-innolux-g121x1-l03-form.patch | 50 ++ ...ix-possible-null-pointer-dereference.patch | 39 ++ ...chip-grf-add-missing-type-to-pcie-ph.patch | 37 ++ ...fs-fix-buffer-size-for-tag-66-packet.patch | 116 ++++ ...epoll-be-better-about-file-lifetimes.patch | 94 ++++ ...e-.ndo_poll_controller-to-avoid-dead.patch | 67 +++ ...sive-credit-estimate-in-ext4_tmpfile.patch | 52 ++ ...-fix-potential-unnitialized-variable.patch | 40 ++ ...ismatch-in-ext4_mb_new_blocks_simple.patch | 57 ++ ...ed-parameter-from-ext4_mb_new_blocks.patch | 189 +++++++ ...lculation-of-blkoff-in-ext4_mb_new_b.patch | 48 ++ ...-groups-in-ext4_mb_new_blocks_simple.patch | 67 +++ .../fbdev-sh7760fb-allow-modular-build.patch | 50 ++ ...dev-shmobile-fix-snprintf-truncation.patch | 40 ++ .../fbdev-sisfb-hide-unused-variables.patch | 68 +++ ...rypi-use-correct-device-for-dma-mapp.patch | 65 +++ ...-forget-to-complete-delayed-withdraw.patch | 39 ++ ...gnore-unlock-failures-after-withdraw.patch | 63 +++ ...d-ipc-add-check-for-pci_alloc_irq_ve.patch | 41 ++ .../ipv6-sr-add-missing-seg6_local_exit.patch | 38 ++ ...v6-sr-fix-incorrect-unregister-order.patch | 39 ++ ...sr-fix-invalid-unregister-error-path.patch | 46 ++ ...si-fix-off-by-one-in-allocation-erro.patch | 40 ++ ...-pch-msi-fix-off-by-one-on-allocatio.patch | 41 ++ ...ttr-node-from-overflowing-the-eraseb.patch | 81 +++ ...nlock-race-in-kernel-thread-creation.patch | 77 +++ ...m68k-mac-fix-reboot-hang-on-mac-iici.patch | 99 ++++ ...cii-fix-bug-sleeping-function-called.patch | 59 +++ ...ftlockup-when-bitmap-size-is-less-th.patch | 93 ++++ ...h_css-fix-a-null-pointer-dereference.patch | 52 ++ ...s-ovti-ov2680-fix-the-power-supply-n.patch | 77 +++ .../media-ipu3-cio2-request-irq-earlier.patch | 52 ++ ...use-temporary-storage-for-struct-dev.patch | 496 ++++++++++++++++++ ...dvb_ca_en50221_init-return-value-che.patch | 40 ++ ...o-shark2-avoid-led_names-truncations.patch | 40 ++ ...e-inverted-data-to-corrupt-kmem-cach.patch | 69 +++ ...-so_keepalive-fix-getsockopt-support.patch | 53 ++ ...error-if-first-mtd_otp_size-call-fai.patch | 44 ++ queue-5.15/mtd-rawnand-hynix-fixed-typo.patch | 43 ++ ...x-add-support-for-model-specific-pre.patch | 234 +++++++++ ...x-avoid-eeprom-timeout-without-eepro.patch | 173 ++++++ .../net-ethernet-cortina-locking-fixes.patch | 86 +++ ...lookup_reuseport-and-inet6_lookup_re.patch | 163 ++++++ ...ances-to-rcu-in-netdev_wait_allrefs_.patch | 54 ++ ...ng-start-position-when-receive-hop-b.patch | 41 ++ ...-command-completions-in-internal-err.patch | 75 +++ ...fix-overwriting-ct-original-tuple-fo.patch | 86 +++ .../net-qrtr-ns-fix-module-refcnt.patch | 83 +++ ...duplicate-reuseport_lookup-functions.patch | 365 +++++++++++++ ...wwan-add-telit-fn920c04-compositions.patch | 108 ++++ ...sc95xx-stop-lying-about-skb-truesize.patch | 87 +++ ...sr9700-stop-lying-about-skb-truesize.patch | 59 +++ ...ix-possible-dead-lock-in-nr_rt_ioctl.patch | 192 +++++++ .../nilfs2-fix-out-of-range-warning.patch | 45 ++ ...sing-mutex_destroy-at-module-removal.patch | 37 ++ ...istance-only-if-controller-has-valid.patch | 47 ++ ...nish-conversion-to-the-new-mount-api.patch | 58 ++ ...c-add-missing-export-of-__cmpxchg_u8.patch | 36 ++ ...omi-wmi-fix-race-condition-when-repo.patch | 95 ++++ ...c-fsl-soc-hide-unused-const-variable.patch | 48 ++ .../printk-let-no_printk-use-_printk.patch | 55 ++ ...to-platform-remove-callback-returnin.patch | 65 +++ ...e-removing-pwm_chip-from-driver-data.patch | 90 ++++ ...-probe-function-using-devm-functions.patch | 115 ++++ ...d-avoid-truncating-work-queue-length.patch | 58 ++ ...hns-fix-deadlock-on-srq-async-events.patch | 69 +++ .../rdma-hns-fix-gmv-table-pagesize.patch | 39 ++ ...x-return-value-in-hns_roce_map_mr_sg.patch | 75 +++ ...-modify-the-print-level-of-cqe-error.patch | 42 ++ ...s-use-complete-parentheses-in-macros.patch | 52 ++ ...format-truncation-compilation-errors.patch | 66 +++ ...-remote-atomic-access-flag-to-updata.patch | 39 ++ ...lator-irq_helpers-duplicate-irq-name.patch | 43 ++ ...vqmmc-ipq4019-fix-module-autoloading.patch | 36 ++ ...-calling-csum_partial-with-misaligne.patch | 187 +++++++ ...a-barrier-for-bpf_fetch-instructions.patch | 62 +++ ...fix-tracepoint-subchannel-type-field.patch | 38 ++ ...ncorrect-initialization-of-the-burst.patch | 71 +++ ...as-checks-before-updating-root_domai.patch | 147 ++++++ ...-disabling-sched_balance_newidle-wit.patch | 64 +++ ...ure-the-copied-buf-is-nul-terminated.patch | 49 ++ ...location-size-for-scsi_host-private-.patch | 41 ++ ...the-failure-of-adding-phy-with-zero-.patch | 55 ++ ...ure-the-copied-buf-is-nul-terminated.patch | 40 ++ ...-debugfs-output-for-fw_resource_coun.patch | 43 ++ ...tfrm-perform-read-back-after-writing.patch | 50 ++ ...rform-read-back-after-disabling-inte.patch | 53 ++ ...rform-read-back-after-disabling-uic_.patch | 52 ++ ...rform-read-back-after-writing-cgc-en.patch | 51 ++ ...rform-read-back-after-writing-reg_uf.patch | 51 ++ ...rform-read-back-after-writing-reset-.patch | 71 +++ ...rform-read-back-after-writing-unipro.patch | 52 ++ ...m-clear-qunipro_g4_sel-for-hw-versio.patch | 76 +++ ...m-fix-the-qcom-register-name-for-off.patch | 41 ++ ...fs-use-the-makefile-s-rules-not-make.patch | 71 +++ ...x-umount-cgroup2-error-in-test_sockm.patch | 43 ++ ...ake-the-test-output-consistent-and-c.patch | 82 +++ ...lftests-kcmp-remove-unused-open-mode.patch | 42 ++ ...idge-increase-igmp-mld-exclude-timeo.patch | 82 +++ ...l-fix-clang-build-failure-use-local_.patch | 60 +++ ...st-return-correct-emulated-syscall-v.patch | 56 ++ queue-5.15/series | 159 ++++++ ...-arch_copy_kprobe-into-arch_prepare_.patch | 53 ++ ...-cmdq-fix-typo-of-cmdq_jump_relative.patch | 49 ++ ...suspicious-rcu-usage-in-__do_softirq.patch | 102 ++++ .../sunrpc-fix-gss_free_in_token_pages.patch | 78 +++ ...sunrpc-removed-redundant-procp-check.patch | 39 ++ ...d-premature-drops-in-tcp_add_backlog.patch | 87 +++ ...s-tsens-fix-null-pointer-dereference.patch | 42 ++ ...l-to-compute_score-on-multiple-sites.patch | 164 ++++++ ...aqc111-stop-lying-about-skb-truesize.patch | 55 ++ ...-array_size-and-struct_size-over-ope.patch | 106 ++++ .../virt-acrn-stop-using-follow_pfn.patch | 71 +++ ...-enable-proper-endpoint-verification.patch | 99 ++++ ...an-error-code-problem-in-ath10k_dbg_.patch | 43 ++ ...-service-ready-message-before-failin.patch | 81 +++ ...h10k-populate-board-data-for-wcn3990.patch | 65 +++ ...d-a-proper-sanity-check-for-endpoint.patch | 97 ++++ ...x-the-order-of-arguments-for-trace-e.patch | 50 ++ ...i-mwl8k-initialize-cmd-addr-properly.patch | 38 ++ ...relocations-in-.notes-sections-in-wa.patch | 54 ++ ...h-instruction-in-x86-instruction-dec.patch | 98 ++++ ...oken-vsyscall-emulation-code-from-th.patch | 232 ++++++++ ...itch-to-the-position-independent-sma.patch | 81 +++ 160 files changed, 11917 insertions(+) create mode 100644 queue-5.15/acpi-disable-wstringop-truncation.patch create mode 100644 queue-5.15/af_packet-do-not-call-packet_read_pending-from-tpack.patch create mode 100644 queue-5.15/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch create mode 100644 queue-5.15/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch create mode 100644 queue-5.15/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch create mode 100644 queue-5.15/asoc-intel-disable-route-checks-for-skylake-boards.patch create mode 100644 queue-5.15/asoc-kirkwood-fix-potential-null-dereference.patch create mode 100644 queue-5.15/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch create mode 100644 queue-5.15/asoc-rt715-add-vendor-clear-control-register.patch create mode 100644 queue-5.15/asoc-rt715-sdca-volume-step-modification.patch create mode 100644 queue-5.15/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch create mode 100644 queue-5.15/bpf-pack-struct-bpf_fib_lookup.patch create mode 100644 queue-5.15/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch create mode 100644 queue-5.15/cppc_cpufreq-fix-possible-null-pointer-dereference.patch create mode 100644 queue-5.15/cpufreq-exit-callback-is-optional.patch create mode 100644 queue-5.15/cpufreq-rearrange-locking-in-cpufreq_remove_dev.patch create mode 100644 queue-5.15/cpufreq-reorganize-checks-in-cpufreq_offline.patch create mode 100644 queue-5.15/cpufreq-split-cpufreq_offline.patch create mode 100644 queue-5.15/crypto-bcm-fix-pointer-arithmetic.patch create mode 100644 queue-5.15/crypto-ccp-drop-platform-ifdef-checks.patch create mode 100644 queue-5.15/crypto-x86-nh-avx2-add-missing-vzeroupper.patch create mode 100644 queue-5.15/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch create mode 100644 queue-5.15/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch create mode 100644 queue-5.15/dev_printk-add-and-use-dev_no_printk.patch create mode 100644 queue-5.15/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch create mode 100644 queue-5.15/drm-amd-display-fix-potential-index-out-of-bounds-in.patch create mode 100644 queue-5.15/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch create mode 100644 queue-5.15/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch create mode 100644 queue-5.15/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch create mode 100644 queue-5.15/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch create mode 100644 queue-5.15/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch create mode 100644 queue-5.15/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch create mode 100644 queue-5.15/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch create mode 100644 queue-5.15/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch create mode 100644 queue-5.15/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch create mode 100644 queue-5.15/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch create mode 100644 queue-5.15/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch create mode 100644 queue-5.15/drm-vc4-fix-possible-null-pointer-dereference.patch create mode 100644 queue-5.15/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch create mode 100644 queue-5.15/ecryptfs-fix-buffer-size-for-tag-66-packet.patch create mode 100644 queue-5.15/epoll-be-better-about-file-lifetimes.patch create mode 100644 queue-5.15/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch create mode 100644 queue-5.15/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch create mode 100644 queue-5.15/ext4-fix-potential-unnitialized-variable.patch create mode 100644 queue-5.15/ext4-fix-unit-mismatch-in-ext4_mb_new_blocks_simple.patch create mode 100644 queue-5.15/ext4-remove-unused-parameter-from-ext4_mb_new_blocks.patch create mode 100644 queue-5.15/ext4-simplify-calculation-of-blkoff-in-ext4_mb_new_b.patch create mode 100644 queue-5.15/ext4-try-all-groups-in-ext4_mb_new_blocks_simple.patch create mode 100644 queue-5.15/fbdev-sh7760fb-allow-modular-build.patch create mode 100644 queue-5.15/fbdev-shmobile-fix-snprintf-truncation.patch create mode 100644 queue-5.15/fbdev-sisfb-hide-unused-variables.patch create mode 100644 queue-5.15/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch create mode 100644 queue-5.15/gfs2-don-t-forget-to-complete-delayed-withdraw.patch create mode 100644 queue-5.15/gfs2-fix-ignore-unlock-failures-after-withdraw.patch create mode 100644 queue-5.15/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch create mode 100644 queue-5.15/ipv6-sr-add-missing-seg6_local_exit.patch create mode 100644 queue-5.15/ipv6-sr-fix-incorrect-unregister-order.patch create mode 100644 queue-5.15/ipv6-sr-fix-invalid-unregister-error-path.patch create mode 100644 queue-5.15/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch create mode 100644 queue-5.15/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch create mode 100644 queue-5.15/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch create mode 100644 queue-5.15/m68k-fix-spinlock-race-in-kernel-thread-creation.patch create mode 100644 queue-5.15/m68k-mac-fix-reboot-hang-on-mac-iici.patch create mode 100644 queue-5.15/macintosh-via-macii-fix-bug-sleeping-function-called.patch create mode 100644 queue-5.15/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch create mode 100644 queue-5.15/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch create mode 100644 queue-5.15/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch create mode 100644 queue-5.15/media-ipu3-cio2-request-irq-earlier.patch create mode 100644 queue-5.15/media-ipu3-cio2-use-temporary-storage-for-struct-dev.patch create mode 100644 queue-5.15/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch create mode 100644 queue-5.15/media-radio-shark2-avoid-led_names-truncations.patch create mode 100644 queue-5.15/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch create mode 100644 queue-5.15/mptcp-so_keepalive-fix-getsockopt-support.patch create mode 100644 queue-5.15/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch create mode 100644 queue-5.15/mtd-rawnand-hynix-fixed-typo.patch create mode 100644 queue-5.15/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch create mode 100644 queue-5.15/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch create mode 100644 queue-5.15/net-ethernet-cortina-locking-fixes.patch create mode 100644 queue-5.15/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch create mode 100644 queue-5.15/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch create mode 100644 queue-5.15/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch create mode 100644 queue-5.15/net-mlx5-discard-command-completions-in-internal-err.patch create mode 100644 queue-5.15/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch create mode 100644 queue-5.15/net-qrtr-ns-fix-module-refcnt.patch create mode 100644 queue-5.15/net-remove-duplicate-reuseport_lookup-functions.patch create mode 100644 queue-5.15/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch create mode 100644 queue-5.15/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch create mode 100644 queue-5.15/net-usb-sr9700-stop-lying-about-skb-truesize.patch create mode 100644 queue-5.15/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch create mode 100644 queue-5.15/nilfs2-fix-out-of-range-warning.patch create mode 100644 queue-5.15/null_blk-fix-missing-mutex_destroy-at-module-removal.patch create mode 100644 queue-5.15/nvme-find-numa-distance-only-if-controller-has-valid.patch create mode 100644 queue-5.15/openpromfs-finish-conversion-to-the-new-mount-api.patch create mode 100644 queue-5.15/parisc-add-missing-export-of-__cmpxchg_u8.patch create mode 100644 queue-5.15/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch create mode 100644 queue-5.15/powerpc-fsl-soc-hide-unused-const-variable.patch create mode 100644 queue-5.15/printk-let-no_printk-use-_printk.patch create mode 100644 queue-5.15/pwm-sti-convert-to-platform-remove-callback-returnin.patch create mode 100644 queue-5.15/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch create mode 100644 queue-5.15/pwm-sti-simplify-probe-function-using-devm-functions.patch create mode 100644 queue-5.15/qed-avoid-truncating-work-queue-length.patch create mode 100644 queue-5.15/rdma-hns-fix-deadlock-on-srq-async-events.patch create mode 100644 queue-5.15/rdma-hns-fix-gmv-table-pagesize.patch create mode 100644 queue-5.15/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch create mode 100644 queue-5.15/rdma-hns-modify-the-print-level-of-cqe-error.patch create mode 100644 queue-5.15/rdma-hns-use-complete-parentheses-in-macros.patch create mode 100644 queue-5.15/rdma-ipoib-fix-format-truncation-compilation-errors.patch create mode 100644 queue-5.15/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch create mode 100644 queue-5.15/regulator-irq_helpers-duplicate-irq-name.patch create mode 100644 queue-5.15/regulator-vqmmc-ipq4019-fix-module-autoloading.patch create mode 100644 queue-5.15/revert-sh-handle-calling-csum_partial-with-misaligne.patch create mode 100644 queue-5.15/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch create mode 100644 queue-5.15/s390-cio-fix-tracepoint-subchannel-type-field.patch create mode 100644 queue-5.15/sched-core-fix-incorrect-initialization-of-the-burst.patch create mode 100644 queue-5.15/sched-fair-add-eas-checks-before-updating-root_domai.patch create mode 100644 queue-5.15/sched-fair-allow-disabling-sched_balance_newidle-wit.patch create mode 100644 queue-5.15/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch create mode 100644 queue-5.15/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch create mode 100644 queue-5.15/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch create mode 100644 queue-5.15/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch create mode 100644 queue-5.15/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch create mode 100644 queue-5.15/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch create mode 100644 queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-inte.patch create mode 100644 queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch create mode 100644 queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch create mode 100644 queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch create mode 100644 queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch create mode 100644 queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch create mode 100644 queue-5.15/scsi-ufs-ufs-qcom-clear-qunipro_g4_sel-for-hw-versio.patch create mode 100644 queue-5.15/scsi-ufs-ufs-qcom-fix-the-qcom-register-name-for-off.patch create mode 100644 queue-5.15/selftests-binderfs-use-the-makefile-s-rules-not-make.patch create mode 100644 queue-5.15/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch create mode 100644 queue-5.15/selftests-kcmp-make-the-test-output-consistent-and-c.patch create mode 100644 queue-5.15/selftests-kcmp-remove-unused-open-mode.patch create mode 100644 queue-5.15/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch create mode 100644 queue-5.15/selftests-resctrl-fix-clang-build-failure-use-local_.patch create mode 100644 queue-5.15/selftests-sud_test-return-correct-emulated-syscall-v.patch create mode 100644 queue-5.15/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch create mode 100644 queue-5.15/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch create mode 100644 queue-5.15/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch create mode 100644 queue-5.15/sunrpc-fix-gss_free_in_token_pages.patch create mode 100644 queue-5.15/sunrpc-removed-redundant-procp-check.patch create mode 100644 queue-5.15/tcp-avoid-premature-drops-in-tcp_add_backlog.patch create mode 100644 queue-5.15/thermal-drivers-tsens-fix-null-pointer-dereference.patch create mode 100644 queue-5.15/udp-avoid-call-to-compute_score-on-multiple-sites.patch create mode 100644 queue-5.15/usb-aqc111-stop-lying-about-skb-truesize.patch create mode 100644 queue-5.15/virt-acrn-prefer-array_size-and-struct_size-over-ope.patch create mode 100644 queue-5.15/virt-acrn-stop-using-follow_pfn.patch create mode 100644 queue-5.15/wifi-ar5523-enable-proper-endpoint-verification.patch create mode 100644 queue-5.15/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch create mode 100644 queue-5.15/wifi-ath10k-poll-service-ready-message-before-failin.patch create mode 100644 queue-5.15/wifi-ath10k-populate-board-data-for-wcn3990.patch create mode 100644 queue-5.15/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch create mode 100644 queue-5.15/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch create mode 100644 queue-5.15/wifi-mwl8k-initialize-cmd-addr-properly.patch create mode 100644 queue-5.15/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch create mode 100644 queue-5.15/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch create mode 100644 queue-5.15/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch create mode 100644 queue-5.15/x86-purgatory-switch-to-the-position-independent-sma.patch diff --git a/queue-5.15/acpi-disable-wstringop-truncation.patch b/queue-5.15/acpi-disable-wstringop-truncation.patch new file mode 100644 index 00000000000..8f4acfc5a15 --- /dev/null +++ b/queue-5.15/acpi-disable-wstringop-truncation.patch @@ -0,0 +1,48 @@ +From c73d843806a2802d4c7e308f242c18a9c173b4f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 16:00:55 +0200 +Subject: ACPI: disable -Wstringop-truncation + +From: Arnd Bergmann + +[ Upstream commit a3403d304708f60565582d60af4316289d0316a0 ] + +gcc -Wstringop-truncation warns about copying a string that results in a +missing nul termination: + +drivers/acpi/acpica/tbfind.c: In function 'acpi_tb_find_table': +drivers/acpi/acpica/tbfind.c:60:9: error: 'strncpy' specified bound 6 equals destination size [-Werror=stringop-truncation] + 60 | strncpy(header.oem_id, oem_id, ACPI_OEM_ID_SIZE); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/acpi/acpica/tbfind.c:61:9: error: 'strncpy' specified bound 8 equals destination size [-Werror=stringop-truncation] + 61 | strncpy(header.oem_table_id, oem_table_id, ACPI_OEM_TABLE_ID_SIZE); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The code works as intended, and the warning could be addressed by using +a memcpy(), but turning the warning off for this file works equally well +and may be easier to merge. + +Fixes: 47c08729bf1c ("ACPICA: Fix for LoadTable operator, input strings") +Link: https://lore.kernel.org/lkml/CAJZ5v0hoUfv54KW7y4223Mn9E7D4xvR7whRFNLTBqCZMUxT50Q@mail.gmail.com/#t +Signed-off-by: Arnd Bergmann +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile +index f919811156b1f..b6cf9c9bd6396 100644 +--- a/drivers/acpi/acpica/Makefile ++++ b/drivers/acpi/acpica/Makefile +@@ -5,6 +5,7 @@ + + ccflags-y := -D_LINUX -DBUILDING_ACPICA + ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT ++CFLAGS_tbfind.o += $(call cc-disable-warning, stringop-truncation) + + # use acpi.o to put all files here into acpi.o modparam namespace + obj-y += acpi.o +-- +2.43.0 + diff --git a/queue-5.15/af_packet-do-not-call-packet_read_pending-from-tpack.patch b/queue-5.15/af_packet-do-not-call-packet_read_pending-from-tpack.patch new file mode 100644 index 00000000000..da5ad95ab55 --- /dev/null +++ b/queue-5.15/af_packet-do-not-call-packet_read_pending-from-tpack.patch @@ -0,0 +1,49 @@ +From 4eb607215e098f96e950ce050e69f07559da7b85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 16:33:58 +0000 +Subject: af_packet: do not call packet_read_pending() from + tpacket_destruct_skb() + +From: Eric Dumazet + +[ Upstream commit 581073f626e387d3e7eed55c48c8495584ead7ba ] + +trafgen performance considerably sank on hosts with many cores +after the blamed commit. + +packet_read_pending() is very expensive, and calling it +in af_packet fast path defeats Daniel intent in commit +b013840810c2 ("packet: use percpu mmap tx frame pending refcount") + +tpacket_destruct_skb() makes room for one packet, we can immediately +wakeup a producer, no need to completely drain the tx ring. + +Fixes: 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") +Signed-off-by: Eric Dumazet +Cc: Neil Horman +Cc: Daniel Borkmann +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20240515163358.4105915-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index cffa217fb3063..0ab3b09f863ba 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2490,8 +2490,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb) + ts = __packet_set_timestamp(po, ph, skb); + __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts); + +- if (!packet_read_pending(&po->tx_ring)) +- complete(&po->skb_completion); ++ complete(&po->skb_completion); + } + + sock_wfree(skb); +-- +2.43.0 + diff --git a/queue-5.15/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch b/queue-5.15/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch new file mode 100644 index 00000000000..350d12b5091 --- /dev/null +++ b/queue-5.15/af_unix-fix-data-races-in-unix_release_sock-unix_str.patch @@ -0,0 +1,76 @@ +From 76646537395e7b577d41352125dfdf3a24093efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 01:14:46 -0700 +Subject: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg + +From: Breno Leitao + +[ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ] + +A data-race condition has been identified in af_unix. In one data path, +the write function unix_release_sock() atomically writes to +sk->sk_shutdown using WRITE_ONCE. However, on the reader side, +unix_stream_sendmsg() does not read it atomically. Consequently, this +issue is causing the following KCSAN splat to occur: + + BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg + + write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: + unix_release_sock (net/unix/af_unix.c:640) + unix_release (net/unix/af_unix.c:1050) + sock_close (net/socket.c:659 net/socket.c:1421) + __fput (fs/file_table.c:422) + __fput_sync (fs/file_table.c:508) + __se_sys_close (fs/open.c:1559 fs/open.c:1541) + __x64_sys_close (fs/open.c:1541) + x64_sys_call (arch/x86/entry/syscall_64.c:33) + do_syscall_64 (arch/x86/entry/common.c:?) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: + unix_stream_sendmsg (net/unix/af_unix.c:2273) + __sock_sendmsg (net/socket.c:730 net/socket.c:745) + ____sys_sendmsg (net/socket.c:2584) + __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) + __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) + x64_sys_call (arch/x86/entry/syscall_64.c:33) + do_syscall_64 (arch/x86/entry/common.c:?) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + value changed: 0x01 -> 0x03 + +The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). + +Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") +addressed a comparable issue in the past regarding sk->sk_shutdown. +However, it overlooked resolving this particular data path. +This patch only offending unix_stream_sendmsg() function, since the +other reads seem to be protected by unix_state_lock() as discussed in +Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Breno Leitao +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/unix/af_unix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index f66f867049015..995a2a0b208a1 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2057,7 +2057,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, + goto out_err; + } + +- if (sk->sk_shutdown & SEND_SHUTDOWN) ++ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) + goto pipe_err; + + while (sent < len) { +-- +2.43.0 + diff --git a/queue-5.15/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch b/queue-5.15/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch new file mode 100644 index 00000000000..38c6873d8d4 --- /dev/null +++ b/queue-5.15/asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch @@ -0,0 +1,55 @@ +From dec81a7b436293cc6cac2315e1dc0c4e0ebdb3d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 10:30:33 -0500 +Subject: ASoC: da7219-aad: fix usage of device_get_named_child_node() + +From: Pierre-Louis Bossart + +[ Upstream commit e8a6a5ad73acbafd98e8fd3f0cbf6e379771bb76 ] + +The documentation for device_get_named_child_node() mentions this +important point: + +" +The caller is responsible for calling fwnode_handle_put() on the +returned fwnode pointer. +" + +Add fwnode_handle_put() to avoid a leaked reference. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240426153033.38500-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 4dc6eed6c18aa..99676c426f781 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -629,8 +629,10 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + return NULL; + + aad_pdata = devm_kzalloc(dev, sizeof(*aad_pdata), GFP_KERNEL); +- if (!aad_pdata) ++ if (!aad_pdata) { ++ fwnode_handle_put(aad_np); + return NULL; ++ } + + aad_pdata->irq = i2c->irq; + +@@ -705,6 +707,8 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + else + aad_pdata->adc_1bit_rpt = DA7219_AAD_ADC_1BIT_RPT_1; + ++ fwnode_handle_put(aad_np); ++ + return aad_pdata; + } + +-- +2.43.0 + diff --git a/queue-5.15/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch b/queue-5.15/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch new file mode 100644 index 00000000000..2a6f0dea6bd --- /dev/null +++ b/queue-5.15/asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch @@ -0,0 +1,48 @@ +From 644ce0cb93c6fd272cd00c90ce001e96dd1d7d53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 17:10:57 +0800 +Subject: ASoC: dt-bindings: rt5645: add cbj sleeve gpio property + +From: Derek Fang + +[ Upstream commit 306b38e3fa727d22454a148a364123709e356600 ] + +Add an optional gpio property to control external CBJ circuits +to avoid some electric noise caused by sleeve/ring2 contacts floating. + +Signed-off-by: Derek Fang + +Link: https://msgid.link/r/20240408091057.14165-2-derek.fang@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/sound/rt5645.txt | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/Documentation/devicetree/bindings/sound/rt5645.txt b/Documentation/devicetree/bindings/sound/rt5645.txt +index 41a62fd2ae1ff..c1fa379f5f3ea 100644 +--- a/Documentation/devicetree/bindings/sound/rt5645.txt ++++ b/Documentation/devicetree/bindings/sound/rt5645.txt +@@ -20,6 +20,11 @@ Optional properties: + a GPIO spec for the external headphone detect pin. If jd-mode = 0, + we will get the JD status by getting the value of hp-detect-gpios. + ++- cbj-sleeve-gpios: ++ a GPIO spec to control the external combo jack circuit to tie the sleeve/ring2 ++ contacts to the ground or floating. It could avoid some electric noise from the ++ active speaker jacks. ++ + - realtek,in2-differential + Boolean. Indicate MIC2 input are differential, rather than single-ended. + +@@ -68,6 +73,7 @@ codec: rt5650@1a { + compatible = "realtek,rt5650"; + reg = <0x1a>; + hp-detect-gpios = <&gpio 19 0>; ++ cbj-sleeve-gpios = <&gpio 20 0>; + interrupt-parent = <&gpio>; + interrupts = <7 IRQ_TYPE_EDGE_FALLING>; + realtek,dmic-en = "true"; +-- +2.43.0 + diff --git a/queue-5.15/asoc-intel-disable-route-checks-for-skylake-boards.patch b/queue-5.15/asoc-intel-disable-route-checks-for-skylake-boards.patch new file mode 100644 index 00000000000..3e878b1321e --- /dev/null +++ b/queue-5.15/asoc-intel-disable-route-checks-for-skylake-boards.patch @@ -0,0 +1,209 @@ +From 721afb244b70ac33bcbab85739c8f44b89592d22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 10:04:58 +0100 +Subject: ASoC: Intel: Disable route checks for Skylake boards + +From: Cezary Rojewski + +[ Upstream commit 0cb3b7fd530b8c107443218ce6db5cb6e7b5dbe1 ] + +Topology files that are propagated to the world and utilized by the +skylake-driver carry shortcomings in their SectionGraphs. + +Since commit daa480bde6b3 ("ASoC: soc-core: tidyup for +snd_soc_dapm_add_routes()") route checks are no longer permissive. Probe +failures for Intel boards have been partially addressed by commit +a22ae72b86a4 ("ASoC: soc-core: disable route checks for legacy devices") +and its follow up but only skl_nau88l25_ssm4567.c is patched. Fix the +problem for the rest of the boards. + +Link: https://lore.kernel.org/all/20200309192744.18380-1-pierre-louis.bossart@linux.intel.com/ +Fixes: daa480bde6b3 ("ASoC: soc-core: tidyup for snd_soc_dapm_add_routes()") +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240308090502.2136760-2-cezary.rojewski@intel.com +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + + sound/soc/intel/boards/bxt_rt298.c | 1 + + sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 ++ + sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 ++++ + sound/soc/intel/boards/kbl_rt5660.c | 1 + + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 ++ + sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ + sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 + + sound/soc/intel/boards/skl_rt286.c | 1 + + 11 files changed, 17 insertions(+) + +diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c +index e49c64f54a12c..5bc2f8c82ffcd 100644 +--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c ++++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c +@@ -750,6 +750,7 @@ static struct snd_soc_card broxton_audio_card = { + .dapm_routes = audio_map, + .num_dapm_routes = ARRAY_SIZE(audio_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = bxt_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c +index 0d1df37ecea0b..cd11a40252329 100644 +--- a/sound/soc/intel/boards/bxt_rt298.c ++++ b/sound/soc/intel/boards/bxt_rt298.c +@@ -575,6 +575,7 @@ static struct snd_soc_card broxton_rt298 = { + .dapm_routes = broxton_rt298_map, + .num_dapm_routes = ARRAY_SIZE(broxton_rt298_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = bxt_card_late_probe, + + }; +diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c +index 99b3d7642cb77..5f1eb75048324 100644 +--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c ++++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c +@@ -603,6 +603,8 @@ static int geminilake_audio_probe(struct platform_device *pdev) + card = &glk_audio_card_rt5682_m98357a; + card->dev = &pdev->dev; + snd_soc_card_set_drvdata(card, ctx); ++ if (!snd_soc_acpi_sof_parent(&pdev->dev)) ++ card->disable_route_checks = true; + + /* override platform name, if required */ + mach = pdev->dev.platform_data; +diff --git a/sound/soc/intel/boards/kbl_da7219_max98357a.c b/sound/soc/intel/boards/kbl_da7219_max98357a.c +index 14b625e947f5f..77f6898b397d4 100644 +--- a/sound/soc/intel/boards/kbl_da7219_max98357a.c ++++ b/sound/soc/intel/boards/kbl_da7219_max98357a.c +@@ -621,6 +621,7 @@ static struct snd_soc_card kabylake_audio_card_da7219_m98357a = { + .dapm_routes = kabylake_map, + .num_dapm_routes = ARRAY_SIZE(kabylake_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_da7219_max98927.c b/sound/soc/intel/boards/kbl_da7219_max98927.c +index 2b43459adc33a..2c57c9204d322 100644 +--- a/sound/soc/intel/boards/kbl_da7219_max98927.c ++++ b/sound/soc/intel/boards/kbl_da7219_max98927.c +@@ -1018,6 +1018,7 @@ static struct snd_soc_card kbl_audio_card_da7219_m98927 = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -1036,6 +1037,7 @@ static struct snd_soc_card kbl_audio_card_max98927 = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -1053,6 +1055,7 @@ static struct snd_soc_card kbl_audio_card_da7219_m98373 = { + .codec_conf = max98373_codec_conf, + .num_configs = ARRAY_SIZE(max98373_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -1070,6 +1073,7 @@ static struct snd_soc_card kbl_audio_card_max98373 = { + .codec_conf = max98373_codec_conf, + .num_configs = ARRAY_SIZE(max98373_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_rt5660.c b/sound/soc/intel/boards/kbl_rt5660.c +index 289ca39b8206e..776a1beaaf17d 100644 +--- a/sound/soc/intel/boards/kbl_rt5660.c ++++ b/sound/soc/intel/boards/kbl_rt5660.c +@@ -519,6 +519,7 @@ static struct snd_soc_card kabylake_audio_card_rt5660 = { + .dapm_routes = kabylake_rt5660_map, + .num_dapm_routes = ARRAY_SIZE(kabylake_rt5660_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_rt5663_max98927.c b/sound/soc/intel/boards/kbl_rt5663_max98927.c +index a3e040a249f6f..fa7d9cff98550 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_max98927.c +@@ -954,6 +954,7 @@ static struct snd_soc_card kabylake_audio_card_rt5663_m98927 = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +@@ -970,6 +971,7 @@ static struct snd_soc_card kabylake_audio_card_rt5663 = { + .dapm_routes = kabylake_5663_map, + .num_dapm_routes = ARRAY_SIZE(kabylake_5663_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index dd38fdaf2ff58..673eaa8917067 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -779,6 +779,7 @@ static struct snd_soc_card kabylake_audio_card = { + .codec_conf = max98927_codec_conf, + .num_configs = ARRAY_SIZE(max98927_codec_conf), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = kabylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c +index f4b4eeca3e03c..6aad5232acbe4 100644 +--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c ++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c +@@ -229,6 +229,8 @@ static int skl_hda_audio_probe(struct platform_device *pdev) + ctx->common_hdmi_codec_drv = mach->mach_params.common_hdmi_codec_drv; + + hda_soc_card.dev = &pdev->dev; ++ if (!snd_soc_acpi_sof_parent(&pdev->dev)) ++ hda_soc_card.disable_route_checks = true; + + if (mach->mach_params.dmic_num > 0) { + snprintf(hda_soc_components, sizeof(hda_soc_components), +diff --git a/sound/soc/intel/boards/skl_nau88l25_max98357a.c b/sound/soc/intel/boards/skl_nau88l25_max98357a.c +index e3a1f04a8b535..3b62e15da95fa 100644 +--- a/sound/soc/intel/boards/skl_nau88l25_max98357a.c ++++ b/sound/soc/intel/boards/skl_nau88l25_max98357a.c +@@ -643,6 +643,7 @@ static struct snd_soc_card skylake_audio_card = { + .dapm_routes = skylake_map, + .num_dapm_routes = ARRAY_SIZE(skylake_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = skylake_card_late_probe, + }; + +diff --git a/sound/soc/intel/boards/skl_rt286.c b/sound/soc/intel/boards/skl_rt286.c +index 75dab5405380f..9c2ba695c1a16 100644 +--- a/sound/soc/intel/boards/skl_rt286.c ++++ b/sound/soc/intel/boards/skl_rt286.c +@@ -524,6 +524,7 @@ static struct snd_soc_card skylake_rt286 = { + .dapm_routes = skylake_rt286_map, + .num_dapm_routes = ARRAY_SIZE(skylake_rt286_map), + .fully_routed = true, ++ .disable_route_checks = true, + .late_probe = skylake_card_late_probe, + }; + +-- +2.43.0 + diff --git a/queue-5.15/asoc-kirkwood-fix-potential-null-dereference.patch b/queue-5.15/asoc-kirkwood-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..c33bd794fbf --- /dev/null +++ b/queue-5.15/asoc-kirkwood-fix-potential-null-dereference.patch @@ -0,0 +1,41 @@ +From bdaaf1f8ea1e3349b9d3bd6ac123245b3f2e0525 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 20:33:37 +0300 +Subject: ASoC: kirkwood: Fix potential NULL dereference + +From: Aleksandr Mishin + +[ Upstream commit ea60ab95723f5738e7737b56dda95e6feefa5b50 ] + +In kirkwood_dma_hw_params() mv_mbus_dram_info() returns NULL if +CONFIG_PLAT_ORION macro is not defined. +Fix this bug by adding NULL check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bb6a40fc5a83 ("ASoC: kirkwood: Fix reference to PCM buffer address") +Signed-off-by: Aleksandr Mishin +Link: https://msgid.link/r/20240328173337.21406-1-amishin@t-argos.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/kirkwood/kirkwood-dma.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c +index 640cebd2983e2..16d2c9acc33a6 100644 +--- a/sound/soc/kirkwood/kirkwood-dma.c ++++ b/sound/soc/kirkwood/kirkwood-dma.c +@@ -182,6 +182,9 @@ static int kirkwood_dma_hw_params(struct snd_soc_component *component, + const struct mbus_dram_target_info *dram = mv_mbus_dram_info(); + unsigned long addr = substream->runtime->dma_addr; + ++ if (!dram) ++ return 0; ++ + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + kirkwood_dma_conf_mbus_windows(priv->io, + KIRKWOOD_PLAYBACK_WIN, addr, dram); +-- +2.43.0 + diff --git a/queue-5.15/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch b/queue-5.15/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch new file mode 100644 index 00000000000..a82a9d39c70 --- /dev/null +++ b/queue-5.15/asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch @@ -0,0 +1,105 @@ +From e22cfc35293813ccb411e8d24eb457360ca4eb88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 17:10:56 +0800 +Subject: ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating + +From: Derek Fang + +[ Upstream commit 103abab975087e1f01b76fcb54c91dbb65dbc249 ] + +The codec leaves tie combo jack's sleeve/ring2 to floating status +default. It would cause electric noise while connecting the active +speaker jack during boot or shutdown. +This patch requests a gpio to control the additional jack circuit +to tie the contacts to the ground or floating. + +Signed-off-by: Derek Fang + +Link: https://msgid.link/r/20240408091057.14165-1-derek.fang@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 2cc3d814bab41..5a44f5201515b 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -441,6 +441,7 @@ struct rt5645_priv { + struct regmap *regmap; + struct i2c_client *i2c; + struct gpio_desc *gpiod_hp_det; ++ struct gpio_desc *gpiod_cbj_sleeve; + struct snd_soc_jack *hp_jack; + struct snd_soc_jack *mic_jack; + struct snd_soc_jack *btn_jack; +@@ -3179,6 +3180,9 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + regmap_update_bits(rt5645->regmap, RT5645_IN1_CTRL2, + RT5645_CBJ_MN_JD, 0); + ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 1); ++ + msleep(600); + regmap_read(rt5645->regmap, RT5645_IN1_CTRL3, &val); + val &= 0x7; +@@ -3195,6 +3199,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); + snd_soc_dapm_sync(dapm); + rt5645->jack_type = SND_JACK_HEADPHONE; ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); + } + if (rt5645->pdata.level_trigger_irq) + regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2, +@@ -3220,6 +3226,9 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + if (rt5645->pdata.level_trigger_irq) + regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2, + RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV); ++ ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); + } + + return rt5645->jack_type; +@@ -3933,6 +3942,16 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, + return ret; + } + ++ rt5645->gpiod_cbj_sleeve = devm_gpiod_get_optional(&i2c->dev, "cbj-sleeve", ++ GPIOD_OUT_LOW); ++ ++ if (IS_ERR(rt5645->gpiod_cbj_sleeve)) { ++ ret = PTR_ERR(rt5645->gpiod_cbj_sleeve); ++ dev_info(&i2c->dev, "failed to initialize gpiod, ret=%d\n", ret); ++ if (ret != -ENOENT) ++ return ret; ++ } ++ + for (i = 0; i < ARRAY_SIZE(rt5645->supplies); i++) + rt5645->supplies[i].supply = rt5645_supply_names[i]; + +@@ -4176,6 +4195,9 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) + cancel_delayed_work_sync(&rt5645->jack_detect_work); + cancel_delayed_work_sync(&rt5645->rcclock_work); + ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); ++ + regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); + + return 0; +@@ -4193,6 +4215,9 @@ static void rt5645_i2c_shutdown(struct i2c_client *i2c) + 0); + msleep(20); + regmap_write(rt5645->regmap, RT5645_RESET, 0); ++ ++ if (rt5645->gpiod_cbj_sleeve) ++ gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0); + } + + static struct i2c_driver rt5645_i2c_driver = { +-- +2.43.0 + diff --git a/queue-5.15/asoc-rt715-add-vendor-clear-control-register.patch b/queue-5.15/asoc-rt715-add-vendor-clear-control-register.patch new file mode 100644 index 00000000000..44582649ef8 --- /dev/null +++ b/queue-5.15/asoc-rt715-add-vendor-clear-control-register.patch @@ -0,0 +1,38 @@ +From c29728c602316ed023d885bd06d292548b43e8a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 06:27:23 +0000 +Subject: ASoC: rt715: add vendor clear control register + +From: Jack Yu + +[ Upstream commit cebfbc89ae2552dbb58cd9b8206a5c8e0e6301e9 ] + +Add vendor clear control register in readable register's +callback function. This prevents an access failure reported +in Intel CI tests. + +Signed-off-by: Jack Yu +Closes: https://github.com/thesofproject/linux/issues/4860 +Tested-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/6a103ce9134d49d8b3941172c87a7bd4@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/rt715-sdw.c b/sound/soc/codecs/rt715-sdw.c +index b047bf87a100c..e269026942e17 100644 +--- a/sound/soc/codecs/rt715-sdw.c ++++ b/sound/soc/codecs/rt715-sdw.c +@@ -111,6 +111,7 @@ static bool rt715_readable_register(struct device *dev, unsigned int reg) + case 0x839d: + case 0x83a7: + case 0x83a9: ++ case 0x752001: + case 0x752039: + return true; + default: +-- +2.43.0 + diff --git a/queue-5.15/asoc-rt715-sdca-volume-step-modification.patch b/queue-5.15/asoc-rt715-sdca-volume-step-modification.patch new file mode 100644 index 00000000000..de44c7f047d --- /dev/null +++ b/queue-5.15/asoc-rt715-sdca-volume-step-modification.patch @@ -0,0 +1,61 @@ +From b944c3b1380b0103898adffac63f54109d602bb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 06:59:35 +0000 +Subject: ASoC: rt715-sdca: volume step modification + +From: Jack Yu + +[ Upstream commit bda16500dd0b05e2e047093b36cbe0873c95aeae ] + +Volume step (dB/step) modification to fix format error +which shown in amixer control. + +Signed-off-by: Jack Yu +Link: https://lore.kernel.org/r/b1f546ad16dc4c7abb7daa7396e8345c@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdca.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/rt715-sdca.c b/sound/soc/codecs/rt715-sdca.c +index bfa536bd71960..7c8d6a012f610 100644 +--- a/sound/soc/codecs/rt715-sdca.c ++++ b/sound/soc/codecs/rt715-sdca.c +@@ -315,7 +315,7 @@ static int rt715_sdca_set_amp_gain_8ch_get(struct snd_kcontrol *kcontrol, + return 0; + } + +-static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -17625, 375, 0); ++static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -1725, 75, 0); + static const DECLARE_TLV_DB_SCALE(mic_vol_tlv, 0, 1000, 0); + + static int rt715_sdca_get_volsw(struct snd_kcontrol *kcontrol, +@@ -476,7 +476,7 @@ static const struct snd_kcontrol_new rt715_sdca_snd_controls[] = { + RT715_SDCA_FU_VOL_CTRL, CH_01), + SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_ADC7_27_VOL, + RT715_SDCA_FU_VOL_CTRL, CH_02), +- 0x2f, 0x7f, 0, ++ 0x2f, 0x3f, 0, + rt715_sdca_set_amp_gain_get, rt715_sdca_set_amp_gain_put, + in_vol_tlv), + RT715_SDCA_EXT_TLV("FU02 Capture Volume", +@@ -484,13 +484,13 @@ static const struct snd_kcontrol_new rt715_sdca_snd_controls[] = { + RT715_SDCA_FU_VOL_CTRL, CH_01), + rt715_sdca_set_amp_gain_4ch_get, + rt715_sdca_set_amp_gain_4ch_put, +- in_vol_tlv, 4, 0x7f), ++ in_vol_tlv, 4, 0x3f), + RT715_SDCA_EXT_TLV("FU06 Capture Volume", + SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_ADC10_11_VOL, + RT715_SDCA_FU_VOL_CTRL, CH_01), + rt715_sdca_set_amp_gain_4ch_get, + rt715_sdca_set_amp_gain_4ch_put, +- in_vol_tlv, 4, 0x7f), ++ in_vol_tlv, 4, 0x3f), + /* MIC Boost Control */ + RT715_SDCA_BOOST_EXT_TLV("FU0E Boost", + SDW_SDCA_CTL(FUN_MIC_ARRAY, RT715_SDCA_FU_DMIC_GAIN_EN, +-- +2.43.0 + diff --git a/queue-5.15/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch b/queue-5.15/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch new file mode 100644 index 00000000000..15f4365d5c9 --- /dev/null +++ b/queue-5.15/asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch @@ -0,0 +1,48 @@ +From 3c095844d596efbe123924ce3defddd92235499c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 00:03:03 -0400 +Subject: ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value + +From: Steven Rostedt + +[ Upstream commit 58300f8d6a48e58d1843199be743f819e2791ea3 ] + +The string SND_SOC_DAPM_DIR_OUT is printed in the snd_soc_dapm_path trace +event instead of its value: + + (((REC->path_dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-") + +User space cannot parse this, as it has no idea what SND_SOC_DAPM_DIR_OUT +is. Use TRACE_DEFINE_ENUM() to convert it to its value: + + (((REC->path_dir) == 1) ? "->" : "<-") + +So that user space tools, such as perf and trace-cmd, can parse it +correctly. + +Reported-by: Luca Ceresoli +Fixes: 6e588a0d839b5 ("ASoC: dapm: Consolidate path trace events") +Signed-off-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20240416000303.04670cdf@rorschach.local.home +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/trace/events/asoc.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/trace/events/asoc.h b/include/trace/events/asoc.h +index 4d8ef71090af1..97a434d021356 100644 +--- a/include/trace/events/asoc.h ++++ b/include/trace/events/asoc.h +@@ -12,6 +12,8 @@ + #define DAPM_DIRECT "(direct)" + #define DAPM_ARROW(dir) (((dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-") + ++TRACE_DEFINE_ENUM(SND_SOC_DAPM_DIR_OUT); ++ + struct snd_soc_jack; + struct snd_soc_card; + struct snd_soc_dapm_widget; +-- +2.43.0 + diff --git a/queue-5.15/bpf-pack-struct-bpf_fib_lookup.patch b/queue-5.15/bpf-pack-struct-bpf_fib_lookup.patch new file mode 100644 index 00000000000..cbc611bf99a --- /dev/null +++ b/queue-5.15/bpf-pack-struct-bpf_fib_lookup.patch @@ -0,0 +1,74 @@ +From b26919874d9fa872eb84426879502cebf5993c2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 14:33:03 +0200 +Subject: bpf: Pack struct bpf_fib_lookup + +From: Anton Protopopov + +[ Upstream commit f91717007217d975aa975ddabd91ae1a107b9bff ] + +The struct bpf_fib_lookup is supposed to be of size 64. A recent commit +59b418c7063d ("bpf: Add a check for struct bpf_fib_lookup size") added +a static assertion to check this property so that future changes to the +structure will not accidentally break this assumption. + +As it immediately turned out, on some 32-bit arm systems, when AEABI=n, +the total size of the structure was equal to 68, see [1]. This happened +because the bpf_fib_lookup structure contains a union of two 16-bit +fields: + + union { + __u16 tot_len; + __u16 mtu_result; + }; + +which was supposed to compile to a 16-bit-aligned 16-bit field. On the +aforementioned setups it was instead both aligned and padded to 32-bits. + +Declare this inner union as __attribute__((packed, aligned(2))) such +that it always is of size 2 and is aligned to 16 bits. + + [1] https://lore.kernel.org/all/CA+G9fYtsoP51f-oP_Sp5MOq-Ffv8La2RztNpwvE6+R1VtFiLrw@mail.gmail.com/#t + +Reported-by: Naresh Kamboju +Fixes: e1850ea9bd9e ("bpf: bpf_fib_lookup return MTU value as output when looked up") +Signed-off-by: Anton Protopopov +Signed-off-by: Andrii Nakryiko +Reviewed-by: Alexander Lobakin +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240403123303.1452184-1-aspsk@isovalent.com +Signed-off-by: Sasha Levin +--- + include/uapi/linux/bpf.h | 2 +- + tools/include/uapi/linux/bpf.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index bdb5f2ba769d2..6bfb510656abe 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -6089,7 +6089,7 @@ struct bpf_fib_lookup { + + /* output: MTU value */ + __u16 mtu_result; +- }; ++ } __attribute__((packed, aligned(2))); + /* input: L3 device index for lookup + * output: device index from FIB lookup + */ +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 69d7f0d65b38b..54b8c899d21ce 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -6089,7 +6089,7 @@ struct bpf_fib_lookup { + + /* output: MTU value */ + __u16 mtu_result; +- }; ++ } __attribute__((packed, aligned(2))); + /* input: L3 device index for lookup + * output: device index from FIB lookup + */ +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch b/queue-5.15/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch new file mode 100644 index 00000000000..0bf96621556 --- /dev/null +++ b/queue-5.15/clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch @@ -0,0 +1,114 @@ +From fb541211f66bbaba9f5f0824746c5e4f0ea095e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 17:07:07 +0200 +Subject: clk: qcom: mmcc-msm8998: fix venus clock issue + +From: Marc Gonzalez + +[ Upstream commit e20ae5ae9f0c843aded4f06f3d1cab7384789e92 ] + +Right now, msm8998 video decoder (venus) is non-functional: + +$ time mpv --hwdec=v4l2m2m-copy --vd-lavc-software-fallback=no --vo=null --no-audio --untimed --length=30 --quiet demo-480.webm + (+) Video --vid=1 (*) (vp9 854x480 29.970fps) + Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz) +[ffmpeg/video] vp9_v4l2m2m: output VIDIOC_REQBUFS failed: Connection timed out +[ffmpeg/video] vp9_v4l2m2m: no v4l2 output context's buffers +[ffmpeg/video] vp9_v4l2m2m: can't configure decoder +Could not open codec. +Software decoding fallback is disabled. +Exiting... (Quit) + +Bryan O'Donoghue suggested the proper fix: +- Set required register offsets in venus GDSC structs. +- Set HW_CTRL flag. + +$ time mpv --hwdec=v4l2m2m-copy --vd-lavc-software-fallback=no --vo=null --no-audio --untimed --length=30 --quiet demo-480.webm + (+) Video --vid=1 (*) (vp9 854x480 29.970fps) + Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz) +[ffmpeg/video] vp9_v4l2m2m: VIDIOC_G_FMT ioctl +[ffmpeg/video] vp9_v4l2m2m: VIDIOC_G_FMT ioctl +... +Using hardware decoding (v4l2m2m-copy). +VO: [null] 854x480 nv12 +Exiting... (End of file) +real 0m3.315s +user 0m1.277s +sys 0m0.453s + +NOTES: + +GDSC = Globally Distributed Switch Controller + +Use same code as mmcc-msm8996 with: +s/venus_gdsc/video_top_gdsc/ +s/venus_core0_gdsc/video_subcore0_gdsc/ +s/venus_core1_gdsc/video_subcore1_gdsc/ + +https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/caf_migration/kernel.lnx.4.4.r38-rel/include/dt-bindings/clock/msm-clocks-hwio-8996.h +https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/caf_migration/kernel.lnx.4.4.r38-rel/include/dt-bindings/clock/msm-clocks-hwio-8998.h + +0x1024 = MMSS_VIDEO GDSCR (undocumented) +0x1028 = MMSS_VIDEO_CORE_CBCR +0x1030 = MMSS_VIDEO_AHB_CBCR +0x1034 = MMSS_VIDEO_AXI_CBCR +0x1038 = MMSS_VIDEO_MAXI_CBCR +0x1040 = MMSS_VIDEO_SUBCORE0 GDSCR (undocumented) +0x1044 = MMSS_VIDEO_SUBCORE1 GDSCR (undocumented) +0x1048 = MMSS_VIDEO_SUBCORE0_CBCR +0x104c = MMSS_VIDEO_SUBCORE1_CBCR + +Fixes: d14b15b5931c2b ("clk: qcom: Add MSM8998 Multimedia Clock Controller (MMCC) driver") +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Marc Gonzalez +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/ff4e2e34-a677-4c39-8c29-83655c5512ae@freebox.fr +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8998.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c +index a68764cfb7930..5e2e60c1c2283 100644 +--- a/drivers/clk/qcom/mmcc-msm8998.c ++++ b/drivers/clk/qcom/mmcc-msm8998.c +@@ -2587,6 +2587,8 @@ static struct clk_hw *mmcc_msm8998_hws[] = { + + static struct gdsc video_top_gdsc = { + .gdscr = 0x1024, ++ .cxcs = (unsigned int []){ 0x1028, 0x1034, 0x1038 }, ++ .cxc_count = 3, + .pd = { + .name = "video_top", + }, +@@ -2595,20 +2597,26 @@ static struct gdsc video_top_gdsc = { + + static struct gdsc video_subcore0_gdsc = { + .gdscr = 0x1040, ++ .cxcs = (unsigned int []){ 0x1048 }, ++ .cxc_count = 1, + .pd = { + .name = "video_subcore0", + }, + .parent = &video_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = HW_CTRL, + }; + + static struct gdsc video_subcore1_gdsc = { + .gdscr = 0x1044, ++ .cxcs = (unsigned int []){ 0x104c }, ++ .cxc_count = 1, + .pd = { + .name = "video_subcore1", + }, + .parent = &video_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = HW_CTRL, + }; + + static struct gdsc mdss_gdsc = { +-- +2.43.0 + diff --git a/queue-5.15/cppc_cpufreq-fix-possible-null-pointer-dereference.patch b/queue-5.15/cppc_cpufreq-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..3b2f6bdfd81 --- /dev/null +++ b/queue-5.15/cppc_cpufreq-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,65 @@ +From 3b6b368879551142d2cce9136134ef045c5c639c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 12:35:36 +0300 +Subject: cppc_cpufreq: Fix possible null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit cf7de25878a1f4508c69dc9f6819c21ba177dbfe ] + +cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from +different places with various parameters. So cpufreq_cpu_get() can return +null as 'policy' in some circumstances. +Fix this bug by adding null return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a28b2bfc099c ("cppc_cpufreq: replace per-cpu data array with a list") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cppc_cpufreq.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index e0ff09d66c96b..17cfa2b92eeec 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -615,10 +615,15 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) + { + struct cppc_perf_fb_ctrs fb_ctrs_t0 = {0}, fb_ctrs_t1 = {0}; + struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); +- struct cppc_cpudata *cpu_data = policy->driver_data; ++ struct cppc_cpudata *cpu_data; + u64 delivered_perf; + int ret; + ++ if (!policy) ++ return -ENODEV; ++ ++ cpu_data = policy->driver_data; ++ + cpufreq_cpu_put(policy); + + ret = cppc_get_perf_ctrs(cpu, &fb_ctrs_t0); +@@ -697,10 +702,15 @@ static struct cpufreq_driver cppc_cpufreq_driver = { + static unsigned int hisi_cppc_cpufreq_get_rate(unsigned int cpu) + { + struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); +- struct cppc_cpudata *cpu_data = policy->driver_data; ++ struct cppc_cpudata *cpu_data; + u64 desired_perf; + int ret; + ++ if (!policy) ++ return -ENODEV; ++ ++ cpu_data = policy->driver_data; ++ + cpufreq_cpu_put(policy); + + ret = cppc_get_desired_perf(cpu, &desired_perf); +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-exit-callback-is-optional.patch b/queue-5.15/cpufreq-exit-callback-is-optional.patch new file mode 100644 index 00000000000..5f7a5608991 --- /dev/null +++ b/queue-5.15/cpufreq-exit-callback-is-optional.patch @@ -0,0 +1,58 @@ +From b7d8598f21201d1c9988c73a85fb7172c7518e4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 11:19:20 +0530 +Subject: cpufreq: exit() callback is optional + +From: Viresh Kumar + +[ Upstream commit b8f85833c05730d631576008daaa34096bc7f3ce ] + +The exit() callback is optional and shouldn't be called without checking +a valid pointer first. + +Also, we must clear freq_table pointer even if the exit() callback isn't +present. + +Signed-off-by: Viresh Kumar +Fixes: 91a12e91dc39 ("cpufreq: Allow light-weight tear down and bring up of CPUs") +Fixes: f339f3541701 ("cpufreq: Rearrange locking in cpufreq_remove_dev()") +Reported-by: Lizhe +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index a8b469094cd3d..a7bbe6f28b544 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1616,10 +1616,13 @@ static void __cpufreq_offline(unsigned int cpu, struct cpufreq_policy *policy) + */ + if (cpufreq_driver->offline) { + cpufreq_driver->offline(policy); +- } else if (cpufreq_driver->exit) { +- cpufreq_driver->exit(policy); +- policy->freq_table = NULL; ++ return; + } ++ ++ if (cpufreq_driver->exit) ++ cpufreq_driver->exit(policy); ++ ++ policy->freq_table = NULL; + } + + static int cpufreq_offline(unsigned int cpu) +@@ -1669,7 +1672,7 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif) + } + + /* We did light-weight exit earlier, do full tear down now */ +- if (cpufreq_driver->offline) ++ if (cpufreq_driver->offline && cpufreq_driver->exit) + cpufreq_driver->exit(policy); + + up_write(&policy->rwsem); +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-rearrange-locking-in-cpufreq_remove_dev.patch b/queue-5.15/cpufreq-rearrange-locking-in-cpufreq_remove_dev.patch new file mode 100644 index 00000000000..9b056d3fd19 --- /dev/null +++ b/queue-5.15/cpufreq-rearrange-locking-in-cpufreq_remove_dev.patch @@ -0,0 +1,70 @@ +From 24f530f4296021f9c4054915d70c3870a20af97a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:51:39 +0200 +Subject: cpufreq: Rearrange locking in cpufreq_remove_dev() + +From: Rafael J. Wysocki + +[ Upstream commit f339f3541701d824a0256ad4bf14c26ceb6d79c3 ] + +Currently, cpufreq_remove_dev() invokes the ->exit() driver callback +without holding the policy rwsem which is inconsistent with what +happens if ->exit() is invoked directly from cpufreq_offline(). + +It also manipulates the real_cpus mask and removes the CPU device +symlink without holding the policy rwsem, but cpufreq_offline() holds +the rwsem around the modifications thereof. + +For consistency, modify cpufreq_remove_dev() to hold the policy rwsem +until the ->exit() callback has been called (or it has been determined +that it is not necessary to call it). + +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Stable-dep-of: b8f85833c057 ("cpufreq: exit() callback is optional") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index ce7d718bdfced..a8b469094cd3d 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1655,19 +1655,26 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif) + if (!policy) + return; + ++ down_write(&policy->rwsem); ++ + if (cpu_online(cpu)) +- cpufreq_offline(cpu); ++ __cpufreq_offline(cpu, policy); + + cpumask_clear_cpu(cpu, policy->real_cpus); + remove_cpu_dev_symlink(policy, dev); + +- if (cpumask_empty(policy->real_cpus)) { +- /* We did light-weight exit earlier, do full tear down now */ +- if (cpufreq_driver->offline) +- cpufreq_driver->exit(policy); +- +- cpufreq_policy_free(policy); ++ if (!cpumask_empty(policy->real_cpus)) { ++ up_write(&policy->rwsem); ++ return; + } ++ ++ /* We did light-weight exit earlier, do full tear down now */ ++ if (cpufreq_driver->offline) ++ cpufreq_driver->exit(policy); ++ ++ up_write(&policy->rwsem); ++ ++ cpufreq_policy_free(policy); + } + + /** +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-reorganize-checks-in-cpufreq_offline.patch b/queue-5.15/cpufreq-reorganize-checks-in-cpufreq_offline.patch new file mode 100644 index 00000000000..0b93769c489 --- /dev/null +++ b/queue-5.15/cpufreq-reorganize-checks-in-cpufreq_offline.patch @@ -0,0 +1,73 @@ +From 1059a5b7a8a0de1ea1affdcd0c90cd03288d3246 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:48:41 +0200 +Subject: cpufreq: Reorganize checks in cpufreq_offline() + +From: Rafael J. Wysocki + +[ Upstream commit e1e962c5b9edbc628a335bcdbd010331a12d3e5b ] + +Notice that cpufreq_offline() only needs to check policy_is_inactive() +once and rearrange the code in there to make that happen. + +No expected functional impact. + +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Stable-dep-of: b8f85833c057 ("cpufreq: exit() callback is optional") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index c2227be7bad88..b65dc6af19f08 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1586,24 +1586,18 @@ static int cpufreq_offline(unsigned int cpu) + } + + down_write(&policy->rwsem); ++ + if (has_target()) + cpufreq_stop_governor(policy); + + cpumask_clear_cpu(cpu, policy->cpus); + +- if (policy_is_inactive(policy)) { +- if (has_target()) +- strncpy(policy->last_governor, policy->governor->name, +- CPUFREQ_NAME_LEN); +- else +- policy->last_policy = policy->policy; +- } else if (cpu == policy->cpu) { +- /* Nominate new CPU */ +- policy->cpu = cpumask_any(policy->cpus); +- } +- +- /* Start governor again for active policy */ + if (!policy_is_inactive(policy)) { ++ /* Nominate a new CPU if necessary. */ ++ if (cpu == policy->cpu) ++ policy->cpu = cpumask_any(policy->cpus); ++ ++ /* Start the governor again for the active policy. */ + if (has_target()) { + ret = cpufreq_start_governor(policy); + if (ret) +@@ -1613,6 +1607,12 @@ static int cpufreq_offline(unsigned int cpu) + goto unlock; + } + ++ if (has_target()) ++ strncpy(policy->last_governor, policy->governor->name, ++ CPUFREQ_NAME_LEN); ++ else ++ policy->last_policy = policy->policy; ++ + if (cpufreq_thermal_control_enabled(cpufreq_driver)) { + cpufreq_cooling_unregister(policy->cdev); + policy->cdev = NULL; +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-split-cpufreq_offline.patch b/queue-5.15/cpufreq-split-cpufreq_offline.patch new file mode 100644 index 00000000000..6055ca83f62 --- /dev/null +++ b/queue-5.15/cpufreq-split-cpufreq_offline.patch @@ -0,0 +1,91 @@ +From 08446f1abce8d5d3aa9532154a229b9aa3c9e845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:50:09 +0200 +Subject: cpufreq: Split cpufreq_offline() + +From: Rafael J. Wysocki + +[ Upstream commit fddd8f86dff4a24742a7f0322ccbb34c6c1c9850 ] + +Split the "core" part running under the policy rwsem out of +cpufreq_offline() to allow the locking in cpufreq_remove_dev() to be +rearranged more easily. + +As a side-effect this eliminates the unlock label that's not needed +any more. + +No expected functional impact. + +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Stable-dep-of: b8f85833c057 ("cpufreq: exit() callback is optional") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 33 +++++++++++++++++++-------------- + 1 file changed, 19 insertions(+), 14 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index b65dc6af19f08..ce7d718bdfced 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1572,21 +1572,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif) + return 0; + } + +-static int cpufreq_offline(unsigned int cpu) ++static void __cpufreq_offline(unsigned int cpu, struct cpufreq_policy *policy) + { +- struct cpufreq_policy *policy; + int ret; + +- pr_debug("%s: unregistering CPU %u\n", __func__, cpu); +- +- policy = cpufreq_cpu_get_raw(cpu); +- if (!policy) { +- pr_debug("%s: No cpu_data found\n", __func__); +- return 0; +- } +- +- down_write(&policy->rwsem); +- + if (has_target()) + cpufreq_stop_governor(policy); + +@@ -1604,7 +1593,7 @@ static int cpufreq_offline(unsigned int cpu) + pr_err("%s: Failed to start governor\n", __func__); + } + +- goto unlock; ++ return; + } + + if (has_target()) +@@ -1631,8 +1620,24 @@ static int cpufreq_offline(unsigned int cpu) + cpufreq_driver->exit(policy); + policy->freq_table = NULL; + } ++} ++ ++static int cpufreq_offline(unsigned int cpu) ++{ ++ struct cpufreq_policy *policy; ++ ++ pr_debug("%s: unregistering CPU %u\n", __func__, cpu); ++ ++ policy = cpufreq_cpu_get_raw(cpu); ++ if (!policy) { ++ pr_debug("%s: No cpu_data found\n", __func__); ++ return 0; ++ } ++ ++ down_write(&policy->rwsem); ++ ++ __cpufreq_offline(cpu, policy); + +-unlock: + up_write(&policy->rwsem); + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-bcm-fix-pointer-arithmetic.patch b/queue-5.15/crypto-bcm-fix-pointer-arithmetic.patch new file mode 100644 index 00000000000..74bee834c57 --- /dev/null +++ b/queue-5.15/crypto-bcm-fix-pointer-arithmetic.patch @@ -0,0 +1,40 @@ +From dea86577a71838b4665d482a0ece4b2db945577d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 23:59:15 +0300 +Subject: crypto: bcm - Fix pointer arithmetic + +From: Aleksandr Mishin + +[ Upstream commit 2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9 ] + +In spu2_dump_omd() value of ptr is increased by ciph_key_len +instead of hash_iv_len which could lead to going beyond the +buffer boundaries. +Fix this bug by changing ciph_key_len to hash_iv_len. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/spu2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/bcm/spu2.c b/drivers/crypto/bcm/spu2.c +index 07989bb8c220a..3fdc64b5a65e7 100644 +--- a/drivers/crypto/bcm/spu2.c ++++ b/drivers/crypto/bcm/spu2.c +@@ -495,7 +495,7 @@ static void spu2_dump_omd(u8 *omd, u16 hash_key_len, u16 ciph_key_len, + if (hash_iv_len) { + packet_log(" Hash IV Length %u bytes\n", hash_iv_len); + packet_dump(" hash IV: ", ptr, hash_iv_len); +- ptr += ciph_key_len; ++ ptr += hash_iv_len; + } + + if (ciph_iv_len) { +-- +2.43.0 + diff --git a/queue-5.15/crypto-ccp-drop-platform-ifdef-checks.patch b/queue-5.15/crypto-ccp-drop-platform-ifdef-checks.patch new file mode 100644 index 00000000000..6ee2964f51b --- /dev/null +++ b/queue-5.15/crypto-ccp-drop-platform-ifdef-checks.patch @@ -0,0 +1,94 @@ +From 7ddf480a85c395c783cbecd171a6d6092577f657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:42 +0200 +Subject: crypto: ccp - drop platform ifdef checks + +From: Arnd Bergmann + +[ Upstream commit 42c2d7d02977ef09d434b1f5b354f5bc6c1027ab ] + +When both ACPI and OF are disabled, the dev_vdata variable is unused: + +drivers/crypto/ccp/sp-platform.c:33:34: error: unused variable 'dev_vdata' [-Werror,-Wunused-const-variable] + +This is not a useful configuration, and there is not much point in saving +a few bytes when only one of the two is enabled, so just remove all +these ifdef checks and rely on of_match_node() and acpi_match_device() +returning NULL when these subsystems are disabled. + +Fixes: 6c5063434098 ("crypto: ccp - Add ACPI support") +Signed-off-by: Arnd Bergmann +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sp-platform.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/ccp/sp-platform.c b/drivers/crypto/ccp/sp-platform.c +index 9dba52fbee997..121f9d0cb608e 100644 +--- a/drivers/crypto/ccp/sp-platform.c ++++ b/drivers/crypto/ccp/sp-platform.c +@@ -39,44 +39,38 @@ static const struct sp_dev_vdata dev_vdata[] = { + }, + }; + +-#ifdef CONFIG_ACPI + static const struct acpi_device_id sp_acpi_match[] = { + { "AMDI0C00", (kernel_ulong_t)&dev_vdata[0] }, + { }, + }; + MODULE_DEVICE_TABLE(acpi, sp_acpi_match); +-#endif + +-#ifdef CONFIG_OF + static const struct of_device_id sp_of_match[] = { + { .compatible = "amd,ccp-seattle-v1a", + .data = (const void *)&dev_vdata[0] }, + { }, + }; + MODULE_DEVICE_TABLE(of, sp_of_match); +-#endif + + static struct sp_dev_vdata *sp_get_of_version(struct platform_device *pdev) + { +-#ifdef CONFIG_OF + const struct of_device_id *match; + + match = of_match_node(sp_of_match, pdev->dev.of_node); + if (match && match->data) + return (struct sp_dev_vdata *)match->data; +-#endif ++ + return NULL; + } + + static struct sp_dev_vdata *sp_get_acpi_version(struct platform_device *pdev) + { +-#ifdef CONFIG_ACPI + const struct acpi_device_id *match; + + match = acpi_match_device(sp_acpi_match, &pdev->dev); + if (match && match->driver_data) + return (struct sp_dev_vdata *)match->driver_data; +-#endif ++ + return NULL; + } + +@@ -222,12 +216,8 @@ static int sp_platform_resume(struct platform_device *pdev) + static struct platform_driver sp_platform_driver = { + .driver = { + .name = "ccp", +-#ifdef CONFIG_ACPI + .acpi_match_table = sp_acpi_match, +-#endif +-#ifdef CONFIG_OF + .of_match_table = sp_of_match, +-#endif + }, + .probe = sp_platform_probe, + .remove = sp_platform_remove, +-- +2.43.0 + diff --git a/queue-5.15/crypto-x86-nh-avx2-add-missing-vzeroupper.patch b/queue-5.15/crypto-x86-nh-avx2-add-missing-vzeroupper.patch new file mode 100644 index 00000000000..72094da790c --- /dev/null +++ b/queue-5.15/crypto-x86-nh-avx2-add-missing-vzeroupper.patch @@ -0,0 +1,36 @@ +From 0aa77b0fe3f53ad053560eaacb76dc4e5713288e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 20:26:08 -0400 +Subject: crypto: x86/nh-avx2 - add missing vzeroupper + +From: Eric Biggers + +[ Upstream commit 4ad096cca942959871d8ff73826d30f81f856f6e ] + +Since nh_avx2() uses ymm registers, execute vzeroupper before returning +from it. This is necessary to avoid reducing the performance of SSE +code. + +Fixes: 0f961f9f670e ("crypto: x86/nhpoly1305 - add AVX2 accelerated NHPoly1305") +Signed-off-by: Eric Biggers +Acked-by: Tim Chen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/nh-avx2-x86_64.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/crypto/nh-avx2-x86_64.S b/arch/x86/crypto/nh-avx2-x86_64.S +index 6a0b15e7196a8..54c0ee41209d5 100644 +--- a/arch/x86/crypto/nh-avx2-x86_64.S ++++ b/arch/x86/crypto/nh-avx2-x86_64.S +@@ -153,5 +153,6 @@ SYM_FUNC_START(nh_avx2) + vpaddq T1, T0, T0 + vpaddq T4, T0, T0 + vmovdqu T0, (HASH) ++ vzeroupper + RET + SYM_FUNC_END(nh_avx2) +-- +2.43.0 + diff --git a/queue-5.15/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch b/queue-5.15/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch new file mode 100644 index 00000000000..99e93c02cca --- /dev/null +++ b/queue-5.15/crypto-x86-sha256-avx2-add-missing-vzeroupper.patch @@ -0,0 +1,37 @@ +From 617c4a0e309cd84ba9ccb7c0cbdfd2284dd13e10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 20:26:09 -0400 +Subject: crypto: x86/sha256-avx2 - add missing vzeroupper + +From: Eric Biggers + +[ Upstream commit 57ce8a4e162599cf9adafef1f29763160a8e5564 ] + +Since sha256_transform_rorx() uses ymm registers, execute vzeroupper +before returning from it. This is necessary to avoid reducing the +performance of SSE code. + +Fixes: d34a460092d8 ("crypto: sha256 - Optimized sha256 x86_64 routine using AVX2's RORX instructions") +Signed-off-by: Eric Biggers +Acked-by: Tim Chen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/sha256-avx2-asm.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/crypto/sha256-avx2-asm.S b/arch/x86/crypto/sha256-avx2-asm.S +index 9bcdbc47b8b4b..f7d7287768559 100644 +--- a/arch/x86/crypto/sha256-avx2-asm.S ++++ b/arch/x86/crypto/sha256-avx2-asm.S +@@ -710,6 +710,7 @@ done_hash: + popq %r13 + popq %r12 + popq %rbx ++ vzeroupper + RET + SYM_FUNC_END(sha256_transform_rorx) + +-- +2.43.0 + diff --git a/queue-5.15/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch b/queue-5.15/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch new file mode 100644 index 00000000000..0cd1f80cee3 --- /dev/null +++ b/queue-5.15/crypto-x86-sha512-avx2-add-missing-vzeroupper.patch @@ -0,0 +1,37 @@ +From 8953a56981fa4563c56ee1e8a8bfa3c60c4e12ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 20:26:10 -0400 +Subject: crypto: x86/sha512-avx2 - add missing vzeroupper + +From: Eric Biggers + +[ Upstream commit 6a24fdfe1edbafacdacd53516654d99068f20eec ] + +Since sha512_transform_rorx() uses ymm registers, execute vzeroupper +before returning from it. This is necessary to avoid reducing the +performance of SSE code. + +Fixes: e01d69cb0195 ("crypto: sha512 - Optimized SHA512 x86_64 assembly routine using AVX instructions.") +Signed-off-by: Eric Biggers +Acked-by: Tim Chen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/sha512-avx2-asm.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/crypto/sha512-avx2-asm.S b/arch/x86/crypto/sha512-avx2-asm.S +index 5cdaab7d69015..1c4e5d88e167e 100644 +--- a/arch/x86/crypto/sha512-avx2-asm.S ++++ b/arch/x86/crypto/sha512-avx2-asm.S +@@ -679,6 +679,7 @@ done_hash: + pop %r12 + pop %rbx + ++ vzeroupper + RET + SYM_FUNC_END(sha512_transform_rorx) + +-- +2.43.0 + diff --git a/queue-5.15/dev_printk-add-and-use-dev_no_printk.patch b/queue-5.15/dev_printk-add-and-use-dev_no_printk.patch new file mode 100644 index 00000000000..0a326b5aebf --- /dev/null +++ b/queue-5.15/dev_printk-add-and-use-dev_no_printk.patch @@ -0,0 +1,98 @@ +From 1a9582e01174d71736d4edceb4f1e4637a572c16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:00:03 +0100 +Subject: dev_printk: Add and use dev_no_printk() + +From: Geert Uytterhoeven + +[ Upstream commit c26ec799042a3888935d59b599f33e41efedf5f8 ] + +When printk-indexing is enabled, each dev_printk() invocation emits a +pi_entry structure. This is even true when the dev_printk() is +protected by an always-false check, as is typically the case for debug +messages: while the actual code to print the message is optimized out by +the compiler, the pi_entry structure is still emitted. + +Avoid emitting pi_entry structures for unavailable dev_printk() kernel +messages by: + 1. Introducing a dev_no_printk() helper, mimicked after the existing + no_printk() helper, which calls _dev_printk() instead of + dev_printk(), + 2. Replacing all "if (0) dev_printk(...)" constructs by calls to the + new helper. + +This reduces the size of an arm64 defconfig kernel with +CONFIG_PRINTK_INDEX=y by 957 KiB. + +Fixes: ad7d61f159db7397 ("printk: index: Add indexing support to dev_printk") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Andy Shevchenko +Reviewed-by: Xiubo Li +Reviewed-by: Chris Down +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/8583d54f1687c801c6cda8edddf2cf0344c6e883.1709127473.git.geert+renesas@glider.be +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + include/linux/dev_printk.h | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/include/linux/dev_printk.h b/include/linux/dev_printk.h +index 8904063d4c9f0..65eec5be8ccb9 100644 +--- a/include/linux/dev_printk.h ++++ b/include/linux/dev_printk.h +@@ -129,6 +129,16 @@ void _dev_info(const struct device *dev, const char *fmt, ...) + _dev_printk(level, dev, fmt, ##__VA_ARGS__); \ + }) + ++/* ++ * Dummy dev_printk for disabled debugging statements to use whilst maintaining ++ * gcc's format checking. ++ */ ++#define dev_no_printk(level, dev, fmt, ...) \ ++ ({ \ ++ if (0) \ ++ _dev_printk(level, dev, fmt, ##__VA_ARGS__); \ ++ }) ++ + /* + * #defines for all the dev_ macros to prefix with whatever + * possible use of #define dev_fmt(fmt) ... +@@ -158,10 +168,7 @@ void _dev_info(const struct device *dev, const char *fmt, ...) + dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #else + #define dev_dbg(dev, fmt, ...) \ +-({ \ +- if (0) \ +- dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \ +-}) ++ dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #endif + + #ifdef CONFIG_PRINTK +@@ -247,20 +254,14 @@ do { \ + } while (0) + #else + #define dev_dbg_ratelimited(dev, fmt, ...) \ +-do { \ +- if (0) \ +- dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \ +-} while (0) ++ dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #endif + + #ifdef VERBOSE_DEBUG + #define dev_vdbg dev_dbg + #else + #define dev_vdbg(dev, fmt, ...) \ +-({ \ +- if (0) \ +- dev_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__); \ +-}) ++ dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__) + #endif + + /* +-- +2.43.0 + diff --git a/queue-5.15/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch b/queue-5.15/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch new file mode 100644 index 00000000000..01ffeb114c4 --- /dev/null +++ b/queue-5.15/drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch @@ -0,0 +1,195 @@ +From 08ae966b1b851be3422ed2723c6be898219adc79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 17:55:25 +0200 +Subject: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() + +From: David Hildenbrand + +[ Upstream commit 3d6586008f7b638f91f3332602592caa8b00b559 ] + +Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes". + +Patch #1 fixes a bunch of issues I spotted in the acrn driver. It +compiles, that's all I know. I'll appreciate some review and testing from +acrn folks. + +Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding +more sanity checks, and improving the documentation. Gave it a quick test +on x86-64 using VM_PAT that ends up using follow_pte(). + +This patch (of 3): + +We currently miss handling various cases, resulting in a dangerous +follow_pte() (previously follow_pfn()) usage. + +(1) We're not checking PTE write permissions. + +Maybe we should simply always require pte_write() like we do for +pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for +ACRN_MEM_ACCESS_WRITE for now. + +(2) We're not rejecting refcounted pages. + +As we are not using MMU notifiers, messing with refcounted pages is +dangerous and can result in use-after-free. Let's make sure to reject them. + +(3) We are only looking at the first PTE of a bigger range. + +We only lookup a single PTE, but memmap->len may span a larger area. +Let's loop over all involved PTEs and make sure the PFN range is +actually contiguous. Reject everything else: it couldn't have worked +either way, and rather made use access PFNs we shouldn't be accessing. + +Link: https://lkml.kernel.org/r/20240410155527.474777-1-david@redhat.com +Link: https://lkml.kernel.org/r/20240410155527.474777-2-david@redhat.com +Fixes: 8a6e85f75a83 ("virt: acrn: obtain pa from VMA with PFNMAP flag") +Signed-off-by: David Hildenbrand +Cc: Alex Williamson +Cc: Christoph Hellwig +Cc: Fei Li +Cc: Gerald Schaefer +Cc: Heiko Carstens +Cc: Ingo Molnar +Cc: Paolo Bonzini +Cc: Yonghua Huang +Cc: Sean Christopherson +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/virt/acrn/mm.c | 63 +++++++++++++++++++++++++++++++----------- + 1 file changed, 47 insertions(+), 16 deletions(-) + +diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c +index ffc1d1136f765..8ef49d7be453c 100644 +--- a/drivers/virt/acrn/mm.c ++++ b/drivers/virt/acrn/mm.c +@@ -155,23 +155,29 @@ int acrn_vm_memseg_unmap(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + { + struct vm_memory_region_batch *regions_info; +- int nr_pages, i = 0, order, nr_regions = 0; ++ int nr_pages, i, order, nr_regions = 0; + struct vm_memory_mapping *region_mapping; + struct vm_memory_region_op *vm_region; + struct page **pages = NULL, *page; + void *remap_vaddr; + int ret, pinned; + u64 user_vm_pa; +- unsigned long pfn; + struct vm_area_struct *vma; + + if (!vm || !memmap) + return -EINVAL; + ++ /* Get the page number of the map region */ ++ nr_pages = memmap->len >> PAGE_SHIFT; ++ if (!nr_pages) ++ return -EINVAL; ++ + mmap_read_lock(current->mm); + vma = vma_lookup(current->mm, memmap->vma_base); + if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) { ++ unsigned long start_pfn, cur_pfn; + spinlock_t *ptl; ++ bool writable; + pte_t *ptep; + + if ((memmap->vma_base + memmap->len) > vma->vm_end) { +@@ -179,25 +185,53 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + return -EINVAL; + } + +- ret = follow_pte(vma->vm_mm, memmap->vma_base, &ptep, &ptl); +- if (ret < 0) { +- mmap_read_unlock(current->mm); ++ for (i = 0; i < nr_pages; i++) { ++ ret = follow_pte(vma->vm_mm, ++ memmap->vma_base + i * PAGE_SIZE, ++ &ptep, &ptl); ++ if (ret) ++ break; ++ ++ cur_pfn = pte_pfn(ptep_get(ptep)); ++ if (i == 0) ++ start_pfn = cur_pfn; ++ writable = !!pte_write(ptep_get(ptep)); ++ pte_unmap_unlock(ptep, ptl); ++ ++ /* Disallow write access if the PTE is not writable. */ ++ if (!writable && ++ (memmap->attr & ACRN_MEM_ACCESS_WRITE)) { ++ ret = -EFAULT; ++ break; ++ } ++ ++ /* Disallow refcounted pages. */ ++ if (pfn_valid(cur_pfn) && ++ !PageReserved(pfn_to_page(cur_pfn))) { ++ ret = -EFAULT; ++ break; ++ } ++ ++ /* Disallow non-contiguous ranges. */ ++ if (cur_pfn != start_pfn + i) { ++ ret = -EINVAL; ++ break; ++ } ++ } ++ mmap_read_unlock(current->mm); ++ ++ if (ret) { + dev_dbg(acrn_dev.this_device, + "Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base); + return ret; + } +- pfn = pte_pfn(ptep_get(ptep)); +- pte_unmap_unlock(ptep, ptl); +- mmap_read_unlock(current->mm); + + return acrn_mm_region_add(vm, memmap->user_vm_pa, +- PFN_PHYS(pfn), memmap->len, ++ PFN_PHYS(start_pfn), memmap->len, + ACRN_MEM_TYPE_WB, memmap->attr); + } + mmap_read_unlock(current->mm); + +- /* Get the page number of the map region */ +- nr_pages = memmap->len >> PAGE_SHIFT; + pages = vzalloc(array_size(nr_pages, sizeof(*pages))); + if (!pages) + return -ENOMEM; +@@ -241,12 +275,11 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + mutex_unlock(&vm->regions_mapping_lock); + + /* Calculate count of vm_memory_region_op */ +- while (i < nr_pages) { ++ for (i = 0; i < nr_pages; i += 1 << order) { + page = pages[i]; + VM_BUG_ON_PAGE(PageTail(page), page); + order = compound_order(page); + nr_regions++; +- i += 1 << order; + } + + /* Prepare the vm_memory_region_batch */ +@@ -263,8 +296,7 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + regions_info->regions_num = nr_regions; + regions_info->regions_gpa = virt_to_phys(vm_region); + user_vm_pa = memmap->user_vm_pa; +- i = 0; +- while (i < nr_pages) { ++ for (i = 0; i < nr_pages; i += 1 << order) { + u32 region_size; + + page = pages[i]; +@@ -280,7 +312,6 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + + vm_region++; + user_vm_pa += region_size; +- i += 1 << order; + } + + /* Inform the ACRN Hypervisor to set up EPT mappings */ +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-display-fix-potential-index-out-of-bounds-in.patch b/queue-5.15/drm-amd-display-fix-potential-index-out-of-bounds-in.patch new file mode 100644 index 00000000000..c92a6c71404 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-potential-index-out-of-bounds-in.patch @@ -0,0 +1,58 @@ +From bca34a79977b596fa584cc97544aea16f4d4f95c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 18:38:08 +0530 +Subject: drm/amd/display: Fix potential index out of bounds in color + transformation function + +From: Srinivasan Shanmugam + +[ Upstream commit 63ae548f1054a0b71678d0349c7dc9628ddd42ca ] + +Fixes index out of bounds issue in the color transformation function. +The issue could occur when the index 'i' exceeds the number of transfer +function points (TRANSFER_FUNC_POINTS). + +The fix adds a check to ensure 'i' is within bounds before accessing the +transfer function points. If 'i' is out of bounds, an error message is +logged and the function returns false to indicate an error. + +Reported by smatch: +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max +drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max + +Fixes: b629596072e5 ("drm/amd/display: Build unity lut for shaper") +Cc: Vitaly Prosyak +Cc: Charlene Liu +Cc: Harry Wentland +Cc: Rodrigo Siqueira +Cc: Roman Li +Cc: Aurabindo Pillai +Cc: Tom Chung +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Tom Chung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +index 7a00fe525dfba..bd9bc51983fec 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +@@ -379,6 +379,11 @@ bool cm_helper_translate_curve_to_hw_format( + i += increment) { + if (j == hw_points - 1) + break; ++ if (i >= TRANSFER_FUNC_POINTS) { ++ DC_LOG_ERROR("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n", ++ i, TRANSFER_FUNC_POINTS); ++ return false; ++ } + rgb_resulted[j].red = output_tf->tf_pts.red[i]; + rgb_resulted[j].green = output_tf->tf_pts.green[i]; + rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch b/queue-5.15/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch new file mode 100644 index 00000000000..e57e43291de --- /dev/null +++ b/queue-5.15/drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch @@ -0,0 +1,37 @@ +From e00f260e1212667499684049ceb742b6e5708f02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 04:21:55 +0000 +Subject: drm/amd/display: Set color_mgmt_changed to true on unsuspend + +From: Joshua Ashton + +[ Upstream commit 2eb9dd497a698dc384c0dd3e0311d541eb2e13dd ] + +Otherwise we can end up with a frame on unsuspend where color management +is not applied when userspace has not committed themselves. + +Fixes re-applying color management on Steam Deck/Gamescope on S3 resume. + +Signed-off-by: Joshua Ashton +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b7b8a2d77da67..b821abb56ac3b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2772,6 +2772,7 @@ static int dm_resume(void *handle) + dc_stream_release(dm_new_crtc_state->stream); + dm_new_crtc_state->stream = NULL; + } ++ dm_new_crtc_state->base.color_mgmt_changed = true; + } + + for_each_new_plane_in_state(dm->cached_state, plane, new_plane_state, i) { +-- +2.43.0 + diff --git a/queue-5.15/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch b/queue-5.15/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch new file mode 100644 index 00000000000..50259013ed8 --- /dev/null +++ b/queue-5.15/drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch @@ -0,0 +1,61 @@ +From 624752dc07bb818b8666af2f09e879302d9e5bba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 14:14:13 +0100 +Subject: drm/amdkfd: Flush the process wq before creating a kfd_process + +From: Lancelot SIX + +[ Upstream commit f5b9053398e70a0c10aa9cb4dd5910ab6bc457c5 ] + +There is a race condition when re-creating a kfd_process for a process. +This has been observed when a process under the debugger executes +exec(3). In this scenario: +- The process executes exec. + - This will eventually release the process's mm, which will cause the + kfd_process object associated with the process to be freed + (kfd_process_free_notifier decrements the reference count to the + kfd_process to 0). This causes kfd_process_ref_release to enqueue + kfd_process_wq_release to the kfd_process_wq. +- The debugger receives the PTRACE_EVENT_EXEC notification, and tries to + re-enable AMDGPU traps (KFD_IOC_DBG_TRAP_ENABLE). + - When handling this request, KFD tries to re-create a kfd_process. + This eventually calls kfd_create_process and kobject_init_and_add. + +At this point the call to kobject_init_and_add can fail because the +old kfd_process.kobj has not been freed yet by kfd_process_wq_release. + +This patch proposes to avoid this race by making sure to drain +kfd_process_wq before creating a new kfd_process object. This way, we +know that any cleanup task is done executing when we reach +kobject_init_and_add. + +Signed-off-by: Lancelot SIX +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 21ec8a18cad29..7f69031f2b61a 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -818,6 +818,14 @@ struct kfd_process *kfd_create_process(struct file *filep) + if (process) { + pr_debug("Process already found\n"); + } else { ++ /* If the process just called exec(3), it is possible that the ++ * cleanup of the kfd_process (following the release of the mm ++ * of the old process image) is still in the cleanup work queue. ++ * Make sure to drain any job before trying to recreate any ++ * resource for this process. ++ */ ++ flush_workqueue(kfd_process_wq); ++ + process = create_process(thread); + if (IS_ERR(process)) + goto out; +-- +2.43.0 + diff --git a/queue-5.15/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch b/queue-5.15/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch new file mode 100644 index 00000000000..1b25f5a02b9 --- /dev/null +++ b/queue-5.15/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch @@ -0,0 +1,42 @@ +From 982eb8b078222b7e17f3746569e561c3f7f3af84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 14:30:53 +0800 +Subject: drm/arm/malidp: fix a possible null pointer dereference + +From: Huai-Yuan Liu + +[ Upstream commit a1f95aede6285dba6dd036d907196f35ae3a11ea ] + +In malidp_mw_connector_reset, new memory is allocated with kzalloc, but +no check is performed. In order to prevent null pointer dereferencing, +ensure that mw_state is checked before calling +__drm_atomic_helper_connector_reset. + +Fixes: 8cbc5caf36ef ("drm: mali-dp: Add writeback connector") +Signed-off-by: Huai-Yuan Liu +Signed-off-by: Liviu Dudau +Link: https://patchwork.freedesktop.org/patch/msgid/20240407063053.5481-1-qq810974084@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/arm/malidp_mw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c +index f5847a79dd7e8..0720b2197c4e7 100644 +--- a/drivers/gpu/drm/arm/malidp_mw.c ++++ b/drivers/gpu/drm/arm/malidp_mw.c +@@ -70,7 +70,10 @@ static void malidp_mw_connector_reset(struct drm_connector *connector) + __drm_atomic_helper_connector_destroy_state(connector->state); + + kfree(connector->state); +- __drm_atomic_helper_connector_reset(connector, &mw_state->base); ++ connector->state = NULL; ++ ++ if (mw_state) ++ __drm_atomic_helper_connector_reset(connector, &mw_state->base); + } + + static enum drm_connector_status +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch b/queue-5.15/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch new file mode 100644 index 00000000000..33023de4459 --- /dev/null +++ b/queue-5.15/drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch @@ -0,0 +1,43 @@ +From 02b0787c49784035af15ed25922098f8ffb3fe4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 15:58:10 +0300 +Subject: drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit 935a92a1c400285545198ca2800a4c6c519c650a ] + +In cdns_mhdp_atomic_enable(), the return value of drm_mode_duplicate() is +assigned to mhdp_state->current_mode, and there is a dereference of it in +drm_mode_set_name(), which will lead to a NULL pointer dereference on +failure of drm_mode_duplicate(). + +Fix this bug add a check of mhdp_state->current_mode. + +Fixes: fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge") +Signed-off-by: Aleksandr Mishin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240408125810.21899-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index 5530fbf64f1e4..c8386311cc704 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -2040,6 +2040,9 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); ++ if (!mhdp_state->current_mode) ++ return; ++ + drm_mode_set_name(mhdp_state->current_mode); + + dev_dbg(mhdp->dev, "%s: Enabling mode %s\n", __func__, mode->name); +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch b/queue-5.15/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch new file mode 100644 index 00000000000..2cbdb67f739 --- /dev/null +++ b/queue-5.15/drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch @@ -0,0 +1,49 @@ +From 64472970f70dab848c0dc30efc61c0fa3d45b1f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:31 -0400 +Subject: drm/bridge: lt8912b: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit b3b4695ff47c4964d4ccb930890c9ffd8e455e20 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-3-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c +index e16b0fc0cda0f..6379d5c8edff1 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -475,10 +475,8 @@ static int lt8912_attach_dsi(struct lt8912 *lt) + }; + + host = of_find_mipi_dsi_host_by_node(lt->host_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch b/queue-5.15/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch new file mode 100644 index 00000000000..e3fb90d43c8 --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch @@ -0,0 +1,50 @@ +From 3f895fbeebb24e773a4c833dbb5cba0b133e4c18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:32 -0400 +Subject: drm/bridge: lt9611: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit cd0a2c6a081ff67007323725b9ff07d9934b1ed8 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-4-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 660e05fa4a704..7f58ceda5b08a 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -766,10 +766,8 @@ static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611, + int ret; + + host = of_find_mipi_dsi_host_by_node(dsi_node); +- if (!host) { +- dev_err(lt9611->dev, "failed to find dsi host\n"); +- return ERR_PTR(-EPROBE_DEFER); +- } ++ if (!host) ++ return ERR_PTR(dev_err_probe(lt9611->dev, -EPROBE_DEFER, "failed to find dsi host\n")); + + dsi = mipi_dsi_device_register_full(host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch b/queue-5.15/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch new file mode 100644 index 00000000000..0038429c322 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch @@ -0,0 +1,49 @@ +From 27ad1b5124417ba9a6170e6c6617b583a5ed8de7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 17:49:34 -0400 +Subject: drm/bridge: tc358775: Don't log an error when DSI host can't be found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 272377aa0e3dddeec3f568c8bb9d12c7a79d8ef5 ] + +Given that failing to find a DSI host causes the driver to defer probe, +make use of dev_err_probe() to log the reason. This makes the defer +probe reason available and avoids alerting userspace about something +that is not necessarily an error. + +Fixes: b26975593b17 ("display/drm/bridge: TC358775 DSI/LVDS driver") +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Laurent Pinchart +Signed-off-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240415-anx7625-defer-log-no-dsi-host-v3-6-619a28148e5c@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358775.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358775.c b/drivers/gpu/drm/bridge/tc358775.c +index 2272adcc5b4ad..55697fa4d7c8b 100644 +--- a/drivers/gpu/drm/bridge/tc358775.c ++++ b/drivers/gpu/drm/bridge/tc358775.c +@@ -605,10 +605,8 @@ static int tc_bridge_attach(struct drm_bridge *bridge, + }; + + host = of_find_mipi_dsi_host_by_node(tc->host_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, "failed to find dsi host\n"); + + dsi = mipi_dsi_device_register_full(host, &info); + if (IS_ERR(dsi)) { +-- +2.43.0 + diff --git a/queue-5.15/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch b/queue-5.15/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch new file mode 100644 index 00000000000..23632b4c25e --- /dev/null +++ b/queue-5.15/drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch @@ -0,0 +1,44 @@ +From 13f35c03e974aa5f82cf285c37c9da1324879969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 13:00:51 -0500 +Subject: drm/mediatek: Add 0 size check to mtk_drm_gem_obj + +From: Justin Green + +[ Upstream commit 1e4350095e8ab2577ee05f8c3b044e661b5af9a0 ] + +Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object +of 0 bytes. Currently, no such check exists and the kernel will panic if +a userspace application attempts to allocate a 0x0 GBM buffer. + +Tested by attempting to allocate a 0x0 GBM buffer on an MT8188 and +verifying that we now return EINVAL. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Justin Green +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240307180051.4104425-1-greenjustin@chromium.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index b983adffa3929..88bdb8eeba81a 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -33,6 +33,9 @@ static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device *dev, + + size = round_up(size, PAGE_SIZE); + ++ if (size == 0) ++ return ERR_PTR(-EINVAL); ++ + mtk_gem_obj = kzalloc(sizeof(*mtk_gem_obj), GFP_KERNEL); + if (!mtk_gem_obj) + return ERR_PTR(-ENOMEM); +-- +2.43.0 + diff --git a/queue-5.15/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch b/queue-5.15/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch new file mode 100644 index 00000000000..72620b04bec --- /dev/null +++ b/queue-5.15/drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch @@ -0,0 +1,65 @@ +From b8b592c1a8dfe58f149e32690b800ce6c8692527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 23:07:04 +0000 +Subject: drm/meson: vclk: fix calculation of 59.94 fractional rates + +From: Christian Hewitt + +[ Upstream commit bfbc68e4d8695497f858a45a142665e22a512ea3 ] + +Playing 4K media with 59.94 fractional rate (typically VP9) causes the screen to lose +sync with the following error reported in the system log: + +[ 89.610280] Fatal Error, invalid HDMI vclk freq 593406 + +Modetest shows the following: + +3840x2160 59.94 3840 4016 4104 4400 2160 2168 2178 2250 593407 flags: xxxx, xxxx, +drm calculated value -------------------------------------^ + +Change the fractional rate calculation to stop DIV_ROUND_CLOSEST rounding down which +results in vclk freq failing to match correctly. + +Fixes: e5fab2ec9ca4 ("drm/meson: vclk: add support for YUV420 setup") +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240109230704.4120561-1-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240109230704.4120561-1-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_vclk.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c +index 2a82119eb58ed..2a942dc6a6dc2 100644 +--- a/drivers/gpu/drm/meson/meson_vclk.c ++++ b/drivers/gpu/drm/meson/meson_vclk.c +@@ -790,13 +790,13 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, + FREQ_1000_1001(params[i].pixel_freq)); + DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n", + i, params[i].phy_freq, +- FREQ_1000_1001(params[i].phy_freq/10)*10); ++ FREQ_1000_1001(params[i].phy_freq/1000)*1000); + /* Match strict frequency */ + if (phy_freq == params[i].phy_freq && + vclk_freq == params[i].vclk_freq) + return MODE_OK; + /* Match 1000/1001 variant */ +- if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) && ++ if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/1000)*1000) && + vclk_freq == FREQ_1000_1001(params[i].vclk_freq)) + return MODE_OK; + } +@@ -1070,7 +1070,7 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, + + for (freq = 0 ; params[freq].pixel_freq ; ++freq) { + if ((phy_freq == params[freq].phy_freq || +- phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) && ++ phy_freq == FREQ_1000_1001(params[freq].phy_freq/1000)*1000) && + (vclk_freq == params[freq].vclk_freq || + vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) { + if (vclk_freq != params[freq].vclk_freq) +-- +2.43.0 + diff --git a/queue-5.15/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch b/queue-5.15/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch new file mode 100644 index 00000000000..75d62e44621 --- /dev/null +++ b/queue-5.15/drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch @@ -0,0 +1,69 @@ +From 18ff69f7d7fdc26fc0eb5284465c8695bdae391b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 02:53:51 +0300 +Subject: drm/mipi-dsi: use correct return type for the DSC functions + +From: Dmitry Baryshkov + +[ Upstream commit de1c705c50326acaceaf1f02bc5bf6f267c572bd ] + +The functions mipi_dsi_compression_mode() and +mipi_dsi_picture_parameter_set() return 0-or-error rather than a buffer +size. Follow example of other similar MIPI DSI functions and use int +return type instead of size_t. + +Fixes: f4dea1aaa9a1 ("drm/dsi: add helpers for DSI compression mode and PPS packets") +Reviewed-by: Marijn Suijten +Reviewed-by: Jessica Zhang +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20240408-lg-sw43408-panel-v5-2-4e092da22991@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mipi_dsi.c | 6 +++--- + include/drm/drm_mipi_dsi.h | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 5d30ba3af4562..24606b632009e 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -653,7 +653,7 @@ EXPORT_SYMBOL(mipi_dsi_set_maximum_return_packet_size); + * + * Return: 0 on success or a negative error code on failure. + */ +-ssize_t mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable) ++int mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable) + { + /* Note: Needs updating for non-default PPS or algorithm */ + u8 tx[2] = { enable << 0, 0 }; +@@ -678,8 +678,8 @@ EXPORT_SYMBOL(mipi_dsi_compression_mode); + * + * Return: 0 on success or a negative error code on failure. + */ +-ssize_t mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, +- const struct drm_dsc_picture_parameter_set *pps) ++int mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, ++ const struct drm_dsc_picture_parameter_set *pps) + { + struct mipi_dsi_msg msg = { + .channel = dsi->channel, +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 5190fd48d318c..05cd782db905c 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -240,9 +240,9 @@ int mipi_dsi_shutdown_peripheral(struct mipi_dsi_device *dsi); + int mipi_dsi_turn_on_peripheral(struct mipi_dsi_device *dsi); + int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device *dsi, + u16 value); +-ssize_t mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable); +-ssize_t mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, +- const struct drm_dsc_picture_parameter_set *pps); ++int mipi_dsi_compression_mode(struct mipi_dsi_device *dsi, bool enable); ++int mipi_dsi_picture_parameter_set(struct mipi_dsi_device *dsi, ++ const struct drm_dsc_picture_parameter_set *pps); + + ssize_t mipi_dsi_generic_write(struct mipi_dsi_device *dsi, const void *payload, + size_t size); +-- +2.43.0 + diff --git a/queue-5.15/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch b/queue-5.15/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch new file mode 100644 index 00000000000..99f1d549e68 --- /dev/null +++ b/queue-5.15/drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch @@ -0,0 +1,50 @@ +From 98f2c3e969e1f515ffd5d7bbcb2b6c711a8b6b6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 11:27:36 +0100 +Subject: drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, + connector + +From: Marek Vasut + +[ Upstream commit 11ac72d033b9f577e8ba0c7a41d1c312bb232593 ] + +The .bpc = 6 implies .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , +add the missing bus_format. Add missing connector type and bus_flags +as well. + +Documentation [1] 1.4 GENERAL SPECIFICATI0NS indicates this panel is +capable of both RGB 18bit/24bit panel, the current configuration uses +18bit mode, .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , .bpc = 6. + +Support for the 24bit mode would require another entry in panel-simple +with .bus_format = MEDIA_BUS_FMT_RGB666_1X7X4_SPWG and .bpc = 8, which +is out of scope of this fix. + +[1] https://www.distec.de/fileadmin/pdf/produkte/TFT-Displays/Innolux/G121X1-L03_Datasheet.pdf + +Fixes: f8fa17ba812b ("drm/panel: simple: Add support for Innolux G121X1-L03") +Signed-off-by: Marek Vasut +Acked-by: Jessica Zhang +Link: https://patchwork.freedesktop.org/patch/msgid/20240328102746.17868-2-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 671bd1d1ad190..0dc4d891fedc2 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2613,6 +2613,9 @@ static const struct panel_desc innolux_g121x1_l03 = { + .unprepare = 200, + .disable = 400, + }, ++ .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + + static const struct drm_display_mode innolux_n116bca_ea1_mode = { +-- +2.43.0 + diff --git a/queue-5.15/drm-vc4-fix-possible-null-pointer-dereference.patch b/queue-5.15/drm-vc4-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..5169731fe2a --- /dev/null +++ b/queue-5.15/drm-vc4-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,39 @@ +From 479001a1d25b82af69f59d769ffad2f03564e5b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 10:56:22 +0300 +Subject: drm: vc4: Fix possible null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit c534b63bede6cb987c2946ed4d0b0013a52c5ba7 ] + +In vc4_hdmi_audio_init() of_get_address() may return +NULL which is later dereferenced. Fix this bug by adding NULL check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bb7d78568814 ("drm/vc4: Add HDMI audio support") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240409075622.11783-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 88aa00a1891b3..86d77794d8392 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -1506,6 +1506,8 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *vc4_hdmi) + index = 1; + + addr = of_get_address(dev->of_node, index, NULL, NULL); ++ if (!addr) ++ return -EINVAL; + + vc4_hdmi->audio.dma_data.addr = be32_to_cpup(addr) + mai_data->offset; + vc4_hdmi->audio.dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +-- +2.43.0 + diff --git a/queue-5.15/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch b/queue-5.15/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch new file mode 100644 index 00000000000..eee190ad557 --- /dev/null +++ b/queue-5.15/dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch @@ -0,0 +1,37 @@ +From 45c67a37516b30ae7625dd694b346996eca2029e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 15:49:58 -0500 +Subject: dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node + +From: Rob Herring + +[ Upstream commit d41201c90f825f19a46afbfb502f22f612d8ccc4 ] + +'pcie-phy' is missing any type. Add 'type: object' to indicate it's a +node. + +Signed-off-by: Rob Herring +Reviewed-by: Heiko Stuebner +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/20240401204959.1698106-1-robh@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/soc/rockchip/grf.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/soc/rockchip/grf.yaml b/Documentation/devicetree/bindings/soc/rockchip/grf.yaml +index dfebf425ca49c..8fe31a7083db8 100644 +--- a/Documentation/devicetree/bindings/soc/rockchip/grf.yaml ++++ b/Documentation/devicetree/bindings/soc/rockchip/grf.yaml +@@ -141,6 +141,7 @@ allOf: + unevaluatedProperties: false + + pcie-phy: ++ type: object + description: + Documentation/devicetree/bindings/phy/rockchip-pcie-phy.txt + +-- +2.43.0 + diff --git a/queue-5.15/ecryptfs-fix-buffer-size-for-tag-66-packet.patch b/queue-5.15/ecryptfs-fix-buffer-size-for-tag-66-packet.patch new file mode 100644 index 00000000000..a0e1318d216 --- /dev/null +++ b/queue-5.15/ecryptfs-fix-buffer-size-for-tag-66-packet.patch @@ -0,0 +1,116 @@ +From a35d5e83ad77509816d766c7e66358dd7de6db85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 07:46:00 -0700 +Subject: ecryptfs: Fix buffer size for tag 66 packet + +From: Brian Kubisiak + +[ Upstream commit 85a6a1aff08ec9f5b929d345d066e2830e8818e5 ] + +The 'TAG 66 Packet Format' description is missing the cipher code and +checksum fields that are packed into the message packet. As a result, +the buffer allocated for the packet is 3 bytes too small and +write_tag_66_packet() will write up to 3 bytes past the end of the +buffer. + +Fix this by increasing the size of the allocation so the whole packet +will always fit in the buffer. + +This fixes the below kasan slab-out-of-bounds bug: + + BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0 + Write of size 1 at addr ffff88800afbb2a5 by task touch/181 + + CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014 + Call Trace: + + dump_stack_lvl+0x4c/0x70 + print_report+0xc5/0x610 + ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 + ? kasan_complete_mode_report_info+0x44/0x210 + ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 + kasan_report+0xc2/0x110 + ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 + __asan_store1+0x62/0x80 + ecryptfs_generate_key_packet_set+0x7d6/0xde0 + ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10 + ? __alloc_pages+0x2e2/0x540 + ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d] + ? dentry_open+0x8f/0xd0 + ecryptfs_write_metadata+0x30a/0x550 + ? __pfx_ecryptfs_write_metadata+0x10/0x10 + ? ecryptfs_get_lower_file+0x6b/0x190 + ecryptfs_initialize_file+0x77/0x150 + ecryptfs_create+0x1c2/0x2f0 + path_openat+0x17cf/0x1ba0 + ? __pfx_path_openat+0x10/0x10 + do_filp_open+0x15e/0x290 + ? __pfx_do_filp_open+0x10/0x10 + ? __kasan_check_write+0x18/0x30 + ? _raw_spin_lock+0x86/0xf0 + ? __pfx__raw_spin_lock+0x10/0x10 + ? __kasan_check_write+0x18/0x30 + ? alloc_fd+0xf4/0x330 + do_sys_openat2+0x122/0x160 + ? __pfx_do_sys_openat2+0x10/0x10 + __x64_sys_openat+0xef/0x170 + ? __pfx___x64_sys_openat+0x10/0x10 + do_syscall_64+0x60/0xd0 + entry_SYSCALL_64_after_hwframe+0x6e/0xd8 + RIP: 0033:0x7f00a703fd67 + Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f + RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 + RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67 + RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c + RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000 + R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941 + R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040 + + + Allocated by task 181: + kasan_save_stack+0x2f/0x60 + kasan_set_track+0x29/0x40 + kasan_save_alloc_info+0x25/0x40 + __kasan_kmalloc+0xc5/0xd0 + __kmalloc+0x66/0x160 + ecryptfs_generate_key_packet_set+0x6d2/0xde0 + ecryptfs_write_metadata+0x30a/0x550 + ecryptfs_initialize_file+0x77/0x150 + ecryptfs_create+0x1c2/0x2f0 + path_openat+0x17cf/0x1ba0 + do_filp_open+0x15e/0x290 + do_sys_openat2+0x122/0x160 + __x64_sys_openat+0xef/0x170 + do_syscall_64+0x60/0xd0 + entry_SYSCALL_64_after_hwframe+0x6e/0xd8 + +Fixes: dddfa461fc89 ("[PATCH] eCryptfs: Public key; packet management") +Signed-off-by: Brian Kubisiak +Link: https://lore.kernel.org/r/5j2q56p6qkhezva6b2yuqfrsurmvrrqtxxzrnp3wqu7xrz22i7@hoecdztoplbl +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/ecryptfs/keystore.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c +index 3fe41964c0d8d..7f9f68c00ef63 100644 +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -300,9 +300,11 @@ write_tag_66_packet(char *signature, u8 cipher_code, + * | Key Identifier Size | 1 or 2 bytes | + * | Key Identifier | arbitrary | + * | File Encryption Key Size | 1 or 2 bytes | ++ * | Cipher Code | 1 byte | + * | File Encryption Key | arbitrary | ++ * | Checksum | 2 bytes | + */ +- data_len = (5 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size); ++ data_len = (8 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size); + *packet = kmalloc(data_len, GFP_KERNEL); + message = *packet; + if (!message) { +-- +2.43.0 + diff --git a/queue-5.15/epoll-be-better-about-file-lifetimes.patch b/queue-5.15/epoll-be-better-about-file-lifetimes.patch new file mode 100644 index 00000000000..26c4caf2490 --- /dev/null +++ b/queue-5.15/epoll-be-better-about-file-lifetimes.patch @@ -0,0 +1,94 @@ +From b4fb72638b36f93ca0b15663acec90ff8514f8ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 13:36:09 -0700 +Subject: epoll: be better about file lifetimes + +From: Linus Torvalds + +[ Upstream commit 4efaa5acf0a1d2b5947f98abb3acf8bfd966422b ] + +epoll can call out to vfs_poll() with a file pointer that may race with +the last 'fput()'. That would make f_count go down to zero, and while +the ep->mtx locking means that the resulting file pointer tear-down will +be blocked until the poll returns, it means that f_count is already +dead, and any use of it won't actually get a reference to the file any +more: it's dead regardless. + +Make sure we have a valid ref on the file pointer before we call down to +vfs_poll() from the epoll routines. + +Link: https://lore.kernel.org/lkml/0000000000002d631f0615918f1e@google.com/ +Reported-by: syzbot+045b454ab35fd82a35fb@syzkaller.appspotmail.com +Reviewed-by: Jens Axboe +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 1c254094c4c36..b60edddf17870 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -832,6 +832,34 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep + return res; + } + ++/* ++ * The ffd.file pointer may be in the process of being torn down due to ++ * being closed, but we may not have finished eventpoll_release() yet. ++ * ++ * Normally, even with the atomic_long_inc_not_zero, the file may have ++ * been free'd and then gotten re-allocated to something else (since ++ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). ++ * ++ * But for epoll, users hold the ep->mtx mutex, and as such any file in ++ * the process of being free'd will block in eventpoll_release_file() ++ * and thus the underlying file allocation will not be free'd, and the ++ * file re-use cannot happen. ++ * ++ * For the same reason we can avoid a rcu_read_lock() around the ++ * operation - 'ffd.file' cannot go away even if the refcount has ++ * reached zero (but we must still not call out to ->poll() functions ++ * etc). ++ */ ++static struct file *epi_fget(const struct epitem *epi) ++{ ++ struct file *file; ++ ++ file = epi->ffd.file; ++ if (!atomic_long_inc_not_zero(&file->f_count)) ++ file = NULL; ++ return file; ++} ++ + /* + * Differs from ep_eventpoll_poll() in that internal callers already have + * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested() +@@ -840,14 +868,22 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep + static __poll_t ep_item_poll(const struct epitem *epi, poll_table *pt, + int depth) + { +- struct file *file = epi->ffd.file; ++ struct file *file = epi_fget(epi); + __poll_t res; + ++ /* ++ * We could return EPOLLERR | EPOLLHUP or something, but let's ++ * treat this more as "file doesn't exist, poll didn't happen". ++ */ ++ if (!file) ++ return 0; ++ + pt->_key = epi->event.events; + if (!is_file_epoll(file)) + res = vfs_poll(file, pt); + else + res = __ep_eventpoll_poll(file, pt, depth); ++ fput(file); + return res & epi->event.events; + } + +-- +2.43.0 + diff --git a/queue-5.15/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch b/queue-5.15/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch new file mode 100644 index 00000000000..1c2b1af1bf5 --- /dev/null +++ b/queue-5.15/eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch @@ -0,0 +1,67 @@ +From f5ef8a688d5125f0b769848709f5d3d9a6a1a56d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 06:45:04 -0700 +Subject: eth: sungem: remove .ndo_poll_controller to avoid deadlocks + +From: Jakub Kicinski + +[ Upstream commit ac0a230f719b02432d8c7eba7615ebd691da86f4 ] + +Erhard reports netpoll warnings from sungem: + + netpoll_send_skb_on_dev(): eth0 enabled interrupts in poll (gem_start_xmit+0x0/0x398) + WARNING: CPU: 1 PID: 1 at net/core/netpoll.c:370 netpoll_send_skb+0x1fc/0x20c + +gem_poll_controller() disables interrupts, which may sleep. +We can't sleep in netpoll, it has interrupts disabled completely. +Strangely, gem_poll_controller() doesn't even poll the completions, +and instead acts as if an interrupt has fired so it just schedules +NAPI and exits. None of this has been necessary for years, since +netpoll invokes NAPI directly. + +Fixes: fe09bb619096 ("sungem: Spring cleaning and GRO support") +Reported-and-tested-by: Erhard Furtner +Link: https://lore.kernel.org/all/20240428125306.2c3080ef@legion +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240508134504.3560956-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/sungem.c | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c +index d72018a60c0f7..e14c1ac767baa 100644 +--- a/drivers/net/ethernet/sun/sungem.c ++++ b/drivers/net/ethernet/sun/sungem.c +@@ -949,17 +949,6 @@ static irqreturn_t gem_interrupt(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-#ifdef CONFIG_NET_POLL_CONTROLLER +-static void gem_poll_controller(struct net_device *dev) +-{ +- struct gem *gp = netdev_priv(dev); +- +- disable_irq(gp->pdev->irq); +- gem_interrupt(gp->pdev->irq, dev); +- enable_irq(gp->pdev->irq); +-} +-#endif +- + static void gem_tx_timeout(struct net_device *dev, unsigned int txqueue) + { + struct gem *gp = netdev_priv(dev); +@@ -2836,9 +2825,6 @@ static const struct net_device_ops gem_netdev_ops = { + .ndo_change_mtu = gem_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = gem_set_mac_address, +-#ifdef CONFIG_NET_POLL_CONTROLLER +- .ndo_poll_controller = gem_poll_controller, +-#endif + }; + + static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) +-- +2.43.0 + diff --git a/queue-5.15/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch b/queue-5.15/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch new file mode 100644 index 00000000000..825b0fbea7b --- /dev/null +++ b/queue-5.15/ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch @@ -0,0 +1,52 @@ +From 138f40d202061d137e62c0f0960b5c144e279449 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:53:20 +0100 +Subject: ext4: avoid excessive credit estimate in ext4_tmpfile() + +From: Jan Kara + +[ Upstream commit 35a1f12f0ca857fee1d7a04ef52cbd5f1f84de13 ] + +A user with minimum journal size (1024 blocks these days) complained +about the following error triggered by generic/697 test in +ext4_tmpfile(): + +run fstests generic/697 at 2024-02-28 05:34:46 +JBD2: vfstest wants too many credits credits:260 rsv_credits:0 max:256 +EXT4-fs error (device loop0) in __ext4_new_inode:1083: error 28 + +Indeed the credit estimate in ext4_tmpfile() is huge. +EXT4_MAXQUOTAS_INIT_BLOCKS() is 219, then 10 credits from ext4_tmpfile() +itself and then ext4_xattr_credits_for_new_inode() adds more credits +needed for security attributes and ACLs. Now the +EXT4_MAXQUOTAS_INIT_BLOCKS() is in fact unnecessary because we've +already initialized quotas with dquot_init() shortly before and so +EXT4_MAXQUOTAS_TRANS_BLOCKS() is enough (which boils down to 3 credits). + +Fixes: af51a2ac36d1 ("ext4: ->tmpfile() support") +Signed-off-by: Jan Kara +Tested-by: Luis Henriques +Tested-by: Disha Goel +Link: https://lore.kernel.org/r/20240307115320.28949-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 14c977e1e4bba..e9501fb28477b 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2901,7 +2901,7 @@ static int ext4_tmpfile(struct user_namespace *mnt_userns, struct inode *dir, + inode = ext4_new_inode_start_handle(mnt_userns, dir, mode, + NULL, 0, NULL, + EXT4_HT_DIR, +- EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) + ++ EXT4_MAXQUOTAS_TRANS_BLOCKS(dir->i_sb) + + 4 + EXT4_XATTR_TRANS_BLOCKS); + handle = ext4_journal_current_handle(); + err = PTR_ERR(inode); +-- +2.43.0 + diff --git a/queue-5.15/ext4-fix-potential-unnitialized-variable.patch b/queue-5.15/ext4-fix-potential-unnitialized-variable.patch new file mode 100644 index 00000000000..76a408d021b --- /dev/null +++ b/queue-5.15/ext4-fix-potential-unnitialized-variable.patch @@ -0,0 +1,40 @@ +From 66fb3c5e04f83020852d9f2059fc5848ee749c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 21:10:40 +0300 +Subject: ext4: fix potential unnitialized variable + +From: Dan Carpenter + +[ Upstream commit 3f4830abd236d0428e50451e1ecb62e14c365e9b ] + +Smatch complains "err" can be uninitialized in the caller. + + fs/ext4/indirect.c:349 ext4_alloc_branch() + error: uninitialized symbol 'err'. + +Set the error to zero on the success path. + +Fixes: 8016e29f4362 ("ext4: fast commit recovery path") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/363a4673-0fb8-4adf-b4fb-90a499077276@moroto.mountain +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index e85123e447f14..1145664a0bb71 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5684,6 +5684,7 @@ ext4_mb_new_blocks_simple(struct ext4_allocation_request *ar, int *errp) + ext4_mb_mark_bb(sb, block, 1, 1); + ar->len = 1; + ++ *errp = 0; + return block; + } + +-- +2.43.0 + diff --git a/queue-5.15/ext4-fix-unit-mismatch-in-ext4_mb_new_blocks_simple.patch b/queue-5.15/ext4-fix-unit-mismatch-in-ext4_mb_new_blocks_simple.patch new file mode 100644 index 00000000000..8e7aded2b58 --- /dev/null +++ b/queue-5.15/ext4-fix-unit-mismatch-in-ext4_mb_new_blocks_simple.patch @@ -0,0 +1,57 @@ +From db80683b5bbe085deb79ce44de9eefe3254ffe73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jun 2023 23:03:10 +0800 +Subject: ext4: fix unit mismatch in ext4_mb_new_blocks_simple + +From: Kemeng Shi + +[ Upstream commit 497885f72d930305d8e61b6b616b22b4da1adf90 ] + +The "i" returned from mb_find_next_zero_bit is in cluster unit and we +need offset "block" corresponding to "i" in block unit. Convert "i" to +block unit to fix the unit mismatch. + +Signed-off-by: Kemeng Shi +Reviewed-by: Ojaswin Mujoo +Link: https://lore.kernel.org/r/20230603150327.3596033-3-shikemeng@huaweicloud.com +Signed-off-by: Theodore Ts'o +Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable") +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index c2fcdee223317..383703e20ea36 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5886,6 +5886,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + { + struct buffer_head *bitmap_bh; + struct super_block *sb = ar->inode->i_sb; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_group_t group; + ext4_grpblk_t blkoff; + ext4_grpblk_t max = EXT4_CLUSTERS_PER_GROUP(sb); +@@ -5914,7 +5915,8 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + if (i >= max) + break; + if (ext4_fc_replay_check_excluded(sb, +- ext4_group_first_block_no(sb, group) + i)) { ++ ext4_group_first_block_no(sb, group) + ++ EXT4_C2B(sbi, i))) { + blkoff = i + 1; + } else + break; +@@ -5931,7 +5933,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + return 0; + } + +- block = ext4_group_first_block_no(sb, group) + i; ++ block = ext4_group_first_block_no(sb, group) + EXT4_C2B(sbi, i); + ext4_mb_mark_bb(sb, block, 1, 1); + ar->len = 1; + +-- +2.43.0 + diff --git a/queue-5.15/ext4-remove-unused-parameter-from-ext4_mb_new_blocks.patch b/queue-5.15/ext4-remove-unused-parameter-from-ext4_mb_new_blocks.patch new file mode 100644 index 00000000000..bbd2a237286 --- /dev/null +++ b/queue-5.15/ext4-remove-unused-parameter-from-ext4_mb_new_blocks.patch @@ -0,0 +1,189 @@ +From f84e14d6f3171af19426e6e9ae60e57c920de3e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jun 2023 23:03:17 +0800 +Subject: ext4: remove unused parameter from ext4_mb_new_blocks_simple() + +From: Kemeng Shi + +[ Upstream commit ad78b5efe4246e5deba8d44a6ed172b8a00d3113 ] + +Two cleanups for ext4_mb_new_blocks_simple: +Remove unused parameter handle of ext4_mb_new_blocks_simple. +Move ext4_mb_new_blocks_simple definition before ext4_mb_new_blocks to +remove unnecessary forward declaration of ext4_mb_new_blocks_simple. + +Signed-off-by: Kemeng Shi +Reviewed-by: Ojaswin Mujoo +Link: https://lore.kernel.org/r/20230603150327.3596033-10-shikemeng@huaweicloud.com +Signed-off-by: Theodore Ts'o +Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable") +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 137 +++++++++++++++++++++++----------------------- + 1 file changed, 67 insertions(+), 70 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index a346ab8f3e5f4..e85123e447f14 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5620,8 +5620,72 @@ static bool ext4_mb_discard_preallocations_should_retry(struct super_block *sb, + return ret; + } + +-static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, +- struct ext4_allocation_request *ar, int *errp); ++/* ++ * Simple allocator for Ext4 fast commit replay path. It searches for blocks ++ * linearly starting at the goal block and also excludes the blocks which ++ * are going to be in use after fast commit replay. ++ */ ++static ext4_fsblk_t ++ext4_mb_new_blocks_simple(struct ext4_allocation_request *ar, int *errp) ++{ ++ struct buffer_head *bitmap_bh; ++ struct super_block *sb = ar->inode->i_sb; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); ++ ext4_group_t group, nr; ++ ext4_grpblk_t blkoff; ++ ext4_grpblk_t max = EXT4_CLUSTERS_PER_GROUP(sb); ++ ext4_grpblk_t i = 0; ++ ext4_fsblk_t goal, block; ++ struct ext4_super_block *es = EXT4_SB(sb)->s_es; ++ ++ goal = ar->goal; ++ if (goal < le32_to_cpu(es->s_first_data_block) || ++ goal >= ext4_blocks_count(es)) ++ goal = le32_to_cpu(es->s_first_data_block); ++ ++ ar->len = 0; ++ ext4_get_group_no_and_offset(sb, goal, &group, &blkoff); ++ for (nr = ext4_get_groups_count(sb); nr > 0; nr--) { ++ bitmap_bh = ext4_read_block_bitmap(sb, group); ++ if (IS_ERR(bitmap_bh)) { ++ *errp = PTR_ERR(bitmap_bh); ++ pr_warn("Failed to read block bitmap\n"); ++ return 0; ++ } ++ ++ while (1) { ++ i = mb_find_next_zero_bit(bitmap_bh->b_data, max, ++ blkoff); ++ if (i >= max) ++ break; ++ if (ext4_fc_replay_check_excluded(sb, ++ ext4_group_first_block_no(sb, group) + ++ EXT4_C2B(sbi, i))) { ++ blkoff = i + 1; ++ } else ++ break; ++ } ++ brelse(bitmap_bh); ++ if (i < max) ++ break; ++ ++ if (++group >= ext4_get_groups_count(sb)) ++ group = 0; ++ ++ blkoff = 0; ++ } ++ ++ if (i >= max) { ++ *errp = -ENOSPC; ++ return 0; ++ } ++ ++ block = ext4_group_first_block_no(sb, group) + EXT4_C2B(sbi, i); ++ ext4_mb_mark_bb(sb, block, 1, 1); ++ ar->len = 1; ++ ++ return block; ++} + + /* + * Main entry point into mballoc to allocate blocks +@@ -5646,7 +5710,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle, + + trace_ext4_request_blocks(ar); + if (sbi->s_mount_state & EXT4_FC_REPLAY) +- return ext4_mb_new_blocks_simple(handle, ar, errp); ++ return ext4_mb_new_blocks_simple(ar, errp); + + /* Allow to use superuser reservation for quota file */ + if (ext4_is_quota_file(ar->inode)) +@@ -5876,73 +5940,6 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b, + return 0; + } + +-/* +- * Simple allocator for Ext4 fast commit replay path. It searches for blocks +- * linearly starting at the goal block and also excludes the blocks which +- * are going to be in use after fast commit replay. +- */ +-static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, +- struct ext4_allocation_request *ar, int *errp) +-{ +- struct buffer_head *bitmap_bh; +- struct super_block *sb = ar->inode->i_sb; +- struct ext4_sb_info *sbi = EXT4_SB(sb); +- ext4_group_t group, nr; +- ext4_grpblk_t blkoff; +- ext4_grpblk_t max = EXT4_CLUSTERS_PER_GROUP(sb); +- ext4_grpblk_t i = 0; +- ext4_fsblk_t goal, block; +- struct ext4_super_block *es = EXT4_SB(sb)->s_es; +- +- goal = ar->goal; +- if (goal < le32_to_cpu(es->s_first_data_block) || +- goal >= ext4_blocks_count(es)) +- goal = le32_to_cpu(es->s_first_data_block); +- +- ar->len = 0; +- ext4_get_group_no_and_offset(sb, goal, &group, &blkoff); +- for (nr = ext4_get_groups_count(sb); nr > 0; nr--) { +- bitmap_bh = ext4_read_block_bitmap(sb, group); +- if (IS_ERR(bitmap_bh)) { +- *errp = PTR_ERR(bitmap_bh); +- pr_warn("Failed to read block bitmap\n"); +- return 0; +- } +- +- while (1) { +- i = mb_find_next_zero_bit(bitmap_bh->b_data, max, +- blkoff); +- if (i >= max) +- break; +- if (ext4_fc_replay_check_excluded(sb, +- ext4_group_first_block_no(sb, group) + +- EXT4_C2B(sbi, i))) { +- blkoff = i + 1; +- } else +- break; +- } +- brelse(bitmap_bh); +- if (i < max) +- break; +- +- if (++group >= ext4_get_groups_count(sb)) +- group = 0; +- +- blkoff = 0; +- } +- +- if (i >= max) { +- *errp = -ENOSPC; +- return 0; +- } +- +- block = ext4_group_first_block_no(sb, group) + EXT4_C2B(sbi, i); +- ext4_mb_mark_bb(sb, block, 1, 1); +- ar->len = 1; +- +- return block; +-} +- + static void ext4_free_blocks_simple(struct inode *inode, ext4_fsblk_t block, + unsigned long count) + { +-- +2.43.0 + diff --git a/queue-5.15/ext4-simplify-calculation-of-blkoff-in-ext4_mb_new_b.patch b/queue-5.15/ext4-simplify-calculation-of-blkoff-in-ext4_mb_new_b.patch new file mode 100644 index 00000000000..acea654df2a --- /dev/null +++ b/queue-5.15/ext4-simplify-calculation-of-blkoff-in-ext4_mb_new_b.patch @@ -0,0 +1,48 @@ +From fd649a9960459ece5e516030dce6809b20ffdb25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Mar 2023 01:21:20 +0800 +Subject: ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple + +From: Kemeng Shi + +[ Upstream commit 253cacb0de89235673ad5889d61f275a73dbee79 ] + +We try to allocate a block from goal in ext4_mb_new_blocks_simple. We +only need get blkoff in first group with goal and set blkoff to 0 for +the rest groups. + +Signed-off-by: Kemeng Shi +Link: https://lore.kernel.org/r/20230303172120.3800725-21-shikemeng@huaweicloud.com +Signed-off-by: Theodore Ts'o +Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable") +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 8dba416aa6c1e..c2fcdee223317 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5908,9 +5908,6 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + return 0; + } + +- ext4_get_group_no_and_offset(sb, +- max(ext4_group_first_block_no(sb, group), goal), +- NULL, &blkoff); + while (1) { + i = mb_find_next_zero_bit(bitmap_bh->b_data, max, + blkoff); +@@ -5925,6 +5922,8 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + brelse(bitmap_bh); + if (i < max) + break; ++ ++ blkoff = 0; + } + + if (group >= ext4_get_groups_count(sb) || i >= max) { +-- +2.43.0 + diff --git a/queue-5.15/ext4-try-all-groups-in-ext4_mb_new_blocks_simple.patch b/queue-5.15/ext4-try-all-groups-in-ext4_mb_new_blocks_simple.patch new file mode 100644 index 00000000000..47a2d36a02b --- /dev/null +++ b/queue-5.15/ext4-try-all-groups-in-ext4_mb_new_blocks_simple.patch @@ -0,0 +1,67 @@ +From 23f8e4f65f6fae4d474460d8906e9b9b8a8dfe28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jun 2023 23:03:15 +0800 +Subject: ext4: try all groups in ext4_mb_new_blocks_simple + +From: Kemeng Shi + +[ Upstream commit 19a043bb1fd1b5cb2652ca33536c55e6c0a70df0 ] + +ext4_mb_new_blocks_simple ignores the group before goal, so it will fail +if free blocks reside in group before goal. Try all groups to avoid +unexpected failure. +Search finishes either if any free block is found or if no available +blocks are found. Simpliy check "i >= max" to distinguish the above +cases. + +Signed-off-by: Kemeng Shi +Suggested-by: Theodore Ts'o +Reviewed-by: Ojaswin Mujoo +Link: https://lore.kernel.org/r/20230603150327.3596033-8-shikemeng@huaweicloud.com +Signed-off-by: Theodore Ts'o +Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable") +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 383703e20ea36..a346ab8f3e5f4 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5887,7 +5887,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + struct buffer_head *bitmap_bh; + struct super_block *sb = ar->inode->i_sb; + struct ext4_sb_info *sbi = EXT4_SB(sb); +- ext4_group_t group; ++ ext4_group_t group, nr; + ext4_grpblk_t blkoff; + ext4_grpblk_t max = EXT4_CLUSTERS_PER_GROUP(sb); + ext4_grpblk_t i = 0; +@@ -5901,7 +5901,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + + ar->len = 0; + ext4_get_group_no_and_offset(sb, goal, &group, &blkoff); +- for (; group < ext4_get_groups_count(sb); group++) { ++ for (nr = ext4_get_groups_count(sb); nr > 0; nr--) { + bitmap_bh = ext4_read_block_bitmap(sb, group); + if (IS_ERR(bitmap_bh)) { + *errp = PTR_ERR(bitmap_bh); +@@ -5925,10 +5925,13 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, + if (i < max) + break; + ++ if (++group >= ext4_get_groups_count(sb)) ++ group = 0; ++ + blkoff = 0; + } + +- if (group >= ext4_get_groups_count(sb) || i >= max) { ++ if (i >= max) { + *errp = -ENOSPC; + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/fbdev-sh7760fb-allow-modular-build.patch b/queue-5.15/fbdev-sh7760fb-allow-modular-build.patch new file mode 100644 index 00000000000..c2fc83dc8c7 --- /dev/null +++ b/queue-5.15/fbdev-sh7760fb-allow-modular-build.patch @@ -0,0 +1,50 @@ +From 1e209e92f9b87ff21cf69f00f5c4643df5bc3ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 21:39:38 -0800 +Subject: fbdev: sh7760fb: allow modular build + +From: Randy Dunlap + +[ Upstream commit 51084f89d687e14d96278241e5200cde4b0985c7 ] + +There is no reason to prohibit sh7760fb from being built as a +loadable module as suggested by Geert, so change the config symbol +from bool to tristate to allow that and change the FB dependency as +needed. + +Fixes: f75f71b2c418 ("fbdev/sh7760fb: Depend on FB=y") +Suggested-by: Geert Uytterhoeven +Signed-off-by: Randy Dunlap +Cc: Thomas Zimmermann +Cc: Javier Martinez Canillas +Cc: John Paul Adrian Glaubitz +Cc: Sam Ravnborg +Cc: Helge Deller +Cc: linux-fbdev@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Acked-by: John Paul Adrian Glaubitz +Acked-by: Javier Martinez Canillas +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +index 662524574cc33..26dfc4e5b10ce 100644 +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -2016,8 +2016,8 @@ config FB_COBALT + depends on FB && MIPS_COBALT + + config FB_SH7760 +- bool "SH7760/SH7763/SH7720/SH7721 LCDC support" +- depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ ++ tristate "SH7760/SH7763/SH7720/SH7721 LCDC support" ++ depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ + || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721) + select FB_CFB_FILLRECT + select FB_CFB_COPYAREA +-- +2.43.0 + diff --git a/queue-5.15/fbdev-shmobile-fix-snprintf-truncation.patch b/queue-5.15/fbdev-shmobile-fix-snprintf-truncation.patch new file mode 100644 index 00000000000..9e0dbaf3146 --- /dev/null +++ b/queue-5.15/fbdev-shmobile-fix-snprintf-truncation.patch @@ -0,0 +1,40 @@ +From 691da1d8afb97580f8c1d833be3ff6af7fe3a8a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:00 +0100 +Subject: fbdev: shmobile: fix snprintf truncation + +From: Arnd Bergmann + +[ Upstream commit 26c8cfb9d1e4b252336d23dd5127a8cbed414a32 ] + +The name of the overlay does not fit into the fixed-length field: + +drivers/video/fbdev/sh_mobile_lcdcfb.c:1577:2: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 25 + +Make it short enough by changing the string. + +Fixes: c5deac3c9b22 ("fbdev: sh_mobile_lcdc: Implement overlays support") +Signed-off-by: Arnd Bergmann +Reviewed-by: Laurent Pinchart +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c +index e33c016c5428c..74a013c398b14 100644 +--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c ++++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c +@@ -1577,7 +1577,7 @@ sh_mobile_lcdc_overlay_fb_init(struct sh_mobile_lcdc_overlay *ovl) + */ + info->fix = sh_mobile_lcdc_overlay_fix; + snprintf(info->fix.id, sizeof(info->fix.id), +- "SH Mobile LCDC Overlay %u", ovl->index); ++ "SHMobile ovl %u", ovl->index); + info->fix.smem_start = ovl->dma_handle; + info->fix.smem_len = ovl->fb_size; + info->fix.line_length = ovl->pitch; +-- +2.43.0 + diff --git a/queue-5.15/fbdev-sisfb-hide-unused-variables.patch b/queue-5.15/fbdev-sisfb-hide-unused-variables.patch new file mode 100644 index 00000000000..b65510e648a --- /dev/null +++ b/queue-5.15/fbdev-sisfb-hide-unused-variables.patch @@ -0,0 +1,68 @@ +From c8bbdac0fb91aa19f76d9c2dbe195af6add998e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:31 +0200 +Subject: fbdev: sisfb: hide unused variables + +From: Arnd Bergmann + +[ Upstream commit 688cf598665851b9e8cb5083ff1d208ce43d10ff ] + +Building with W=1 shows that a couple of variables in this driver are only +used in certain configurations: + +drivers/video/fbdev/sis/init301.c:239:28: error: 'SiS_Part2CLVX_6' defined but not used [-Werror=unused-const-variable=] + 239 | static const unsigned char SiS_Part2CLVX_6[] = { /* 1080i */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:230:28: error: 'SiS_Part2CLVX_5' defined but not used [-Werror=unused-const-variable=] + 230 | static const unsigned char SiS_Part2CLVX_5[] = { /* 750p */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:211:28: error: 'SiS_Part2CLVX_4' defined but not used [-Werror=unused-const-variable=] + 211 | static const unsigned char SiS_Part2CLVX_4[] = { /* PAL */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:192:28: error: 'SiS_Part2CLVX_3' defined but not used [-Werror=unused-const-variable=] + 192 | static const unsigned char SiS_Part2CLVX_3[] = { /* NTSC, 525i, 525p */ + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:184:28: error: 'SiS_Part2CLVX_2' defined but not used [-Werror=unused-const-variable=] + 184 | static const unsigned char SiS_Part2CLVX_2[] = { + | ^~~~~~~~~~~~~~~ +drivers/video/fbdev/sis/init301.c:176:28: error: 'SiS_Part2CLVX_1' defined but not used [-Werror=unused-const-variable=] + 176 | static const unsigned char SiS_Part2CLVX_1[] = { + | ^~~~~~~~~~~~~~~ + +This started showing up after the definitions were moved into the +source file from the header, which was not flagged by the compiler. +Move the definition into the appropriate #ifdef block that already +exists next to them. + +Fixes: 5908986ef348 ("video: fbdev: sis: avoid mismatched prototypes") +Signed-off-by: Arnd Bergmann +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sis/init301.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/sis/init301.c b/drivers/video/fbdev/sis/init301.c +index a8fb41f1a2580..09329072004f4 100644 +--- a/drivers/video/fbdev/sis/init301.c ++++ b/drivers/video/fbdev/sis/init301.c +@@ -172,7 +172,7 @@ static const unsigned char SiS_HiTVGroup3_2[] = { + }; + + /* 301C / 302ELV extended Part2 TV registers (4 tap scaler) */ +- ++#ifdef CONFIG_FB_SIS_315 + static const unsigned char SiS_Part2CLVX_1[] = { + 0x00,0x00, + 0x00,0x20,0x00,0x00,0x7F,0x20,0x02,0x7F,0x7D,0x20,0x04,0x7F,0x7D,0x1F,0x06,0x7E, +@@ -245,7 +245,6 @@ static const unsigned char SiS_Part2CLVX_6[] = { /* 1080i */ + 0xFF,0xFF, + }; + +-#ifdef CONFIG_FB_SIS_315 + /* 661 et al LCD data structure (2.03.00) */ + static const unsigned char SiS_LCDStruct661[] = { + /* 1024x768 */ +-- +2.43.0 + diff --git a/queue-5.15/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch b/queue-5.15/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch new file mode 100644 index 00000000000..796a4ff3813 --- /dev/null +++ b/queue-5.15/firmware-raspberrypi-use-correct-device-for-dma-mapp.patch @@ -0,0 +1,65 @@ +From 1ff2ba1cd3a0626c194787ab593e67b93f5c6775 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 21:58:06 +0200 +Subject: firmware: raspberrypi: Use correct device for DMA mappings + +From: Laurent Pinchart + +[ Upstream commit df518a0ae1b982a4dcf2235464016c0c4576a34d ] + +The buffer used to transfer data over the mailbox interface is mapped +using the client's device. This is incorrect, as the device performing +the DMA transfer is the mailbox itself. Fix it by using the mailbox +controller device instead. + +This requires including the mailbox_controller.h header to dereference +the mbox_chan and mbox_controller structures. The header is not meant to +be included by clients. This could be fixed by extending the client API +with a function to access the controller's device. + +Fixes: 4e3d60656a72 ("ARM: bcm2835: Add the Raspberry Pi firmware driver") +Signed-off-by: Laurent Pinchart +Reviewed-by: Stefan Wahren +Tested-by: Ivan T. Ivanov +Link: https://lore.kernel.org/r/20240326195807.15163-3-laurent.pinchart@ideasonboard.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + drivers/firmware/raspberrypi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c +index dba315f675bc7..ec223976c972d 100644 +--- a/drivers/firmware/raspberrypi.c ++++ b/drivers/firmware/raspberrypi.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -96,8 +97,8 @@ int rpi_firmware_property_list(struct rpi_firmware *fw, + if (size & 3) + return -EINVAL; + +- buf = dma_alloc_coherent(fw->cl.dev, PAGE_ALIGN(size), &bus_addr, +- GFP_ATOMIC); ++ buf = dma_alloc_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size), ++ &bus_addr, GFP_ATOMIC); + if (!buf) + return -ENOMEM; + +@@ -125,7 +126,7 @@ int rpi_firmware_property_list(struct rpi_firmware *fw, + ret = -EINVAL; + } + +- dma_free_coherent(fw->cl.dev, PAGE_ALIGN(size), buf, bus_addr); ++ dma_free_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size), buf, bus_addr); + + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/gfs2-don-t-forget-to-complete-delayed-withdraw.patch b/queue-5.15/gfs2-don-t-forget-to-complete-delayed-withdraw.patch new file mode 100644 index 00000000000..4f539fbb63c --- /dev/null +++ b/queue-5.15/gfs2-don-t-forget-to-complete-delayed-withdraw.patch @@ -0,0 +1,39 @@ +From 89dc3e22dc72d487737182bcbd54110f9cb07f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 11:49:44 +0100 +Subject: gfs2: Don't forget to complete delayed withdraw + +From: Andreas Gruenbacher + +[ Upstream commit b01189333ee91c1ae6cd96dfd1e3a3c2e69202f0 ] + +Commit fffe9bee14b0 ("gfs2: Delay withdraw from atomic context") +switched from gfs2_withdraw() to gfs2_withdraw_delayed() in +gfs2_ail_error(), but failed to then check if a delayed withdraw had +occurred. Fix that by adding the missing check in __gfs2_ail_flush(), +where the spin locks are already dropped and a withdraw is possible. + +Fixes: fffe9bee14b0 ("gfs2: Delay withdraw from atomic context") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/glops.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c +index 558932ad89d5d..5a4b3550d833f 100644 +--- a/fs/gfs2/glops.c ++++ b/fs/gfs2/glops.c +@@ -82,6 +82,9 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync, + GLOCK_BUG_ON(gl, !fsync && atomic_read(&gl->gl_ail_count)); + spin_unlock(&sdp->sd_ail_lock); + gfs2_log_unlock(sdp); ++ ++ if (gfs2_withdrawing(sdp)) ++ gfs2_withdraw(sdp); + } + + +-- +2.43.0 + diff --git a/queue-5.15/gfs2-fix-ignore-unlock-failures-after-withdraw.patch b/queue-5.15/gfs2-fix-ignore-unlock-failures-after-withdraw.patch new file mode 100644 index 00000000000..166de34e4e6 --- /dev/null +++ b/queue-5.15/gfs2-fix-ignore-unlock-failures-after-withdraw.patch @@ -0,0 +1,63 @@ +From 2b345dced3e3bb5a186b29a11ab5674d27d6694e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 13:47:51 +0200 +Subject: gfs2: Fix "ignore unlock failures after withdraw" + +From: Andreas Gruenbacher + +[ Upstream commit 5d9231111966b6c5a65016d58dcbeab91055bc91 ] + +Commit 3e11e53041502 tries to suppress dlm_lock() lock conversion errors +that occur when the lockspace has already been released. + +It does that by setting and checking the SDF_SKIP_DLM_UNLOCK flag. This +conflicts with the intended meaning of the SDF_SKIP_DLM_UNLOCK flag, so +check whether the lockspace is still allocated instead. + +(Given the current DLM API, checking for this kind of error after the +fact seems easier that than to make sure that the lockspace is still +allocated before calling dlm_lock(). Changing the DLM API so that users +maintain the lockspace references themselves would be an option.) + +Fixes: 3e11e53041502 ("GFS2: ignore unlock failures after withdraw") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/glock.c | 4 +++- + fs/gfs2/util.c | 1 - + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index e85ef6b14777d..7fed3beb5e80c 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -807,11 +807,13 @@ __acquires(&gl->gl_lockref.lock) + } + + if (sdp->sd_lockstruct.ls_ops->lm_lock) { ++ struct lm_lockstruct *ls = &sdp->sd_lockstruct; ++ + /* lock_dlm */ + ret = sdp->sd_lockstruct.ls_ops->lm_lock(gl, target, lck_flags); + if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED && + target == LM_ST_UNLOCKED && +- test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags)) { ++ test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { + finish_xmote(gl, target); + gfs2_glock_queue_work(gl, 0); + } else if (ret) { +diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c +index cf345a86ef67b..9cdece4928454 100644 +--- a/fs/gfs2/util.c ++++ b/fs/gfs2/util.c +@@ -351,7 +351,6 @@ int gfs2_withdraw(struct gfs2_sbd *sdp) + fs_err(sdp, "telling LM to unmount\n"); + lm->lm_unmount(sdp); + } +- set_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags); + fs_err(sdp, "File system withdrawn\n"); + dump_stack(); + clear_bit(SDF_WITHDRAW_IN_PROG, &sdp->sd_flags); +-- +2.43.0 + diff --git a/queue-5.15/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch b/queue-5.15/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch new file mode 100644 index 00000000000..0f69ed39cdf --- /dev/null +++ b/queue-5.15/hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch @@ -0,0 +1,41 @@ +From 8121f06cdb9abd3e93a6cfd264dda895625d9ac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 16:54:22 +0800 +Subject: HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors + +From: Chen Ni + +[ Upstream commit 6baa4524027fd64d7ca524e1717c88c91a354b93 ] + +Add a check for the return value of pci_alloc_irq_vectors() and return +error if it fails. + +[jkosina@suse.com: reworded changelog based on Srinivas' suggestion] +Fixes: 74fbc7d371d9 ("HID: intel-ish-hid: add MSI interrupt support") +Signed-off-by: Chen Ni +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +index 5916ef2933e27..bbc3ea34585d2 100644 +--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c ++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +@@ -212,6 +212,11 @@ static int ish_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + /* request and enable interrupt */ + ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES); ++ if (ret < 0) { ++ dev_err(dev, "ISH: Failed to allocate IRQ vectors\n"); ++ return ret; ++ } ++ + if (!pdev->msi_enabled && !pdev->msix_enabled) + irq_flag = IRQF_SHARED; + +-- +2.43.0 + diff --git a/queue-5.15/ipv6-sr-add-missing-seg6_local_exit.patch b/queue-5.15/ipv6-sr-add-missing-seg6_local_exit.patch new file mode 100644 index 00000000000..f2642228ddb --- /dev/null +++ b/queue-5.15/ipv6-sr-add-missing-seg6_local_exit.patch @@ -0,0 +1,38 @@ +From e805db4d901be3d611e14cf378c3467fdf02c0d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:18:10 +0800 +Subject: ipv6: sr: add missing seg6_local_exit + +From: Hangbin Liu + +[ Upstream commit 3321687e321307629c71b664225b861ebf3e5753 ] + +Currently, we only call seg6_local_exit() in seg6_init() if +seg6_local_init() failed. But forgot to call it in seg6_exit(). + +Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel") +Signed-off-by: Hangbin Liu +Reviewed-by: Sabrina Dubroca +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240509131812.1662197-2-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index dc434e4ee6d66..d626e0767a069 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -559,6 +559,7 @@ void seg6_exit(void) + seg6_hmac_exit(); + #endif + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL ++ seg6_local_exit(); + seg6_iptunnel_exit(); + #endif + unregister_pernet_subsys(&ip6_segments_ops); +-- +2.43.0 + diff --git a/queue-5.15/ipv6-sr-fix-incorrect-unregister-order.patch b/queue-5.15/ipv6-sr-fix-incorrect-unregister-order.patch new file mode 100644 index 00000000000..cdb81030197 --- /dev/null +++ b/queue-5.15/ipv6-sr-fix-incorrect-unregister-order.patch @@ -0,0 +1,39 @@ +From 1cc98156a0a95cfc66b888eb17628ae07b9c37fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:18:11 +0800 +Subject: ipv6: sr: fix incorrect unregister order + +From: Hangbin Liu + +[ Upstream commit 6e370a771d2985107e82d0f6174381c1acb49c20 ] + +Commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and +null-ptr-deref") changed the register order in seg6_init(). But the +unregister order in seg6_exit() is not updated. + +Fixes: 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") +Signed-off-by: Hangbin Liu +Reviewed-by: Sabrina Dubroca +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240509131812.1662197-3-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index d626e0767a069..846c3abbcfb41 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -562,6 +562,6 @@ void seg6_exit(void) + seg6_local_exit(); + seg6_iptunnel_exit(); + #endif +- unregister_pernet_subsys(&ip6_segments_ops); + genl_unregister_family(&seg6_genl_family); ++ unregister_pernet_subsys(&ip6_segments_ops); + } +-- +2.43.0 + diff --git a/queue-5.15/ipv6-sr-fix-invalid-unregister-error-path.patch b/queue-5.15/ipv6-sr-fix-invalid-unregister-error-path.patch new file mode 100644 index 00000000000..9fee14445dc --- /dev/null +++ b/queue-5.15/ipv6-sr-fix-invalid-unregister-error-path.patch @@ -0,0 +1,46 @@ +From 55c45e7596e4db4d2f2f492525e92be553c5edd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:18:12 +0800 +Subject: ipv6: sr: fix invalid unregister error path + +From: Hangbin Liu + +[ Upstream commit 160e9d2752181fcf18c662e74022d77d3164cd45 ] + +The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL +is not defined. In that case if seg6_hmac_init() fails, the +genl_unregister_family() isn't called. + +This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control +lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible +use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() +with genl_unregister_family() in this error path. + +Fixes: 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support") +Reported-by: Guillaume Nault +Signed-off-by: Hangbin Liu +Reviewed-by: Sabrina Dubroca +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240509131812.1662197-4-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index 846c3abbcfb41..03090d1419d09 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -546,6 +546,8 @@ int __init seg6_init(void) + #endif + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL + out_unregister_genl: ++#endif ++#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC) + genl_unregister_family(&seg6_genl_family); + #endif + out_unregister_pernet: +-- +2.43.0 + diff --git a/queue-5.15/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch b/queue-5.15/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch new file mode 100644 index 00000000000..fa587b83f81 --- /dev/null +++ b/queue-5.15/irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch @@ -0,0 +1,40 @@ +From 5aa37bf700ee3fd3fa83f01638a35f88c9d2a391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 22:23:05 +0800 +Subject: irqchip/alpine-msi: Fix off-by-one in allocation error path + +From: Zenghui Yu + +[ Upstream commit ff3669a71afa06208de58d6bea1cc49d5e3fcbd1 ] + +When alpine_msix_gic_domain_alloc() fails, there is an off-by-one in the +number of interrupts to be freed. + +Fix it by passing the number of successfully allocated interrupts, instead +of the relative index of the last allocated one. + +Fixes: 3841245e8498 ("irqchip/alpine-msi: Fix freeing of interrupts on allocation error path") +Signed-off-by: Zenghui Yu +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240327142305.1048-1-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-alpine-msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c +index fc1ef7de37973..c9ffd69dfc756 100644 +--- a/drivers/irqchip/irq-alpine-msi.c ++++ b/drivers/irqchip/irq-alpine-msi.c +@@ -165,7 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain, + return 0; + + err_sgi: +- irq_domain_free_irqs_parent(domain, virq, i - 1); ++ irq_domain_free_irqs_parent(domain, virq, i); + alpine_msix_free_sgi(priv, sgi, nr_irqs); + return err; + } +-- +2.43.0 + diff --git a/queue-5.15/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch b/queue-5.15/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch new file mode 100644 index 00000000000..5e844f44b32 --- /dev/null +++ b/queue-5.15/irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch @@ -0,0 +1,41 @@ +From f4cc9e04a3360f7f48164f2e1a105bbf75de5f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 22:23:34 +0800 +Subject: irqchip/loongson-pch-msi: Fix off-by-one on allocation error path + +From: Zenghui Yu + +[ Upstream commit b327708798809328f21da8dc14cc8883d1e8a4b3 ] + +When pch_msi_parent_domain_alloc() returns an error, there is an off-by-one +in the number of interrupts to be freed. + +Fix it by passing the number of successfully allocated interrupts, instead of the +relative index of the last allocated one. + +Fixes: 632dcc2c75ef ("irqchip: Add Loongson PCH MSI controller") +Signed-off-by: Zenghui Yu +Signed-off-by: Thomas Gleixner +Reviewed-by: Jiaxun Yang +Link: https://lore.kernel.org/r/20240327142334.1098-1-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-loongson-pch-msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-loongson-pch-msi.c b/drivers/irqchip/irq-loongson-pch-msi.c +index 32562b7e681b5..254a58fbb844a 100644 +--- a/drivers/irqchip/irq-loongson-pch-msi.c ++++ b/drivers/irqchip/irq-loongson-pch-msi.c +@@ -132,7 +132,7 @@ static int pch_msi_middle_domain_alloc(struct irq_domain *domain, + + err_hwirq: + pch_msi_free_hwirq(priv, hwirq, nr_irqs); +- irq_domain_free_irqs_parent(domain, virq, i - 1); ++ irq_domain_free_irqs_parent(domain, virq, i); + + return err; + } +-- +2.43.0 + diff --git a/queue-5.15/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch b/queue-5.15/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch new file mode 100644 index 00000000000..ba36fa6b765 --- /dev/null +++ b/queue-5.15/jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch @@ -0,0 +1,81 @@ +From f646f5740890c3d74674ad55b38b77ffdfb86dee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 18:53:54 +0300 +Subject: jffs2: prevent xattr node from overflowing the eraseblock + +From: Ilya Denisyev + +[ Upstream commit c6854e5a267c28300ff045480b5a7ee7f6f1d913 ] + +Add a check to make sure that the requested xattr node size is no larger +than the eraseblock minus the cleanmarker. + +Unlike the usual inode nodes, the xattr nodes aren't split into parts +and spread across multiple eraseblocks, which means that a xattr node +must not occupy more than one eraseblock. If the requested xattr value is +too large, the xattr node can spill onto the next eraseblock, overwriting +the nodes and causing errors such as: + +jffs2: argh. node added in wrong place at 0x0000b050(2) +jffs2: nextblock 0x0000a000, expected at 0000b00c +jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050, +read=0xfc892c93, calc=0x000000 +jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed +at 0x01e00c. {848f,2fc4,0fef511f,59a3d171} +jffs2: Node at 0x0000000c with length 0x00001044 would run over the +end of the erase block +jffs2: Perhaps the file system was created with the wrong erase size? +jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found +at 0x00000010: 0x1044 instead + +This breaks the filesystem and can lead to KASAN crashes such as: + +BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0 +Read of size 4 at addr ffff88802c31e914 by task repro/830 +CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), +BIOS Arch Linux 1.16.3-1-1 04/01/2014 +Call Trace: + + dump_stack_lvl+0xc6/0x120 + print_report+0xc4/0x620 + ? __virt_addr_valid+0x308/0x5b0 + kasan_report+0xc1/0xf0 + ? jffs2_sum_add_kvec+0x125e/0x15d0 + ? jffs2_sum_add_kvec+0x125e/0x15d0 + jffs2_sum_add_kvec+0x125e/0x15d0 + jffs2_flash_direct_writev+0xa8/0xd0 + jffs2_flash_writev+0x9c9/0xef0 + ? __x64_sys_setxattr+0xc4/0x160 + ? do_syscall_64+0x69/0x140 + ? entry_SYSCALL_64_after_hwframe+0x76/0x7e + [...] + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: aa98d7cf59b5 ("[JFFS2][XATTR] XATTR support on JFFS2 (version. 5)") +Signed-off-by: Ilya Denisyev +Link: https://lore.kernel.org/r/20240412155357.237803-1-dev@elkcl.ru +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/jffs2/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c +index acb4492f5970c..5a31220f96f5f 100644 +--- a/fs/jffs2/xattr.c ++++ b/fs/jffs2/xattr.c +@@ -1111,6 +1111,9 @@ int do_jffs2_setxattr(struct inode *inode, int xprefix, const char *xname, + return rc; + + request = PAD(sizeof(struct jffs2_raw_xattr) + strlen(xname) + 1 + size); ++ if (request > c->sector_size - c->cleanmarker_size) ++ return -ERANGE; ++ + rc = jffs2_reserve_space(c, request, &length, + ALLOC_NORMAL, JFFS2_SUMMARY_XATTR_SIZE); + if (rc) { +-- +2.43.0 + diff --git a/queue-5.15/m68k-fix-spinlock-race-in-kernel-thread-creation.patch b/queue-5.15/m68k-fix-spinlock-race-in-kernel-thread-creation.patch new file mode 100644 index 00000000000..73de9696df5 --- /dev/null +++ b/queue-5.15/m68k-fix-spinlock-race-in-kernel-thread-creation.patch @@ -0,0 +1,77 @@ +From b15c53919f1adfd74bcc94815f50d34b7f96f69b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 15:36:31 +1200 +Subject: m68k: Fix spinlock race in kernel thread creation + +From: Michael Schmitz + +[ Upstream commit da89ce46f02470ef08f0f580755d14d547da59ed ] + +Context switching does take care to retain the correct lock owner across +the switch from 'prev' to 'next' tasks. This does rely on interrupts +remaining disabled for the entire duration of the switch. + +This condition is guaranteed for normal process creation and context +switching between already running processes, because both 'prev' and +'next' already have interrupts disabled in their saved copies of the +status register. + +The situation is different for newly created kernel threads. The status +register is set to PS_S in copy_thread(), which does leave the IPL at 0. +Upon restoring the 'next' thread's status register in switch_to() aka +resume(), interrupts then become enabled prematurely. resume() then +returns via ret_from_kernel_thread() and schedule_tail() where run queue +lock is released (see finish_task_switch() and finish_lock_switch()). + +A timer interrupt calling scheduler_tick() before the lock is released +in finish_task_switch() will find the lock already taken, with the +current task as lock owner. This causes a spinlock recursion warning as +reported by Guenter Roeck. + +As far as I can ascertain, this race has been opened in commit +533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()") +but I haven't done a detailed study of kernel history so it may well +predate that commit. + +Interrupts cannot be disabled in the saved status register copy for +kernel threads (init will complain about interrupts disabled when +finally starting user space). Disable interrupts temporarily when +switching the tasks' register sets in resume(). + +Note that a simple oriw 0x700,%sr after restoring sr is not enough here +- this leaves enough of a race for the 'spinlock recursion' warning to +still be observed. + +Tested on ARAnyM and qemu (Quadra 800 emulation). + +Fixes: 533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()") +Reported-by: Guenter Roeck +Closes: https://lore.kernel.org/all/07811b26-677c-4d05-aeb4-996cd880b789@roeck-us.net +Signed-off-by: Michael Schmitz +Tested-by: Guenter Roeck +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240411033631.16335-1-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/entry.S | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S +index 9f3663facaa0e..198c4c919c678 100644 +--- a/arch/m68k/kernel/entry.S ++++ b/arch/m68k/kernel/entry.S +@@ -430,7 +430,9 @@ resume: + movec %a0,%dfc + + /* restore status register */ +- movew %a1@(TASK_THREAD+THREAD_SR),%sr ++ movew %a1@(TASK_THREAD+THREAD_SR),%d0 ++ oriw #0x0700,%d0 ++ movew %d0,%sr + + rts + +-- +2.43.0 + diff --git a/queue-5.15/m68k-mac-fix-reboot-hang-on-mac-iici.patch b/queue-5.15/m68k-mac-fix-reboot-hang-on-mac-iici.patch new file mode 100644 index 00000000000..f14ebae6bc1 --- /dev/null +++ b/queue-5.15/m68k-mac-fix-reboot-hang-on-mac-iici.patch @@ -0,0 +1,99 @@ +From fb70996b6b841ba2d2585aa39823280011d7d28c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 14:31:12 +1000 +Subject: m68k: mac: Fix reboot hang on Mac IIci + +From: Finn Thain + +[ Upstream commit 265a3b322df9a973ff1fc63da70af456ab6ae1d6 ] + +Calling mac_reset() on a Mac IIci does reset the system, but what +follows is a POST failure that requires a manual reset to resolve. +Avoid that by using the 68030 asm implementation instead of the C +implementation. + +Apparently the SE/30 has a similar problem as it has used the asm +implementation since before git. This patch extends that solution to +other systems with a similar ROM. + +After this patch, the only systems still using the C implementation are +68040 systems where adb_type is either MAC_ADB_IOP or MAC_ADB_II. This +implies a 1 MiB Quadra ROM. + +This now includes the Quadra 900/950, which previously fell through to +the "should never get here" catch-all. + +Reported-and-tested-by: Stan Johnson +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/480ebd1249d229c6dc1f3f1c6d599b8505483fd8.1714797072.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/mac/misc.c | 36 ++++++++++++++++++------------------ + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/arch/m68k/mac/misc.c b/arch/m68k/mac/misc.c +index 4fab347917586..060394b00037d 100644 +--- a/arch/m68k/mac/misc.c ++++ b/arch/m68k/mac/misc.c +@@ -451,30 +451,18 @@ void mac_poweroff(void) + + void mac_reset(void) + { +- if (macintosh_config->adb_type == MAC_ADB_II && +- macintosh_config->ident != MAC_MODEL_SE30) { +- /* need ROMBASE in booter */ +- /* indeed, plus need to MAP THE ROM !! */ +- +- if (mac_bi_data.rombase == 0) +- mac_bi_data.rombase = 0x40800000; +- +- /* works on some */ +- rom_reset = (void *) (mac_bi_data.rombase + 0xa); +- +- local_irq_disable(); +- rom_reset(); + #ifdef CONFIG_ADB_CUDA +- } else if (macintosh_config->adb_type == MAC_ADB_EGRET || +- macintosh_config->adb_type == MAC_ADB_CUDA) { ++ if (macintosh_config->adb_type == MAC_ADB_EGRET || ++ macintosh_config->adb_type == MAC_ADB_CUDA) { + cuda_restart(); ++ } else + #endif + #ifdef CONFIG_ADB_PMU +- } else if (macintosh_config->adb_type == MAC_ADB_PB2) { ++ if (macintosh_config->adb_type == MAC_ADB_PB2) { + pmu_restart(); ++ } else + #endif +- } else if (CPU_IS_030) { +- ++ if (CPU_IS_030) { + /* 030-specific reset routine. The idea is general, but the + * specific registers to reset are '030-specific. Until I + * have a non-030 machine, I can't test anything else. +@@ -522,6 +510,18 @@ void mac_reset(void) + "jmp %/a0@\n\t" /* jump to the reset vector */ + ".chip 68k" + : : "r" (offset), "a" (rombase) : "a0"); ++ } else { ++ /* need ROMBASE in booter */ ++ /* indeed, plus need to MAP THE ROM !! */ ++ ++ if (mac_bi_data.rombase == 0) ++ mac_bi_data.rombase = 0x40800000; ++ ++ /* works on some */ ++ rom_reset = (void *)(mac_bi_data.rombase + 0xa); ++ ++ local_irq_disable(); ++ rom_reset(); + } + + /* should never get here */ +-- +2.43.0 + diff --git a/queue-5.15/macintosh-via-macii-fix-bug-sleeping-function-called.patch b/queue-5.15/macintosh-via-macii-fix-bug-sleeping-function-called.patch new file mode 100644 index 00000000000..3a66301ad71 --- /dev/null +++ b/queue-5.15/macintosh-via-macii-fix-bug-sleeping-function-called.patch @@ -0,0 +1,59 @@ +From 9e8a30b8ec0f4ace70b8b21103697180d352b0f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 13:53:41 +1100 +Subject: macintosh/via-macii: Fix "BUG: sleeping function called from invalid + context" + +From: Finn Thain + +[ Upstream commit d301a71c76ee4c384b4e03cdc320a55f5cf1df05 ] + +The via-macii ADB driver calls request_irq() after disabling hard +interrupts. But disabling interrupts isn't necessary here because the +VIA shift register interrupt was masked during VIA1 initialization. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/419fcc09d0e563b425c419053d02236b044d86b0.1710298421.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/macintosh/via-macii.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c +index db9270da5b8e9..b6ddf1d47cb4e 100644 +--- a/drivers/macintosh/via-macii.c ++++ b/drivers/macintosh/via-macii.c +@@ -140,24 +140,19 @@ static int macii_probe(void) + /* Initialize the driver */ + static int macii_init(void) + { +- unsigned long flags; + int err; + +- local_irq_save(flags); +- + err = macii_init_via(); + if (err) +- goto out; ++ return err; + + err = request_irq(IRQ_MAC_ADB, macii_interrupt, 0, "ADB", + macii_interrupt); + if (err) +- goto out; ++ return err; + + macii_state = idle; +-out: +- local_irq_restore(flags); +- return err; ++ return 0; + } + + /* initialize the hardware */ +-- +2.43.0 + diff --git a/queue-5.15/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch b/queue-5.15/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch new file mode 100644 index 00000000000..703cbfc77fe --- /dev/null +++ b/queue-5.15/md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch @@ -0,0 +1,93 @@ +From 94803023a23b907ef29ed974f604fd73b2fa2c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 14:58:24 +0800 +Subject: md: fix resync softlockup when bitmap size is less than array size + +From: Yu Kuai + +[ Upstream commit f0e729af2eb6bee9eb58c4df1087f14ebaefe26b ] + +Is is reported that for dm-raid10, lvextend + lvchange --syncaction will +trigger following softlockup: + +kernel:watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [mdX_resync:6976] +CPU: 7 PID: 3588 Comm: mdX_resync Kdump: loaded Not tainted 6.9.0-rc4-next-20240419 #1 +RIP: 0010:_raw_spin_unlock_irq+0x13/0x30 +Call Trace: + + md_bitmap_start_sync+0x6b/0xf0 + raid10_sync_request+0x25c/0x1b40 [raid10] + md_do_sync+0x64b/0x1020 + md_thread+0xa7/0x170 + kthread+0xcf/0x100 + ret_from_fork+0x30/0x50 + ret_from_fork_asm+0x1a/0x30 + +And the detailed process is as follows: + +md_do_sync + j = mddev->resync_min + while (j < max_sectors) + sectors = raid10_sync_request(mddev, j, &skipped) + if (!md_bitmap_start_sync(..., &sync_blocks)) + // md_bitmap_start_sync set sync_blocks to 0 + return sync_blocks + sectors_skippe; + // sectors = 0; + j += sectors; + // j never change + +Root cause is that commit 301867b1c168 ("md/raid10: check +slab-out-of-bounds in md_bitmap_get_counter") return early from +md_bitmap_get_counter(), without setting returned blocks. + +Fix this problem by always set returned blocks from +md_bitmap_get_counter"(), as it used to be. + +Noted that this patch just fix the softlockup problem in kernel, the +case that bitmap size doesn't match array size still need to be fixed. + +Fixes: 301867b1c168 ("md/raid10: check slab-out-of-bounds in md_bitmap_get_counter") +Reported-and-tested-by: Nigel Croxon +Closes: https://lore.kernel.org/all/71ba5272-ab07-43ba-8232-d2da642acb4e@redhat.com/ +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20240422065824.2516-1-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 49c46f3aea573..b26e22dd9ba2e 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -1355,7 +1355,7 @@ __acquires(bitmap->lock) + sector_t chunk = offset >> bitmap->chunkshift; + unsigned long page = chunk >> PAGE_COUNTER_SHIFT; + unsigned long pageoff = (chunk & PAGE_COUNTER_MASK) << COUNTER_BYTE_SHIFT; +- sector_t csize; ++ sector_t csize = ((sector_t)1) << bitmap->chunkshift; + int err; + + if (page >= bitmap->pages) { +@@ -1364,6 +1364,7 @@ __acquires(bitmap->lock) + * End-of-device while looking for a whole page or + * user set a huge number to sysfs bitmap_set_bits. + */ ++ *blocks = csize - (offset & (csize - 1)); + return NULL; + } + err = md_bitmap_checkpage(bitmap, page, create, 0); +@@ -1372,8 +1373,7 @@ __acquires(bitmap->lock) + bitmap->bp[page].map == NULL) + csize = ((sector_t)1) << (bitmap->chunkshift + + PAGE_COUNTER_SHIFT); +- else +- csize = ((sector_t)1) << bitmap->chunkshift; ++ + *blocks = csize - (offset & (csize - 1)); + + if (err < 0) +-- +2.43.0 + diff --git a/queue-5.15/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch b/queue-5.15/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..f87595f7f6e --- /dev/null +++ b/queue-5.15/media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch @@ -0,0 +1,52 @@ +From 3f143301231dd79cb76d4391788060cfef3b8880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 16:13:00 +0100 +Subject: media: atomisp: ssh_css: Fix a null-pointer dereference in + load_video_binaries + +From: Zhipeng Lu + +[ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ] + +The allocation failure of mycs->yuv_scaler_binary in load_video_binaries() +is followed with a dereference of mycs->yuv_scaler_binary after the +following call chain: + +sh_css_pipe_load_binaries() + |-> load_video_binaries(mycs->yuv_scaler_binary == NULL) + | + |-> sh_css_pipe_unload_binaries() + |-> unload_video_binaries() + +In unload_video_binaries(), it calls to ia_css_binary_unload with argument +&pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the +same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer +dereference is triggered. + +Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn + +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Signed-off-by: Zhipeng Lu +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/sh_css.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c +index ba25d0da8b811..feaec4cd96361 100644 +--- a/drivers/staging/media/atomisp/pci/sh_css.c ++++ b/drivers/staging/media/atomisp/pci/sh_css.c +@@ -5322,6 +5322,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe) + sizeof(struct ia_css_binary), + GFP_KERNEL); + if (!mycs->yuv_scaler_binary) { ++ mycs->num_yuv_scaler = 0; + err = -ENOMEM; + return err; + } +-- +2.43.0 + diff --git a/queue-5.15/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch b/queue-5.15/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch new file mode 100644 index 00000000000..cc098343267 --- /dev/null +++ b/queue-5.15/media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch @@ -0,0 +1,77 @@ +From 584672b6c0ba0d6b5f279e65dd44e69e1aed90e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 14:40:27 -0300 +Subject: media: dt-bindings: ovti,ov2680: Fix the power supply names + +From: Fabio Estevam + +[ Upstream commit e2f6ea61b6f3e4ebbb7dff857eea6220c18cd17b ] + +The original .txt bindings had the OV2680 power supply names correct, +but the transition from .txt to yaml spelled them incorrectly. + +Fix the OV2680 power supply names as the original .txt bindings +as these are the names used by the OV2680 driver and in devicetree. + +Fixes: 57226cd8c8bf ("media: dt-bindings: ov2680: convert bindings to yaml") +Signed-off-by: Fabio Estevam +Reviewed-by: Rob Herring +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../bindings/media/i2c/ovti,ov2680.yaml | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml b/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml +index cf456f8d9ddcb..c87677f5e2a25 100644 +--- a/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml ++++ b/Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml +@@ -37,15 +37,15 @@ properties: + active low. + maxItems: 1 + +- dovdd-supply: ++ DOVDD-supply: + description: + Definition of the regulator used as interface power supply. + +- avdd-supply: ++ AVDD-supply: + description: + Definition of the regulator used as analog power supply. + +- dvdd-supply: ++ DVDD-supply: + description: + Definition of the regulator used as digital power supply. + +@@ -59,9 +59,9 @@ required: + - reg + - clocks + - clock-names +- - dovdd-supply +- - avdd-supply +- - dvdd-supply ++ - DOVDD-supply ++ - AVDD-supply ++ - DVDD-supply + - reset-gpios + - port + +@@ -82,9 +82,9 @@ examples: + clock-names = "xvclk"; + reset-gpios = <&gpio1 3 GPIO_ACTIVE_LOW>; + +- dovdd-supply = <&sw2_reg>; +- dvdd-supply = <&sw2_reg>; +- avdd-supply = <®_peri_3p15v>; ++ DOVDD-supply = <&sw2_reg>; ++ DVDD-supply = <&sw2_reg>; ++ AVDD-supply = <®_peri_3p15v>; + + port { + ov2680_to_mipi: endpoint { +-- +2.43.0 + diff --git a/queue-5.15/media-ipu3-cio2-request-irq-earlier.patch b/queue-5.15/media-ipu3-cio2-request-irq-earlier.patch new file mode 100644 index 00000000000..4d24d670a11 --- /dev/null +++ b/queue-5.15/media-ipu3-cio2-request-irq-earlier.patch @@ -0,0 +1,52 @@ +From 9ad4e0e7ad479b6819cf4d54d580dde6aa186339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 16:01:20 +0200 +Subject: media: ipu3-cio2: Request IRQ earlier + +From: Sakari Ailus + +[ Upstream commit a069f79bfa6ec1ea0744981ea8425c8a25322579 ] + +Call devm_request_irq() before registering the async notifier, as otherwise +it would be possible to use the device before the interrupts could be +delivered to the driver. + +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +index 29c660fe1425b..dfb2be0b9625a 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +@@ -1803,11 +1803,6 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + + v4l2_async_notifier_init(&cio2->notifier); + +- /* Register notifier for subdevices we care */ +- r = cio2_parse_firmware(cio2); +- if (r) +- goto fail_clean_notifier; +- + r = devm_request_irq(dev, pci_dev->irq, cio2_irq, IRQF_SHARED, + CIO2_NAME, cio2); + if (r) { +@@ -1815,6 +1810,11 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + goto fail_clean_notifier; + } + ++ /* Register notifier for subdevices we care */ ++ r = cio2_parse_firmware(cio2); ++ if (r) ++ goto fail_clean_notifier; ++ + pm_runtime_put_noidle(dev); + pm_runtime_allow(dev); + +-- +2.43.0 + diff --git a/queue-5.15/media-ipu3-cio2-use-temporary-storage-for-struct-dev.patch b/queue-5.15/media-ipu3-cio2-use-temporary-storage-for-struct-dev.patch new file mode 100644 index 00000000000..60313fac287 --- /dev/null +++ b/queue-5.15/media-ipu3-cio2-use-temporary-storage-for-struct-dev.patch @@ -0,0 +1,496 @@ +From 26412f56a51a445ab04ed43a8396861d2f569889 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 22:21:27 +0200 +Subject: media: ipu3-cio2: Use temporary storage for struct device pointer + +From: Andy Shevchenko + +[ Upstream commit cfd13612a5a70715299d2468f967334048ce52a7 ] + +Use temporary storage for struct device pointer to simplify the code. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: a069f79bfa6e ("media: ipu3-cio2: Request IRQ earlier") +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 138 +++++++++--------- + 1 file changed, 67 insertions(+), 71 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +index 162ab089124f3..29c660fe1425b 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +@@ -102,26 +102,29 @@ static inline u32 cio2_bytesperline(const unsigned int width) + + static void cio2_fbpt_exit_dummy(struct cio2_device *cio2) + { ++ struct device *dev = &cio2->pci_dev->dev; ++ + if (cio2->dummy_lop) { +- dma_free_coherent(&cio2->pci_dev->dev, PAGE_SIZE, +- cio2->dummy_lop, cio2->dummy_lop_bus_addr); ++ dma_free_coherent(dev, PAGE_SIZE, cio2->dummy_lop, ++ cio2->dummy_lop_bus_addr); + cio2->dummy_lop = NULL; + } + if (cio2->dummy_page) { +- dma_free_coherent(&cio2->pci_dev->dev, PAGE_SIZE, +- cio2->dummy_page, cio2->dummy_page_bus_addr); ++ dma_free_coherent(dev, PAGE_SIZE, cio2->dummy_page, ++ cio2->dummy_page_bus_addr); + cio2->dummy_page = NULL; + } + } + + static int cio2_fbpt_init_dummy(struct cio2_device *cio2) + { ++ struct device *dev = &cio2->pci_dev->dev; + unsigned int i; + +- cio2->dummy_page = dma_alloc_coherent(&cio2->pci_dev->dev, PAGE_SIZE, ++ cio2->dummy_page = dma_alloc_coherent(dev, PAGE_SIZE, + &cio2->dummy_page_bus_addr, + GFP_KERNEL); +- cio2->dummy_lop = dma_alloc_coherent(&cio2->pci_dev->dev, PAGE_SIZE, ++ cio2->dummy_lop = dma_alloc_coherent(dev, PAGE_SIZE, + &cio2->dummy_lop_bus_addr, + GFP_KERNEL); + if (!cio2->dummy_page || !cio2->dummy_lop) { +@@ -497,6 +500,7 @@ static int cio2_hw_init(struct cio2_device *cio2, struct cio2_queue *q) + + static void cio2_hw_exit(struct cio2_device *cio2, struct cio2_queue *q) + { ++ struct device *dev = &cio2->pci_dev->dev; + void __iomem *const base = cio2->base; + unsigned int i; + u32 value; +@@ -514,8 +518,7 @@ static void cio2_hw_exit(struct cio2_device *cio2, struct cio2_queue *q) + value, value & CIO2_CDMAC0_DMA_HALTED, + 4000, 2000000); + if (ret) +- dev_err(&cio2->pci_dev->dev, +- "DMA %i can not be halted\n", CIO2_DMA_CHAN); ++ dev_err(dev, "DMA %i can not be halted\n", CIO2_DMA_CHAN); + + for (i = 0; i < CIO2_NUM_PORTS; i++) { + writel(readl(base + CIO2_REG_PXM_FRF_CFG(i)) | +@@ -539,8 +542,7 @@ static void cio2_buffer_done(struct cio2_device *cio2, unsigned int dma_chan) + + entry = &q->fbpt[q->bufs_first * CIO2_MAX_LOPS]; + if (entry->first_entry.ctrl & CIO2_FBPT_CTRL_VALID) { +- dev_warn(&cio2->pci_dev->dev, +- "no ready buffers found on DMA channel %u\n", ++ dev_warn(dev, "no ready buffers found on DMA channel %u\n", + dma_chan); + return; + } +@@ -557,8 +559,7 @@ static void cio2_buffer_done(struct cio2_device *cio2, unsigned int dma_chan) + + q->bufs[q->bufs_first] = NULL; + atomic_dec(&q->bufs_queued); +- dev_dbg(&cio2->pci_dev->dev, +- "buffer %i done\n", b->vbb.vb2_buf.index); ++ dev_dbg(dev, "buffer %i done\n", b->vbb.vb2_buf.index); + + b->vbb.vb2_buf.timestamp = ns; + b->vbb.field = V4L2_FIELD_NONE; +@@ -624,8 +625,8 @@ static const char *const cio2_port_errs[] = { + + static void cio2_irq_handle_once(struct cio2_device *cio2, u32 int_status) + { +- void __iomem *const base = cio2->base; + struct device *dev = &cio2->pci_dev->dev; ++ void __iomem *const base = cio2->base; + + if (int_status & CIO2_INT_IOOE) { + /* +@@ -795,6 +796,7 @@ static int cio2_vb2_queue_setup(struct vb2_queue *vq, + struct device *alloc_devs[]) + { + struct cio2_device *cio2 = vb2_get_drv_priv(vq); ++ struct device *dev = &cio2->pci_dev->dev; + struct cio2_queue *q = vb2q_to_cio2_queue(vq); + unsigned int i; + +@@ -802,7 +804,7 @@ static int cio2_vb2_queue_setup(struct vb2_queue *vq, + + for (i = 0; i < *num_planes; ++i) { + sizes[i] = q->format.plane_fmt[i].sizeimage; +- alloc_devs[i] = &cio2->pci_dev->dev; ++ alloc_devs[i] = dev; + } + + *num_buffers = clamp_val(*num_buffers, 1, CIO2_MAX_BUFFERS); +@@ -879,6 +881,7 @@ static int cio2_vb2_buf_init(struct vb2_buffer *vb) + static void cio2_vb2_buf_queue(struct vb2_buffer *vb) + { + struct cio2_device *cio2 = vb2_get_drv_priv(vb->vb2_queue); ++ struct device *dev = &cio2->pci_dev->dev; + struct cio2_queue *q = + container_of(vb->vb2_queue, struct cio2_queue, vbq); + struct cio2_buffer *b = +@@ -889,7 +892,7 @@ static void cio2_vb2_buf_queue(struct vb2_buffer *vb) + int bufs_queued = atomic_inc_return(&q->bufs_queued); + u32 fbpt_rp; + +- dev_dbg(&cio2->pci_dev->dev, "queue buffer %d\n", vb->index); ++ dev_dbg(dev, "queue buffer %d\n", vb->index); + + /* + * This code queues the buffer to the CIO2 DMA engine, which starts +@@ -940,12 +943,12 @@ static void cio2_vb2_buf_queue(struct vb2_buffer *vb) + return; + } + +- dev_dbg(&cio2->pci_dev->dev, "entry %i was full!\n", next); ++ dev_dbg(dev, "entry %i was full!\n", next); + next = (next + 1) % CIO2_MAX_BUFFERS; + } + + local_irq_restore(flags); +- dev_err(&cio2->pci_dev->dev, "error: all cio2 entries were full!\n"); ++ dev_err(dev, "error: all cio2 entries were full!\n"); + atomic_dec(&q->bufs_queued); + vb2_buffer_done(vb, VB2_BUF_STATE_ERROR); + } +@@ -954,6 +957,7 @@ static void cio2_vb2_buf_queue(struct vb2_buffer *vb) + static void cio2_vb2_buf_cleanup(struct vb2_buffer *vb) + { + struct cio2_device *cio2 = vb2_get_drv_priv(vb->vb2_queue); ++ struct device *dev = &cio2->pci_dev->dev; + struct cio2_buffer *b = + container_of(vb, struct cio2_buffer, vbb.vb2_buf); + unsigned int i; +@@ -961,7 +965,7 @@ static void cio2_vb2_buf_cleanup(struct vb2_buffer *vb) + /* Free LOP table */ + for (i = 0; i < CIO2_MAX_LOPS; i++) { + if (b->lop[i]) +- dma_free_coherent(&cio2->pci_dev->dev, PAGE_SIZE, ++ dma_free_coherent(dev, PAGE_SIZE, + b->lop[i], b->lop_bus_addr[i]); + } + } +@@ -970,14 +974,15 @@ static int cio2_vb2_start_streaming(struct vb2_queue *vq, unsigned int count) + { + struct cio2_queue *q = vb2q_to_cio2_queue(vq); + struct cio2_device *cio2 = vb2_get_drv_priv(vq); ++ struct device *dev = &cio2->pci_dev->dev; + int r; + + cio2->cur_queue = q; + atomic_set(&q->frame_sequence, 0); + +- r = pm_runtime_resume_and_get(&cio2->pci_dev->dev); ++ r = pm_runtime_resume_and_get(dev); + if (r < 0) { +- dev_info(&cio2->pci_dev->dev, "failed to set power %d\n", r); ++ dev_info(dev, "failed to set power %d\n", r); + return r; + } + +@@ -1003,9 +1008,9 @@ static int cio2_vb2_start_streaming(struct vb2_queue *vq, unsigned int count) + fail_hw: + media_pipeline_stop(&q->vdev.entity); + fail_pipeline: +- dev_dbg(&cio2->pci_dev->dev, "failed to start streaming (%d)\n", r); ++ dev_dbg(dev, "failed to start streaming (%d)\n", r); + cio2_vb2_return_all_buffers(q, VB2_BUF_STATE_QUEUED); +- pm_runtime_put(&cio2->pci_dev->dev); ++ pm_runtime_put(dev); + + return r; + } +@@ -1014,16 +1019,16 @@ static void cio2_vb2_stop_streaming(struct vb2_queue *vq) + { + struct cio2_queue *q = vb2q_to_cio2_queue(vq); + struct cio2_device *cio2 = vb2_get_drv_priv(vq); ++ struct device *dev = &cio2->pci_dev->dev; + + if (v4l2_subdev_call(q->sensor, video, s_stream, 0)) +- dev_err(&cio2->pci_dev->dev, +- "failed to stop sensor streaming\n"); ++ dev_err(dev, "failed to stop sensor streaming\n"); + + cio2_hw_exit(cio2, q); + synchronize_irq(cio2->pci_dev->irq); + cio2_vb2_return_all_buffers(q, VB2_BUF_STATE_ERROR); + media_pipeline_stop(&q->vdev.entity); +- pm_runtime_put(&cio2->pci_dev->dev); ++ pm_runtime_put(dev); + cio2->streaming = false; + } + +@@ -1315,12 +1320,12 @@ static int cio2_video_link_validate(struct media_link *link) + struct video_device, entity); + struct cio2_queue *q = container_of(vd, struct cio2_queue, vdev); + struct cio2_device *cio2 = video_get_drvdata(vd); ++ struct device *dev = &cio2->pci_dev->dev; + struct v4l2_subdev_format source_fmt; + int ret; + + if (!media_entity_remote_pad(link->sink->entity->pads)) { +- dev_info(&cio2->pci_dev->dev, +- "video node %s pad not connected\n", vd->name); ++ dev_info(dev, "video node %s pad not connected\n", vd->name); + return -ENOTCONN; + } + +@@ -1330,8 +1335,7 @@ static int cio2_video_link_validate(struct media_link *link) + + if (source_fmt.format.width != q->format.width || + source_fmt.format.height != q->format.height) { +- dev_err(&cio2->pci_dev->dev, +- "Wrong width or height %ux%u (%ux%u expected)\n", ++ dev_err(dev, "Wrong width or height %ux%u (%ux%u expected)\n", + q->format.width, q->format.height, + source_fmt.format.width, source_fmt.format.height); + return -EINVAL; +@@ -1412,6 +1416,7 @@ static int cio2_notifier_complete(struct v4l2_async_notifier *notifier) + { + struct cio2_device *cio2 = container_of(notifier, struct cio2_device, + notifier); ++ struct device *dev = &cio2->pci_dev->dev; + struct sensor_async_subdev *s_asd; + struct v4l2_async_subdev *asd; + struct cio2_queue *q; +@@ -1428,8 +1433,7 @@ static int cio2_notifier_complete(struct v4l2_async_notifier *notifier) + break; + + if (pad == q->sensor->entity.num_pads) { +- dev_err(&cio2->pci_dev->dev, +- "failed to find src pad for %s\n", ++ dev_err(dev, "failed to find src pad for %s\n", + q->sensor->name); + return -ENXIO; + } +@@ -1439,8 +1443,7 @@ static int cio2_notifier_complete(struct v4l2_async_notifier *notifier) + &q->subdev.entity, CIO2_PAD_SINK, + 0); + if (ret) { +- dev_err(&cio2->pci_dev->dev, +- "failed to create link for %s\n", ++ dev_err(dev, "failed to create link for %s\n", + q->sensor->name); + return ret; + } +@@ -1457,6 +1460,7 @@ static const struct v4l2_async_notifier_operations cio2_async_ops = { + + static int cio2_parse_firmware(struct cio2_device *cio2) + { ++ struct device *dev = &cio2->pci_dev->dev; + unsigned int i; + int ret; + +@@ -1467,10 +1471,8 @@ static int cio2_parse_firmware(struct cio2_device *cio2) + struct sensor_async_subdev *s_asd; + struct fwnode_handle *ep; + +- ep = fwnode_graph_get_endpoint_by_id( +- dev_fwnode(&cio2->pci_dev->dev), i, 0, +- FWNODE_GRAPH_ENDPOINT_NEXT); +- ++ ep = fwnode_graph_get_endpoint_by_id(dev_fwnode(dev), i, 0, ++ FWNODE_GRAPH_ENDPOINT_NEXT); + if (!ep) + continue; + +@@ -1504,8 +1506,7 @@ static int cio2_parse_firmware(struct cio2_device *cio2) + cio2->notifier.ops = &cio2_async_ops; + ret = v4l2_async_notifier_register(&cio2->v4l2_dev, &cio2->notifier); + if (ret) +- dev_err(&cio2->pci_dev->dev, +- "failed to register async notifier : %d\n", ret); ++ dev_err(dev, "failed to register async notifier : %d\n", ret); + + return ret; + } +@@ -1524,7 +1525,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + static const u32 default_width = 1936; + static const u32 default_height = 1096; + const struct ipu3_cio2_fmt dflt_fmt = formats[0]; +- ++ struct device *dev = &cio2->pci_dev->dev; + struct video_device *vdev = &q->vdev; + struct vb2_queue *vbq = &q->vbq; + struct v4l2_subdev *subdev = &q->subdev; +@@ -1566,8 +1567,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + subdev->internal_ops = &cio2_subdev_internal_ops; + r = media_entity_pads_init(&subdev->entity, CIO2_PADS, q->subdev_pads); + if (r) { +- dev_err(&cio2->pci_dev->dev, +- "failed initialize subdev media entity (%d)\n", r); ++ dev_err(dev, "failed initialize subdev media entity (%d)\n", r); + goto fail_subdev_media_entity; + } + +@@ -1575,8 +1575,8 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + vdev->entity.ops = &cio2_video_entity_ops; + r = media_entity_pads_init(&vdev->entity, 1, &q->vdev_pad); + if (r) { +- dev_err(&cio2->pci_dev->dev, +- "failed initialize videodev media entity (%d)\n", r); ++ dev_err(dev, "failed initialize videodev media entity (%d)\n", ++ r); + goto fail_vdev_media_entity; + } + +@@ -1590,8 +1590,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + v4l2_set_subdevdata(subdev, cio2); + r = v4l2_device_register_subdev(&cio2->v4l2_dev, subdev); + if (r) { +- dev_err(&cio2->pci_dev->dev, +- "failed initialize subdev (%d)\n", r); ++ dev_err(dev, "failed initialize subdev (%d)\n", r); + goto fail_subdev; + } + +@@ -1607,8 +1606,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + vbq->lock = &q->lock; + r = vb2_queue_init(vbq); + if (r) { +- dev_err(&cio2->pci_dev->dev, +- "failed to initialize videobuf2 queue (%d)\n", r); ++ dev_err(dev, "failed to initialize videobuf2 queue (%d)\n", r); + goto fail_subdev; + } + +@@ -1625,8 +1623,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + video_set_drvdata(vdev, cio2); + r = video_register_device(vdev, VFL_TYPE_VIDEO, -1); + if (r) { +- dev_err(&cio2->pci_dev->dev, +- "failed to register video device (%d)\n", r); ++ dev_err(dev, "failed to register video device (%d)\n", r); + goto fail_vdev; + } + +@@ -1648,7 +1645,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q) + fail_vdev_media_entity: + media_entity_cleanup(&subdev->entity); + fail_subdev_media_entity: +- cio2_fbpt_exit(q, &cio2->pci_dev->dev); ++ cio2_fbpt_exit(q, dev); + fail_fbpt: + mutex_destroy(&q->subdev_lock); + mutex_destroy(&q->lock); +@@ -1715,11 +1712,12 @@ static int cio2_check_fwnode_graph(struct fwnode_handle *fwnode) + static int cio2_pci_probe(struct pci_dev *pci_dev, + const struct pci_device_id *id) + { +- struct fwnode_handle *fwnode = dev_fwnode(&pci_dev->dev); ++ struct device *dev = &pci_dev->dev; ++ struct fwnode_handle *fwnode = dev_fwnode(dev); + struct cio2_device *cio2; + int r; + +- cio2 = devm_kzalloc(&pci_dev->dev, sizeof(*cio2), GFP_KERNEL); ++ cio2 = devm_kzalloc(dev, sizeof(*cio2), GFP_KERNEL); + if (!cio2) + return -ENOMEM; + cio2->pci_dev = pci_dev; +@@ -1732,7 +1730,7 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + r = cio2_check_fwnode_graph(fwnode); + if (r) { + if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary)) { +- dev_err(&pci_dev->dev, "fwnode graph has no endpoints connected\n"); ++ dev_err(dev, "fwnode graph has no endpoints connected\n"); + return -EINVAL; + } + +@@ -1743,16 +1741,16 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + + r = pcim_enable_device(pci_dev); + if (r) { +- dev_err(&pci_dev->dev, "failed to enable device (%d)\n", r); ++ dev_err(dev, "failed to enable device (%d)\n", r); + return r; + } + +- dev_info(&pci_dev->dev, "device 0x%x (rev: 0x%x)\n", ++ dev_info(dev, "device 0x%x (rev: 0x%x)\n", + pci_dev->device, pci_dev->revision); + + r = pcim_iomap_regions(pci_dev, 1 << CIO2_PCI_BAR, pci_name(pci_dev)); + if (r) { +- dev_err(&pci_dev->dev, "failed to remap I/O memory (%d)\n", r); ++ dev_err(dev, "failed to remap I/O memory (%d)\n", r); + return -ENODEV; + } + +@@ -1764,13 +1762,13 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + + r = pci_set_dma_mask(pci_dev, CIO2_DMA_MASK); + if (r) { +- dev_err(&pci_dev->dev, "failed to set DMA mask (%d)\n", r); ++ dev_err(dev, "failed to set DMA mask (%d)\n", r); + return -ENODEV; + } + + r = pci_enable_msi(pci_dev); + if (r) { +- dev_err(&pci_dev->dev, "failed to enable MSI (%d)\n", r); ++ dev_err(dev, "failed to enable MSI (%d)\n", r); + return r; + } + +@@ -1780,7 +1778,7 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + + mutex_init(&cio2->lock); + +- cio2->media_dev.dev = &cio2->pci_dev->dev; ++ cio2->media_dev.dev = dev; + strscpy(cio2->media_dev.model, CIO2_DEVICE_NAME, + sizeof(cio2->media_dev.model)); + snprintf(cio2->media_dev.bus_info, sizeof(cio2->media_dev.bus_info), +@@ -1793,10 +1791,9 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + goto fail_mutex_destroy; + + cio2->v4l2_dev.mdev = &cio2->media_dev; +- r = v4l2_device_register(&pci_dev->dev, &cio2->v4l2_dev); ++ r = v4l2_device_register(dev, &cio2->v4l2_dev); + if (r) { +- dev_err(&pci_dev->dev, +- "failed to register V4L2 device (%d)\n", r); ++ dev_err(dev, "failed to register V4L2 device (%d)\n", r); + goto fail_media_device_unregister; + } + +@@ -1811,15 +1808,15 @@ static int cio2_pci_probe(struct pci_dev *pci_dev, + if (r) + goto fail_clean_notifier; + +- r = devm_request_irq(&pci_dev->dev, pci_dev->irq, cio2_irq, +- IRQF_SHARED, CIO2_NAME, cio2); ++ r = devm_request_irq(dev, pci_dev->irq, cio2_irq, IRQF_SHARED, ++ CIO2_NAME, cio2); + if (r) { +- dev_err(&pci_dev->dev, "failed to request IRQ (%d)\n", r); ++ dev_err(dev, "failed to request IRQ (%d)\n", r); + goto fail_clean_notifier; + } + +- pm_runtime_put_noidle(&pci_dev->dev); +- pm_runtime_allow(&pci_dev->dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_allow(dev); + + return 0; + +@@ -2008,10 +2005,9 @@ static int __maybe_unused cio2_resume(struct device *dev) + if (!cio2->streaming) + return 0; + /* Start stream */ +- r = pm_runtime_force_resume(&cio2->pci_dev->dev); ++ r = pm_runtime_force_resume(dev); + if (r < 0) { +- dev_err(&cio2->pci_dev->dev, +- "failed to set power %d\n", r); ++ dev_err(dev, "failed to set power %d\n", r); + return r; + } + +-- +2.43.0 + diff --git a/queue-5.15/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch b/queue-5.15/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch new file mode 100644 index 00000000000..57467ecdf90 --- /dev/null +++ b/queue-5.15/media-ngene-add-dvb_ca_en50221_init-return-value-che.patch @@ -0,0 +1,40 @@ +From 428adf8ddad5781513895ae28dcb09238c2d964a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 14:15:53 +0300 +Subject: media: ngene: Add dvb_ca_en50221_init return value check + +From: Aleksandr Burakov + +[ Upstream commit 9bb1fd7eddcab2d28cfc11eb20f1029154dac718 ] + +The return value of dvb_ca_en50221_init() is not checked here that may +cause undefined behavior in case of nonzero value return. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 25aee3debe04 ("[media] Rename media/dvb as media/pci") +Signed-off-by: Aleksandr Burakov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ngene/ngene-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c +index 7481f553f9595..24ec576dc3bff 100644 +--- a/drivers/media/pci/ngene/ngene-core.c ++++ b/drivers/media/pci/ngene/ngene-core.c +@@ -1488,7 +1488,9 @@ static int init_channel(struct ngene_channel *chan) + } + + if (dev->ci.en && (io & NGENE_IO_TSOUT)) { +- dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1); ++ ret = dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1); ++ if (ret != 0) ++ goto err; + set_transfer(chan, 1); + chan->dev->channel[2].DataFormatFlags = DF_SWAP32; + set_transfer(&chan->dev->channel[2], 1); +-- +2.43.0 + diff --git a/queue-5.15/media-radio-shark2-avoid-led_names-truncations.patch b/queue-5.15/media-radio-shark2-avoid-led_names-truncations.patch new file mode 100644 index 00000000000..6faf1b12831 --- /dev/null +++ b/queue-5.15/media-radio-shark2-avoid-led_names-truncations.patch @@ -0,0 +1,40 @@ +From 8d1dc0d5db55ef5603e20dfd9c0aecddd20cf8e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 14:50:24 +0000 +Subject: media: radio-shark2: Avoid led_names truncations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ricardo Ribalda + +[ Upstream commit 1820e16a3019b6258e6009d34432946a6ddd0a90 ] + +Increase the size of led_names so it can fit any valid v4l2 device name. + +Fixes: +drivers/media/radio/radio-shark2.c:197:17: warning: ‘%s’ directive output may be truncated writing up to 35 bytes into a region of size 32 [-Wformat-truncation=] + +Signed-off-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/radio/radio-shark2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c +index f1c5c0a6a335c..e3e6aa87fe081 100644 +--- a/drivers/media/radio/radio-shark2.c ++++ b/drivers/media/radio/radio-shark2.c +@@ -62,7 +62,7 @@ struct shark_device { + #ifdef SHARK_USE_LEDS + struct work_struct led_work; + struct led_classdev leds[NO_LEDS]; +- char led_names[NO_LEDS][32]; ++ char led_names[NO_LEDS][64]; + atomic_t brightness[NO_LEDS]; + unsigned long brightness_new; + #endif +-- +2.43.0 + diff --git a/queue-5.15/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch b/queue-5.15/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch new file mode 100644 index 00000000000..3ca30de43ea --- /dev/null +++ b/queue-5.15/mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch @@ -0,0 +1,69 @@ +From 3b393d2294c9a2f862533b05bbabff8c7508deb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 06:38:39 -0700 +Subject: mm/slub, kunit: Use inverted data to corrupt kmem cache + +From: Guenter Roeck + +[ Upstream commit b1080c667b3b2c8c38a7fa83ca5567124887abae ] + +Two failure patterns are seen randomly when running slub_kunit tests with +CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled. + +Pattern 1: + # test_clobber_zone: pass:1 fail:0 skip:0 total:1 + ok 1 test_clobber_zone + # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 + Expected 3 == slab_errors, but + slab_errors == 0 (0x0) + # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84 + Expected 2 == slab_errors, but + slab_errors == 0 (0x0) + # test_next_pointer: pass:0 fail:1 skip:0 total:1 + not ok 2 test_next_pointer + +In this case, test_next_pointer() overwrites p[s->offset], but the data +at p[s->offset] is already 0x12. + +Pattern 2: + ok 1 test_clobber_zone + # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 + Expected 3 == slab_errors, but + slab_errors == 2 (0x2) + # test_next_pointer: pass:0 fail:1 skip:0 total:1 + not ok 2 test_next_pointer + +In this case, p[s->offset] has a value other than 0x12, but one of the +expected failures is nevertheless missing. + +Invert data instead of writing a fixed value to corrupt the cache data +structures to fix the problem. + +Fixes: 1f9f78b1b376 ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality") +Cc: Oliver Glitta +Cc: Vlastimil Babka +CC: Daniel Latypov +Cc: Marco Elver +Signed-off-by: Guenter Roeck +Signed-off-by: Vlastimil Babka +Signed-off-by: Sasha Levin +--- + lib/slub_kunit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c +index 8662dc6cb5092..e8b13b62029de 100644 +--- a/lib/slub_kunit.c ++++ b/lib/slub_kunit.c +@@ -39,7 +39,7 @@ static void test_next_pointer(struct kunit *test) + + ptr_addr = (unsigned long *)(p + s->offset); + tmp = *ptr_addr; +- p[s->offset] = 0x12; ++ p[s->offset] = ~p[s->offset]; + + /* + * Expecting three errors. +-- +2.43.0 + diff --git a/queue-5.15/mptcp-so_keepalive-fix-getsockopt-support.patch b/queue-5.15/mptcp-so_keepalive-fix-getsockopt-support.patch new file mode 100644 index 00000000000..bf28fc0d872 --- /dev/null +++ b/queue-5.15/mptcp-so_keepalive-fix-getsockopt-support.patch @@ -0,0 +1,53 @@ +From 8ccde2540360b101b974e19711073cb268e894bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 18:13:25 -0700 +Subject: mptcp: SO_KEEPALIVE: fix getsockopt support + +From: Matthieu Baerts (NGI0) + +[ Upstream commit a65198136eaa15b74ee0abf73f12ef83d469a334 ] + +SO_KEEPALIVE support has to be set on each subflow: on each TCP socket, +where sk_prot->keepalive is defined. Technically, nothing has to be done +on the MPTCP socket. That's why mptcp_sol_socket_sync_intval() was +called instead of mptcp_sol_socket_intval(). + +Except that when nothing is done on the MPTCP socket, the +getsockopt(SO_KEEPALIVE), handled in net/core/sock.c:sk_getsockopt(), +will not know if SO_KEEPALIVE has been set on the different subflows or +not. + +The fix is simple: simply call mptcp_sol_socket_intval() which will end +up calling net/core/sock.c:sk_setsockopt() where the SOCK_KEEPOPEN flag +will be set, the one used in sk_getsockopt(). + +So now, getsockopt(SO_KEEPALIVE) on an MPTCP socket will return the same +value as the one previously set with setsockopt(SO_KEEPALIVE). + +Fixes: 1b3e7ede1365 ("mptcp: setsockopt: handle SO_KEEPALIVE and SO_PRIORITY") +Acked-by: Paolo Abeni +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Mat Martineau +Link: https://lore.kernel.org/r/20240514011335.176158-2-martineau@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/sockopt.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c +index 4bb305342fcc7..bd797d8f72ab1 100644 +--- a/net/mptcp/sockopt.c ++++ b/net/mptcp/sockopt.c +@@ -177,8 +177,6 @@ static int mptcp_setsockopt_sol_socket_int(struct mptcp_sock *msk, int optname, + + switch (optname) { + case SO_KEEPALIVE: +- mptcp_sol_socket_sync_intval(msk, optname, val); +- return 0; + case SO_DEBUG: + case SO_MARK: + case SO_PRIORITY: +-- +2.43.0 + diff --git a/queue-5.15/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch b/queue-5.15/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch new file mode 100644 index 00000000000..73447e4fbd1 --- /dev/null +++ b/queue-5.15/mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch @@ -0,0 +1,44 @@ +From d58156e8f6e721a1052e35194b3007b2bd559bc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:34:24 +0200 +Subject: mtd: core: Report error if first mtd_otp_size() call fails in + mtd_otp_nvmem_add() + +From: Aapo Vienamo + +[ Upstream commit d44f0bbbd8d182debcce88bda55b05269f3d33d6 ] + +Jump to the error reporting code in mtd_otp_nvmem_add() if the +mtd_otp_size() call fails. Without this fix, the error is not logged. + +Signed-off-by: Aapo Vienamo +Reviewed-by: Mika Westerberg +Reviewed-by: Michael Walle +Fixes: 4b361cfa8624 ("mtd: core: add OTP nvmem provider support") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240313173425.1325790-2-aapo.vienamo@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index 2a228ee32641c..16077e5a2df1c 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -886,8 +886,10 @@ static int mtd_otp_nvmem_add(struct mtd_info *mtd) + + if (mtd->_get_user_prot_info && mtd->_read_user_prot_reg) { + size = mtd_otp_size(mtd, true); +- if (size < 0) +- return size; ++ if (size < 0) { ++ err = size; ++ goto err; ++ } + + if (size > 0) { + nvmem = mtd_otp_nvmem_register(mtd, "user-otp", size, +-- +2.43.0 + diff --git a/queue-5.15/mtd-rawnand-hynix-fixed-typo.patch b/queue-5.15/mtd-rawnand-hynix-fixed-typo.patch new file mode 100644 index 00000000000..a770c58bc9f --- /dev/null +++ b/queue-5.15/mtd-rawnand-hynix-fixed-typo.patch @@ -0,0 +1,43 @@ +From 5f6ea90315cf12abbcd31b14cfa104e8545e3eab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 13:27:20 +0300 +Subject: mtd: rawnand: hynix: fixed typo + +From: Maxim Korotkov + +[ Upstream commit 6819db94e1cd3ce24a432f3616cd563ed0c4eaba ] + +The function hynix_nand_rr_init() should probably return an error code. +Judging by the usage, it seems that the return code is passed up +the call stack. +Right now, it always returns 0 and the function hynix_nand_cleanup() +in hynix_nand_init() has never been called. + +Found by RASU JSC and Linux Verification Center (linuxtesting.org) + +Fixes: 626994e07480 ("mtd: nand: hynix: Add read-retry support for 1x nm MLC NANDs") + +Signed-off-by: Maxim Korotkov +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240313102721.1991299-1-korotkov.maxim.s@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/nand_hynix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/nand_hynix.c b/drivers/mtd/nand/raw/nand_hynix.c +index a9f50c9af1097..856b3d6eceb73 100644 +--- a/drivers/mtd/nand/raw/nand_hynix.c ++++ b/drivers/mtd/nand/raw/nand_hynix.c +@@ -402,7 +402,7 @@ static int hynix_nand_rr_init(struct nand_chip *chip) + if (ret) + pr_warn("failed to initialize read-retry infrastructure"); + +- return 0; ++ return ret; + } + + static void hynix_nand_extract_oobsize(struct nand_chip *chip, +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch b/queue-5.15/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch new file mode 100644 index 00000000000..7bc91c31949 --- /dev/null +++ b/queue-5.15/net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch @@ -0,0 +1,234 @@ +From f0f7c88f81803c059d0d03b1ce8c15170fc7ca6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:47:48 +0200 +Subject: net: dsa: mv88e6xxx: Add support for model-specific pre- and + post-reset handlers + +From: Matthias Schiffer + +[ Upstream commit 0fdd27b9d6d7c60bd319d3497ad797934bab13cb ] + +Instead of calling mv88e6xxx_g2_eeprom_wait() directly from +mv88e6xxx_hardware_reset(), add configurable pre- and post-reset hard +reset handlers. Initially, the handlers are set to +mv88e6xxx_g2_eeprom_wait() for all families that have get/set_eeprom() +to match the existing behavior. No functional change intended (except +for additional error messages on failure). + +Fixes: 6ccf50d4d474 ("net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 50 +++++++++++++++++++++++++++++--- + drivers/net/dsa/mv88e6xxx/chip.h | 6 ++++ + 2 files changed, 52 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 3fc120802883a..7484ba387d771 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2585,6 +2585,7 @@ static int mv88e6xxx_software_reset(struct mv88e6xxx_chip *chip) + static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip) + { + struct gpio_desc *gpiod = chip->reset; ++ int err; + + /* If there is a GPIO connected to the reset pin, toggle it */ + if (gpiod) { +@@ -2593,17 +2594,26 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip) + * mid-byte, causing the first EEPROM read after the reset + * from the wrong location resulting in the switch booting + * to wrong mode and inoperable. ++ * For this reason, switch families with EEPROM support ++ * generally wait for EEPROM loads to complete as their pre- ++ * and post-reset handlers. + */ +- if (chip->info->ops->get_eeprom) +- mv88e6xxx_g2_eeprom_wait(chip); ++ if (chip->info->ops->hardware_reset_pre) { ++ err = chip->info->ops->hardware_reset_pre(chip); ++ if (err) ++ dev_err(chip->dev, "pre-reset error: %d\n", err); ++ } + + gpiod_set_value_cansleep(gpiod, 1); + usleep_range(10000, 20000); + gpiod_set_value_cansleep(gpiod, 0); + usleep_range(10000, 20000); + +- if (chip->info->ops->get_eeprom) +- mv88e6xxx_g2_eeprom_wait(chip); ++ if (chip->info->ops->hardware_reset_post) { ++ err = chip->info->ops->hardware_reset_post(chip); ++ if (err) ++ dev_err(chip->dev, "post-reset error: %d\n", err); ++ } + } + } + +@@ -3824,6 +3834,8 @@ static const struct mv88e6xxx_ops mv88e6141_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4006,6 +4018,8 @@ static const struct mv88e6xxx_ops mv88e6172_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4103,6 +4117,8 @@ static const struct mv88e6xxx_ops mv88e6176_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4201,6 +4217,8 @@ static const struct mv88e6xxx_ops mv88e6190_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4262,6 +4280,8 @@ static const struct mv88e6xxx_ops mv88e6190x_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4321,6 +4341,8 @@ static const struct mv88e6xxx_ops mv88e6191_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4383,6 +4405,8 @@ static const struct mv88e6xxx_ops mv88e6240_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4438,6 +4462,8 @@ static const struct mv88e6xxx_ops mv88e6250_ops = { + .watchdog_ops = &mv88e6250_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6250_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +@@ -4482,6 +4508,8 @@ static const struct mv88e6xxx_ops mv88e6290_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4543,6 +4571,8 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +@@ -4586,6 +4616,8 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { + .set_egress_port = mv88e6095_g1_set_egress_port, + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +@@ -4634,6 +4666,8 @@ static const struct mv88e6xxx_ops mv88e6341_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4784,6 +4818,8 @@ static const struct mv88e6xxx_ops mv88e6352_ops = { + .watchdog_ops = &mv88e6097_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4848,6 +4884,8 @@ static const struct mv88e6xxx_ops mv88e6390_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4913,6 +4951,8 @@ static const struct mv88e6xxx_ops mv88e6390x_ops = { + .watchdog_ops = &mv88e6390_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +@@ -4981,6 +5021,8 @@ static const struct mv88e6xxx_ops mv88e6393x_ops = { + .watchdog_ops = &mv88e6393x_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6393x_port_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, ++ .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, + .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, + .atu_get_hash = mv88e6165_g1_atu_get_hash, +diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h +index 6b7307edaf172..6b86e7645be60 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.h ++++ b/drivers/net/dsa/mv88e6xxx/chip.h +@@ -434,6 +434,12 @@ struct mv88e6xxx_ops { + int (*ppu_enable)(struct mv88e6xxx_chip *chip); + int (*ppu_disable)(struct mv88e6xxx_chip *chip); + ++ /* Additional handlers to run before and after hard reset, to make sure ++ * that the switch and EEPROM are in a good state. ++ */ ++ int (*hardware_reset_pre)(struct mv88e6xxx_chip *chip); ++ int (*hardware_reset_post)(struct mv88e6xxx_chip *chip); ++ + /* Switch Software Reset */ + int (*reset)(struct mv88e6xxx_chip *chip); + +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch b/queue-5.15/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch new file mode 100644 index 00000000000..efd17ece027 --- /dev/null +++ b/queue-5.15/net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch @@ -0,0 +1,173 @@ +From 0596cb44d45883553139bc49456afcb786ad8f5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:47:49 +0200 +Subject: net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on + 88E6250-family switches + +From: Matthias Schiffer + +[ Upstream commit e44894e2aa4eb311ceda134de8b6f51ff979211b ] + +88E6250-family switches have the quirk that the EEPROM Running flag can +get stuck at 1 when no EEPROM is connected, causing +mv88e6xxx_g2_eeprom_wait() to time out. We still want to wait for the +EEPROM however, to avoid interrupting a transfer and leaving the EEPROM +in an invalid state. + +The condition to wait for recommended by the hardware spec is the EEInt +flag, however this flag is cleared on read, so before the hardware reset, +is may have been cleared already even though the EEPROM has been read +successfully. + +For this reason, we revive the mv88e6xxx_g1_wait_eeprom_done() function +that was removed in commit 6ccf50d4d474 +("net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent") in a +slightly refactored form, and introduce a new +mv88e6xxx_g1_wait_eeprom_done_prereset() that additionally handles this +case by triggering another EEPROM reload that can be waited on. + +On other switch models without this quirk, mv88e6xxx_g2_eeprom_wait() is +kept, as it avoids the additional reload. + +Fixes: 6ccf50d4d474 ("net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- + drivers/net/dsa/mv88e6xxx/global1.c | 89 +++++++++++++++++++++++++++++ + drivers/net/dsa/mv88e6xxx/global1.h | 2 + + 3 files changed, 93 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 7484ba387d771..5ddd97f79e8e6 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -4462,8 +4462,8 @@ static const struct mv88e6xxx_ops mv88e6250_ops = { + .watchdog_ops = &mv88e6250_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, +- .hardware_reset_pre = mv88e6xxx_g2_eeprom_wait, +- .hardware_reset_post = mv88e6xxx_g2_eeprom_wait, ++ .hardware_reset_pre = mv88e6250_g1_wait_eeprom_done_prereset, ++ .hardware_reset_post = mv88e6xxx_g1_wait_eeprom_done, + .reset = mv88e6250_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index 964928285782c..83c6d1fab94ab 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -75,6 +75,95 @@ static int mv88e6xxx_g1_wait_init_ready(struct mv88e6xxx_chip *chip) + return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_STS, bit, 1); + } + ++static int mv88e6250_g1_eeprom_reload(struct mv88e6xxx_chip *chip) ++{ ++ /* MV88E6185_G1_CTL1_RELOAD_EEPROM is also valid for 88E6250 */ ++ int bit = __bf_shf(MV88E6185_G1_CTL1_RELOAD_EEPROM); ++ u16 val; ++ int err; ++ ++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &val); ++ if (err) ++ return err; ++ ++ val |= MV88E6185_G1_CTL1_RELOAD_EEPROM; ++ ++ err = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, val); ++ if (err) ++ return err; ++ ++ return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_CTL1, bit, 0); ++} ++ ++/* Returns 0 when done, -EBUSY when waiting, other negative codes on error */ ++static int mv88e6xxx_g1_is_eeprom_done(struct mv88e6xxx_chip *chip) ++{ ++ u16 val; ++ int err; ++ ++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &val); ++ if (err < 0) { ++ dev_err(chip->dev, "Error reading status"); ++ return err; ++ } ++ ++ /* If the switch is still resetting, it may not ++ * respond on the bus, and so MDIO read returns ++ * 0xffff. Differentiate between that, and waiting for ++ * the EEPROM to be done by bit 0 being set. ++ */ ++ if (val == 0xffff || !(val & BIT(MV88E6XXX_G1_STS_IRQ_EEPROM_DONE))) ++ return -EBUSY; ++ ++ return 0; ++} ++ ++/* As the EEInt (EEPROM done) flag clears on read if the status register, this ++ * function must be called directly after a hard reset or EEPROM ReLoad request, ++ * or the done condition may have been missed ++ */ ++int mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip) ++{ ++ const unsigned long timeout = jiffies + 1 * HZ; ++ int ret; ++ ++ /* Wait up to 1 second for the switch to finish reading the ++ * EEPROM. ++ */ ++ while (time_before(jiffies, timeout)) { ++ ret = mv88e6xxx_g1_is_eeprom_done(chip); ++ if (ret != -EBUSY) ++ return ret; ++ } ++ ++ dev_err(chip->dev, "Timeout waiting for EEPROM done"); ++ return -ETIMEDOUT; ++} ++ ++int mv88e6250_g1_wait_eeprom_done_prereset(struct mv88e6xxx_chip *chip) ++{ ++ int ret; ++ ++ ret = mv88e6xxx_g1_is_eeprom_done(chip); ++ if (ret != -EBUSY) ++ return ret; ++ ++ /* Pre-reset, we don't know the state of the switch - when ++ * mv88e6xxx_g1_is_eeprom_done() returns -EBUSY, that may be because ++ * the switch is actually busy reading the EEPROM, or because ++ * MV88E6XXX_G1_STS_IRQ_EEPROM_DONE has been cleared by an unrelated ++ * status register read already. ++ * ++ * To account for the latter case, trigger another EEPROM reload for ++ * another chance at seeing the done flag. ++ */ ++ ret = mv88e6250_g1_eeprom_reload(chip); ++ if (ret) ++ return ret; ++ ++ return mv88e6xxx_g1_wait_eeprom_done(chip); ++} ++ + /* Offset 0x01: Switch MAC Address Register Bytes 0 & 1 + * Offset 0x02: Switch MAC Address Register Bytes 2 & 3 + * Offset 0x03: Switch MAC Address Register Bytes 4 & 5 +diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h +index 6f41762eff3e6..92fcebade809f 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.h ++++ b/drivers/net/dsa/mv88e6xxx/global1.h +@@ -280,6 +280,8 @@ int mv88e6xxx_g1_set_switch_mac(struct mv88e6xxx_chip *chip, u8 *addr); + int mv88e6185_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6352_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6250_g1_reset(struct mv88e6xxx_chip *chip); ++int mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip); ++int mv88e6250_g1_wait_eeprom_done_prereset(struct mv88e6xxx_chip *chip); + + int mv88e6185_g1_ppu_enable(struct mv88e6xxx_chip *chip); + int mv88e6185_g1_ppu_disable(struct mv88e6xxx_chip *chip); +-- +2.43.0 + diff --git a/queue-5.15/net-ethernet-cortina-locking-fixes.patch b/queue-5.15/net-ethernet-cortina-locking-fixes.patch new file mode 100644 index 00000000000..da9155bbf39 --- /dev/null +++ b/queue-5.15/net-ethernet-cortina-locking-fixes.patch @@ -0,0 +1,86 @@ +From 041b83aaf7ea34f1637ed90cddf71c9142056207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 09:44:54 +0200 +Subject: net: ethernet: cortina: Locking fixes + +From: Linus Walleij + +[ Upstream commit 812552808f7ff71133fc59768cdc253c5b8ca1bf ] + +This fixes a probably long standing problem in the Cortina +Gemini ethernet driver: there are some paths in the code +where the IRQ registers are written without taking the proper +locks. + +Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") +Signed-off-by: Linus Walleij +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240509-gemini-ethernet-locking-v1-1-afd00a528b95@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 675c6dda45e24..0c8c92ff7704f 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -1108,10 +1108,13 @@ static void gmac_tx_irq_enable(struct net_device *netdev, + { + struct gemini_ethernet_port *port = netdev_priv(netdev); + struct gemini_ethernet *geth = port->geth; ++ unsigned long flags; + u32 val, mask; + + netdev_dbg(netdev, "%s device %d\n", __func__, netdev->dev_id); + ++ spin_lock_irqsave(&geth->irq_lock, flags); ++ + mask = GMAC0_IRQ0_TXQ0_INTS << (6 * netdev->dev_id + txq); + + if (en) +@@ -1120,6 +1123,8 @@ static void gmac_tx_irq_enable(struct net_device *netdev, + val = readl(geth->base + GLOBAL_INTERRUPT_ENABLE_0_REG); + val = en ? val | mask : val & ~mask; + writel(val, geth->base + GLOBAL_INTERRUPT_ENABLE_0_REG); ++ ++ spin_unlock_irqrestore(&geth->irq_lock, flags); + } + + static void gmac_tx_irq(struct net_device *netdev, unsigned int txq_num) +@@ -1426,15 +1431,19 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget) + union gmac_rxdesc_3 word3; + struct page *page = NULL; + unsigned int page_offs; ++ unsigned long flags; + unsigned short r, w; + union dma_rwptr rw; + dma_addr_t mapping; + int frag_nr = 0; + ++ spin_lock_irqsave(&geth->irq_lock, flags); + rw.bits32 = readl(ptr_reg); + /* Reset interrupt as all packages until here are taken into account */ + writel(DEFAULT_Q0_INT_BIT << netdev->dev_id, + geth->base + GLOBAL_INTERRUPT_STATUS_1_REG); ++ spin_unlock_irqrestore(&geth->irq_lock, flags); ++ + r = rw.bits.rptr; + w = rw.bits.wptr; + +@@ -1737,10 +1746,9 @@ static irqreturn_t gmac_irq(int irq, void *data) + gmac_update_hw_stats(netdev); + + if (val & (GMAC0_RX_OVERRUN_INT_BIT << (netdev->dev_id * 8))) { ++ spin_lock(&geth->irq_lock); + writel(GMAC0_RXDERR_INT_BIT << (netdev->dev_id * 8), + geth->base + GLOBAL_INTERRUPT_STATUS_4_REG); +- +- spin_lock(&geth->irq_lock); + u64_stats_update_begin(&port->ir_stats_syncp); + ++port->stats.rx_fifo_errors; + u64_stats_update_end(&port->ir_stats_syncp); +-- +2.43.0 + diff --git a/queue-5.15/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch b/queue-5.15/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch new file mode 100644 index 00000000000..909d5045da1 --- /dev/null +++ b/queue-5.15/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch @@ -0,0 +1,163 @@ +From 88000f32c608f9775ba444d929dbb67a3b53326c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:07 +0200 +Subject: net: export inet_lookup_reuseport and inet6_lookup_reuseport + +From: Lorenz Bauer + +[ Upstream commit ce796e60b3b196b61fcc565df195443cbb846ef0 ] + +Rename the existing reuseport helpers for IPv4 and IPv6 so that they +can be invoked in the follow up commit. Export them so that building +DCCP and IPv6 as a module works. + +No change in functionality. + +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-3-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Stable-dep-of: 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites") +Signed-off-by: Sasha Levin +--- + include/net/inet6_hashtables.h | 7 +++++++ + include/net/inet_hashtables.h | 5 +++++ + net/ipv4/inet_hashtables.c | 15 ++++++++------- + net/ipv6/inet6_hashtables.c | 19 ++++++++++--------- + 4 files changed, 30 insertions(+), 16 deletions(-) + +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index 56f1286583d3c..032ddab48f8f8 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -48,6 +48,13 @@ struct sock *__inet6_lookup_established(struct net *net, + const u16 hnum, const int dif, + const int sdif); + ++struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ const struct in6_addr *saddr, ++ __be16 sport, ++ const struct in6_addr *daddr, ++ unsigned short hnum); ++ + struct sock *inet6_lookup_listener(struct net *net, + struct inet_hashinfo *hashinfo, + struct sk_buff *skb, int doff, +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index a7a8e66a1bad0..1e81b130cfb0c 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -279,6 +279,11 @@ struct sock *__inet_lookup_established(struct net *net, + const __be32 daddr, const u16 hnum, + const int dif, const int sdif); + ++struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ __be32 saddr, __be16 sport, ++ __be32 daddr, unsigned short hnum); ++ + static inline struct sock * + inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo, + const __be32 saddr, const __be16 sport, +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index b4e0120af9c2b..34828b4488ce5 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -216,10 +216,10 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, int doff, +- __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum) ++struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ __be32 saddr, __be16 sport, ++ __be32 daddr, unsigned short hnum) + { + struct sock *reuse_sk = NULL; + u32 phash; +@@ -230,6 +230,7 @@ static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, + } + return reuse_sk; + } ++EXPORT_SYMBOL_GPL(inet_lookup_reuseport); + + /* + * Here are some nice properties to exploit here. The BSD API +@@ -253,8 +254,8 @@ static struct sock *inet_lhash2_lookup(struct net *net, + sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) { + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { +- result = lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ result = inet_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, hnum); + if (result) + return result; + +@@ -283,7 +284,7 @@ static inline struct sock *inet_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index c40cbdfc6247f..356455d557f4c 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -113,12 +113,12 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, int doff, +- const struct in6_addr *saddr, +- __be16 sport, +- const struct in6_addr *daddr, +- unsigned short hnum) ++struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ const struct in6_addr *saddr, ++ __be16 sport, ++ const struct in6_addr *daddr, ++ unsigned short hnum) + { + struct sock *reuse_sk = NULL; + u32 phash; +@@ -129,6 +129,7 @@ static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, + } + return reuse_sk; + } ++EXPORT_SYMBOL_GPL(inet6_lookup_reuseport); + + /* called with rcu_read_lock() */ + static struct sock *inet6_lhash2_lookup(struct net *net, +@@ -145,8 +146,8 @@ static struct sock *inet6_lhash2_lookup(struct net *net, + sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) { + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { +- result = lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ result = inet6_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, hnum); + if (result) + return result; + +@@ -177,7 +178,7 @@ static inline struct sock *inet6_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); + if (reuse_sk) + sk = reuse_sk; + return sk; +-- +2.43.0 + diff --git a/queue-5.15/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch b/queue-5.15/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch new file mode 100644 index 00000000000..f4f17936c73 --- /dev/null +++ b/queue-5.15/net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch @@ -0,0 +1,54 @@ +From 83963a70e0b1ed2053a4fbb6e5e94e232bd865e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 06:42:22 +0000 +Subject: net: give more chances to rcu in netdev_wait_allrefs_any() + +From: Eric Dumazet + +[ Upstream commit cd42ba1c8ac9deb9032add6adf491110e7442040 ] + +This came while reviewing commit c4e86b4363ac ("net: add two more +call_rcu_hurry()"). + +Paolo asked if adding one synchronize_rcu() would help. + +While synchronize_rcu() does not help, making sure to call +rcu_barrier() before msleep(wait) is definitely helping +to make sure lazy call_rcu() are completed. + +Instead of waiting ~100 seconds in my tests, the ref_tracker +splats occurs one time only, and netdev_wait_allrefs_any() +latency is reduced to the strict minimum. + +Ideally we should audit our call_rcu() users to make sure +no refcount (or cascading call_rcu()) is held too long, +because rcu_barrier() is quite expensive. + +Fixes: 0e4be9e57e8c ("net: use exponential backoff in netdev_wait_allrefs") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/all/28bbf698-befb-42f6-b561-851c67f464aa@kernel.org/T/#m76d73ed6b03cd930778ac4d20a777f22a08d6824 +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index f80bc2ca888aa..e86ef1a1647ec 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10549,8 +10549,9 @@ static void netdev_wait_allrefs(struct net_device *dev) + rebroadcast_time = jiffies; + } + ++ rcu_barrier(); ++ + if (!wait) { +- rcu_barrier(); + wait = WAIT_REFS_MIN_MSECS; + } else { + msleep(wait); +-- +2.43.0 + diff --git a/queue-5.15/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch b/queue-5.15/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch new file mode 100644 index 00000000000..175b08d8fe5 --- /dev/null +++ b/queue-5.15/net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch @@ -0,0 +1,41 @@ +From 96b61742df384cc038b3cca607eed68c01cc9013 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:19:17 +0800 +Subject: net: ipv6: fix wrong start position when receive hop-by-hop fragment + +From: gaoxingwang + +[ Upstream commit 1cd354fe1e4864eeaff62f66ee513080ec946f20 ] + +In IPv6, ipv6_rcv_core will parse the hop-by-hop type extension header and increase skb->transport_header by one extension header length. +But if there are more other extension headers like fragment header at this time, the skb->transport_header points to the second extension header, +not the transport layer header or the first extension header. + +This will result in the start and nexthdrp variable not pointing to the same position in ipv6frag_thdr_trunced, +and ipv6_skip_exthdr returning incorrect offset and frag_off.Sometimes,the length of the last sharded packet is smaller than the calculated incorrect offset, resulting in packet loss. +We can use network header to offset and calculate the correct position to solve this problem. + +Fixes: 9d9e937b1c8b (ipv6/netfilter: Discard first fragment not including all headers) +Signed-off-by: Gao Xingwang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/reassembly.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c +index 28e44782c94d1..6993675171556 100644 +--- a/net/ipv6/reassembly.c ++++ b/net/ipv6/reassembly.c +@@ -363,7 +363,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) + * the source of the fragment, with the Pointer field set to zero. + */ + nexthdr = hdr->nexthdr; +- if (ipv6frag_thdr_truncated(skb, skb_transport_offset(skb), &nexthdr)) { ++ if (ipv6frag_thdr_truncated(skb, skb_network_offset(skb) + sizeof(struct ipv6hdr), &nexthdr)) { + __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev), + IPSTATS_MIB_INHDRERRORS); + icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0); +-- +2.43.0 + diff --git a/queue-5.15/net-mlx5-discard-command-completions-in-internal-err.patch b/queue-5.15/net-mlx5-discard-command-completions-in-internal-err.patch new file mode 100644 index 00000000000..65fd972efb7 --- /dev/null +++ b/queue-5.15/net-mlx5-discard-command-completions-in-internal-err.patch @@ -0,0 +1,75 @@ +From 2c49efc47253fc911cc044c82036d4cbe7c5405c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 14:29:51 +0300 +Subject: net/mlx5: Discard command completions in internal error + +From: Akiva Goldberger + +[ Upstream commit db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 ] + +Fix use after free when FW completion arrives while device is in +internal error state. Avoid calling completion handler in this case, +since the device will flush the command interface and trigger all +completions manually. + +Kernel log: +------------[ cut here ]------------ +refcount_t: underflow; use-after-free. +... +RIP: 0010:refcount_warn_saturate+0xd8/0xe0 +... +Call Trace: + +? __warn+0x79/0x120 +? refcount_warn_saturate+0xd8/0xe0 +? report_bug+0x17c/0x190 +? handle_bug+0x3c/0x60 +? exc_invalid_op+0x14/0x70 +? asm_exc_invalid_op+0x16/0x20 +? refcount_warn_saturate+0xd8/0xe0 +cmd_ent_put+0x13b/0x160 [mlx5_core] +mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] +cmd_comp_notifier+0x1f/0x30 [mlx5_core] +notifier_call_chain+0x35/0xb0 +atomic_notifier_call_chain+0x16/0x20 +mlx5_eq_async_int+0xf6/0x290 [mlx5_core] +notifier_call_chain+0x35/0xb0 +atomic_notifier_call_chain+0x16/0x20 +irq_int_handler+0x19/0x30 [mlx5_core] +__handle_irq_event_percpu+0x4b/0x160 +handle_irq_event+0x2e/0x80 +handle_edge_irq+0x98/0x230 +__common_interrupt+0x3b/0xa0 +common_interrupt+0x7b/0xa0 + + +asm_common_interrupt+0x22/0x40 + +Fixes: 51d138c2610a ("net/mlx5: Fix health error state handling") +Signed-off-by: Akiva Goldberger +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20240509112951.590184-6-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 8d5dd8aba8cd4..81e517dbe60e9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -1535,6 +1535,9 @@ static int cmd_comp_notifier(struct notifier_block *nb, + dev = container_of(cmd, struct mlx5_core_dev, cmd); + eqe = data; + ++ if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) ++ return NOTIFY_DONE; ++ + mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false); + + return NOTIFY_OK; +-- +2.43.0 + diff --git a/queue-5.15/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch b/queue-5.15/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch new file mode 100644 index 00000000000..cf2d3d07a9a --- /dev/null +++ b/queue-5.15/net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch @@ -0,0 +1,86 @@ +From 690330318e3454a055cb7bca8c0e511ce7427c70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 11:38:05 +0200 +Subject: net: openvswitch: fix overwriting ct original tuple for ICMPv6 + +From: Ilya Maximets + +[ Upstream commit 7c988176b6c16c516474f6fceebe0f055af5eb56 ] + +OVS_PACKET_CMD_EXECUTE has 3 main attributes: + - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. + - OVS_PACKET_ATTR_PACKET - Binary packet content. + - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. + +OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure +with the metadata like conntrack state, input port, recirculation id, +etc. Then the packet itself gets parsed to populate the rest of the +keys from the packet headers. + +Whenever the packet parsing code starts parsing the ICMPv6 header, it +first zeroes out fields in the key corresponding to Neighbor Discovery +information even if it is not an ND packet. + +It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares +the space between 'nd' and 'ct_orig' that holds the original tuple +conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. + +ND packets should not normally have conntrack state, so it's fine to +share the space, but normal ICMPv6 Echo packets or maybe other types of +ICMPv6 can have the state attached and it should not be overwritten. + +The issue results in all but the last 4 bytes of the destination +address being wiped from the original conntrack tuple leading to +incorrect packet matching and potentially executing wrong actions +in case this packet recirculates within the datapath or goes back +to userspace. + +ND fields should not be accessed in non-ND packets, so not clearing +them should be fine. Executing memset() only for actual ND packets to +avoid the issue. + +Initializing the whole thing before parsing is needed because ND packet +may not contain all the options. + +The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't +affect packets entering OVS datapath from network interfaces, because +in this case CT metadata is populated from skb after the packet is +already parsed. + +Fixes: 9dd7f8907c37 ("openvswitch: Add original direction conntrack tuple to sw_flow_key.") +Reported-by: Antonin Bas +Closes: https://github.com/openvswitch/ovs-issues/issues/327 +Signed-off-by: Ilya Maximets +Acked-by: Aaron Conole +Acked-by: Eelco Chaudron +Link: https://lore.kernel.org/r/20240509094228.1035477-1-i.maximets@ovn.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/flow.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c +index 1b81d71bac3cf..209b42cf5aeaf 100644 +--- a/net/openvswitch/flow.c ++++ b/net/openvswitch/flow.c +@@ -417,7 +417,6 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, + */ + key->tp.src = htons(icmp->icmp6_type); + key->tp.dst = htons(icmp->icmp6_code); +- memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); + + if (icmp->icmp6_code == 0 && + (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION || +@@ -426,6 +425,8 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, + struct nd_msg *nd; + int offset; + ++ memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); ++ + /* In order to process neighbor discovery options, we need the + * entire packet. + */ +-- +2.43.0 + diff --git a/queue-5.15/net-qrtr-ns-fix-module-refcnt.patch b/queue-5.15/net-qrtr-ns-fix-module-refcnt.patch new file mode 100644 index 00000000000..36602d3e8ad --- /dev/null +++ b/queue-5.15/net-qrtr-ns-fix-module-refcnt.patch @@ -0,0 +1,83 @@ +From 2308f3449d621cc59477eac0a1c7e9643e025084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 10:31:46 -0700 +Subject: net: qrtr: ns: Fix module refcnt + +From: Chris Lew + +[ Upstream commit fd76e5ccc48f9f54eb44909dd7c0b924005f1582 ] + +The qrtr protocol core logic and the qrtr nameservice are combined into +a single module. Neither the core logic or nameservice provide much +functionality by themselves; combining the two into a single module also +prevents any possible issues that may stem from client modules loading +inbetween qrtr and the ns. + +Creating a socket takes two references to the module that owns the +socket protocol. Since the ns needs to create the control socket, this +creates a scenario where there are always two references to the qrtr +module. This prevents the execution of 'rmmod' for qrtr. + +To resolve this, forcefully put the module refcount for the socket +opened by the nameservice. + +Fixes: a365023a76f2 ("net: qrtr: combine nameservice into main module") +Reported-by: Jeffrey Hugo +Tested-by: Jeffrey Hugo +Signed-off-by: Chris Lew +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Jeffrey Hugo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/ns.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index 4a13b9f7abb44..3c513e7ca2d5c 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -807,6 +807,24 @@ int qrtr_ns_init(void) + if (ret < 0) + goto err_wq; + ++ /* As the qrtr ns socket owner and creator is the same module, we have ++ * to decrease the qrtr module reference count to guarantee that it ++ * remains zero after the ns socket is created, otherwise, executing ++ * "rmmod" command is unable to make the qrtr module deleted after the ++ * qrtr module is inserted successfully. ++ * ++ * However, the reference count is increased twice in ++ * sock_create_kern(): one is to increase the reference count of owner ++ * of qrtr socket's proto_ops struct; another is to increment the ++ * reference count of owner of qrtr proto struct. Therefore, we must ++ * decrement the module reference count twice to ensure that it keeps ++ * zero after server's listening socket is created. Of course, we ++ * must bump the module reference count twice as well before the socket ++ * is closed. ++ */ ++ module_put(qrtr_ns.sock->ops->owner); ++ module_put(qrtr_ns.sock->sk->sk_prot_creator->owner); ++ + return 0; + + err_wq: +@@ -821,6 +839,15 @@ void qrtr_ns_remove(void) + { + cancel_work_sync(&qrtr_ns.work); + destroy_workqueue(qrtr_ns.workqueue); ++ ++ /* sock_release() expects the two references that were put during ++ * qrtr_ns_init(). This function is only called during module remove, ++ * so try_stop_module() has already set the refcnt to 0. Use ++ * __module_get() instead of try_module_get() to successfully take two ++ * references. ++ */ ++ __module_get(qrtr_ns.sock->ops->owner); ++ __module_get(qrtr_ns.sock->sk->sk_prot_creator->owner); + sock_release(qrtr_ns.sock); + } + EXPORT_SYMBOL_GPL(qrtr_ns_remove); +-- +2.43.0 + diff --git a/queue-5.15/net-remove-duplicate-reuseport_lookup-functions.patch b/queue-5.15/net-remove-duplicate-reuseport_lookup-functions.patch new file mode 100644 index 00000000000..f7463195ed0 --- /dev/null +++ b/queue-5.15/net-remove-duplicate-reuseport_lookup-functions.patch @@ -0,0 +1,365 @@ +From e703a941d1194674332a7a3eb0d8d202ff9ea1a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:08 +0200 +Subject: net: remove duplicate reuseport_lookup functions + +From: Lorenz Bauer + +[ Upstream commit 0f495f7617229772403e683033abc473f0f0553c ] + +There are currently four copies of reuseport_lookup: one each for +(TCP, UDP)x(IPv4, IPv6). This forces us to duplicate all callers of +those functions as well. This is already the case for sk_lookup +helpers (inet,inet6,udp4,udp6)_lookup_run_bpf. + +There are two differences between the reuseport_lookup helpers: + +1. They call different hash functions depending on protocol +2. UDP reuseport_lookup checks that sk_state != TCP_ESTABLISHED + +Move the check for sk_state into the caller and use the INDIRECT_CALL +infrastructure to cut down the helpers to one per IP version. + +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-4-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Stable-dep-of: 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites") +Signed-off-by: Sasha Levin +--- + include/net/inet6_hashtables.h | 11 ++++++++- + include/net/inet_hashtables.h | 15 ++++++++----- + net/ipv4/inet_hashtables.c | 20 +++++++++++------ + net/ipv4/udp.c | 34 +++++++++++----------------- + net/ipv6/inet6_hashtables.c | 14 ++++++++---- + net/ipv6/udp.c | 41 +++++++++++++--------------------- + 6 files changed, 72 insertions(+), 63 deletions(-) + +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index 032ddab48f8f8..f89320b6fee31 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -48,12 +48,21 @@ struct sock *__inet6_lookup_established(struct net *net, + const u16 hnum, const int dif, + const int sdif); + ++typedef u32 (inet6_ehashfn_t)(const struct net *net, ++ const struct in6_addr *laddr, const u16 lport, ++ const struct in6_addr *faddr, const __be16 fport); ++ ++inet6_ehashfn_t inet6_ehashfn; ++ ++INDIRECT_CALLABLE_DECLARE(inet6_ehashfn_t udp6_ehashfn); ++ + struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + const struct in6_addr *saddr, + __be16 sport, + const struct in6_addr *daddr, +- unsigned short hnum); ++ unsigned short hnum, ++ inet6_ehashfn_t *ehashfn); + + struct sock *inet6_lookup_listener(struct net *net, + struct inet_hashinfo *hashinfo, +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index 1e81b130cfb0c..5849f816402dc 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -279,10 +279,19 @@ struct sock *__inet_lookup_established(struct net *net, + const __be32 daddr, const u16 hnum, + const int dif, const int sdif); + ++typedef u32 (inet_ehashfn_t)(const struct net *net, ++ const __be32 laddr, const __u16 lport, ++ const __be32 faddr, const __be16 fport); ++ ++inet_ehashfn_t inet_ehashfn; ++ ++INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); ++ + struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum); ++ __be32 daddr, unsigned short hnum, ++ inet_ehashfn_t *ehashfn); + + static inline struct sock * + inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo, +@@ -353,10 +362,6 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo, + refcounted); + } + +-u32 inet6_ehashfn(const struct net *net, +- const struct in6_addr *laddr, const u16 lport, +- const struct in6_addr *faddr, const __be16 fport); +- + static inline void sk_daddr_set(struct sock *sk, __be32 addr) + { + sk->sk_daddr = addr; /* alias of inet_daddr */ +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 34828b4488ce5..a2ab164e815a6 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -28,9 +28,9 @@ + #include + #include + +-static u32 inet_ehashfn(const struct net *net, const __be32 laddr, +- const __u16 lport, const __be32 faddr, +- const __be16 fport) ++u32 inet_ehashfn(const struct net *net, const __be32 laddr, ++ const __u16 lport, const __be32 faddr, ++ const __be16 fport) + { + static u32 inet_ehash_secret __read_mostly; + +@@ -39,6 +39,7 @@ static u32 inet_ehashfn(const struct net *net, const __be32 laddr, + return __inet_ehashfn(laddr, lport, faddr, fport, + inet_ehash_secret + net_hash_mix(net)); + } ++EXPORT_SYMBOL_GPL(inet_ehashfn); + + /* This function handles inet_sock, but also timewait and request sockets + * for IPv4/IPv6. +@@ -216,16 +217,20 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + ++INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); ++ + struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum) ++ __be32 daddr, unsigned short hnum, ++ inet_ehashfn_t *ehashfn) + { + struct sock *reuse_sk = NULL; + u32 phash; + + if (sk->sk_reuseport) { +- phash = inet_ehashfn(net, daddr, hnum, saddr, sport); ++ phash = INDIRECT_CALL_2(ehashfn, udp_ehashfn, inet_ehashfn, ++ net, daddr, hnum, saddr, sport); + reuse_sk = reuseport_select_sock(sk, phash, skb, doff); + } + return reuse_sk; +@@ -255,7 +260,7 @@ static struct sock *inet_lhash2_lookup(struct net *net, + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { + result = inet_lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ saddr, sport, daddr, hnum, inet_ehashfn); + if (result) + return result; + +@@ -284,7 +289,8 @@ static inline struct sock *inet_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum, ++ inet_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index d0387e5eee5b5..a2e5c6776966e 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -398,9 +398,9 @@ static int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static u32 udp_ehashfn(const struct net *net, const __be32 laddr, +- const __u16 lport, const __be32 faddr, +- const __be16 fport) ++INDIRECT_CALLABLE_SCOPE ++u32 udp_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, ++ const __be32 faddr, const __be16 fport) + { + static u32 udp_ehash_secret __read_mostly; + +@@ -410,22 +410,6 @@ static u32 udp_ehashfn(const struct net *net, const __be32 laddr, + udp_ehash_secret + net_hash_mix(net)); + } + +-static struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, +- __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum) +-{ +- struct sock *reuse_sk = NULL; +- u32 hash; +- +- if (sk->sk_reuseport && sk->sk_state != TCP_ESTABLISHED) { +- hash = udp_ehashfn(net, daddr, hnum, saddr, sport); +- reuse_sk = reuseport_select_sock(sk, hash, skb, +- sizeof(struct udphdr)); +- } +- return reuse_sk; +-} +- + /* called with rcu_read_lock() */ + static struct sock *udp4_lib_lookup2(struct net *net, + __be32 saddr, __be16 sport, +@@ -444,7 +428,14 @@ static struct sock *udp4_lib_lookup2(struct net *net, + daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; +- result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ ++ if (sk->sk_state == TCP_ESTABLISHED) { ++ result = sk; ++ continue; ++ } ++ ++ result = inet_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp_ehashfn); + if (!result) { + result = sk; + continue; +@@ -483,7 +474,8 @@ static struct sock *udp4_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index 356455d557f4c..869173f176ccb 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -41,6 +41,7 @@ u32 inet6_ehashfn(const struct net *net, + return __inet6_ehashfn(lhash, lport, fhash, fport, + inet6_ehash_secret + net_hash_mix(net)); + } ++EXPORT_SYMBOL_GPL(inet6_ehashfn); + + /* + * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so +@@ -113,18 +114,22 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + ++INDIRECT_CALLABLE_DECLARE(inet6_ehashfn_t udp6_ehashfn); ++ + struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + const struct in6_addr *saddr, + __be16 sport, + const struct in6_addr *daddr, +- unsigned short hnum) ++ unsigned short hnum, ++ inet6_ehashfn_t *ehashfn) + { + struct sock *reuse_sk = NULL; + u32 phash; + + if (sk->sk_reuseport) { +- phash = inet6_ehashfn(net, daddr, hnum, saddr, sport); ++ phash = INDIRECT_CALL_INET(ehashfn, udp6_ehashfn, inet6_ehashfn, ++ net, daddr, hnum, saddr, sport); + reuse_sk = reuseport_select_sock(sk, phash, skb, doff); + } + return reuse_sk; +@@ -147,7 +152,7 @@ static struct sock *inet6_lhash2_lookup(struct net *net, + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { + result = inet6_lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ saddr, sport, daddr, hnum, inet6_ehashfn); + if (result) + return result; + +@@ -178,7 +183,8 @@ static inline struct sock *inet6_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, hnum, inet6_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 256de135191f8..0a7f716a0aea3 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -68,11 +68,12 @@ int udpv6_init_sock(struct sock *sk) + return 0; + } + +-static u32 udp6_ehashfn(const struct net *net, +- const struct in6_addr *laddr, +- const u16 lport, +- const struct in6_addr *faddr, +- const __be16 fport) ++INDIRECT_CALLABLE_SCOPE ++u32 udp6_ehashfn(const struct net *net, ++ const struct in6_addr *laddr, ++ const u16 lport, ++ const struct in6_addr *faddr, ++ const __be16 fport) + { + static u32 udp6_ehash_secret __read_mostly; + static u32 udp_ipv6_hash_secret __read_mostly; +@@ -156,24 +157,6 @@ static int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, +- const struct in6_addr *saddr, +- __be16 sport, +- const struct in6_addr *daddr, +- unsigned int hnum) +-{ +- struct sock *reuse_sk = NULL; +- u32 hash; +- +- if (sk->sk_reuseport && sk->sk_state != TCP_ESTABLISHED) { +- hash = udp6_ehashfn(net, daddr, hnum, saddr, sport); +- reuse_sk = reuseport_select_sock(sk, hash, skb, +- sizeof(struct udphdr)); +- } +- return reuse_sk; +-} +- + /* called with rcu_read_lock() */ + static struct sock *udp6_lib_lookup2(struct net *net, + const struct in6_addr *saddr, __be16 sport, +@@ -191,7 +174,14 @@ static struct sock *udp6_lib_lookup2(struct net *net, + daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; +- result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ ++ if (sk->sk_state == TCP_ESTABLISHED) { ++ result = sk; ++ continue; ++ } ++ ++ result = inet6_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp6_ehashfn); + if (!result) { + result = sk; + continue; +@@ -231,7 +221,8 @@ static inline struct sock *udp6_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp6_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +-- +2.43.0 + diff --git a/queue-5.15/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch b/queue-5.15/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch new file mode 100644 index 00000000000..38029c2e268 --- /dev/null +++ b/queue-5.15/net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch @@ -0,0 +1,108 @@ +From dd33fdf03b600bbeff79b7ef44c558dfcdcbace6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 13:12:07 +0200 +Subject: net: usb: qmi_wwan: add Telit FN920C04 compositions + +From: Daniele Palmas + +[ Upstream commit 0b8fe5bd73249dc20be2e88a12041f8920797b59 ] + +Add the following Telit FN920C04 compositions: + +0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a4 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a9 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 89e1fac07a255..9bd145732e58b 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1362,6 +1362,9 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +-- +2.43.0 + diff --git a/queue-5.15/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch b/queue-5.15/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..20edd689c9a --- /dev/null +++ b/queue-5.15/net-usb-smsc95xx-stop-lying-about-skb-truesize.patch @@ -0,0 +1,87 @@ +From 342f8370a8a082cd6c25840ff43d3d20fd6d11f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 08:33:13 +0000 +Subject: net: usb: smsc95xx: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit d50729f1d60bca822ef6d9c1a5fb28d486bd7593 ] + +Some usb drivers try to set small skb->truesize and break +core networking stacks. + +In this patch, I removed one of the skb->truesize override. + +I also replaced one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a: +stop lying about skb->truesize") + +v3: also fix a sparse error ( https://lore.kernel.org/oe-kbuild-all/202405091310.KvncIecx-lkp@intel.com/ ) +v2: leave the skb_trim() game because smsc95xx_rx_csum_offload() + needs the csum part. (Jakub) + While we are it, use get_unaligned() in smsc95xx_rx_csum_offload(). + +Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") +Signed-off-by: Eric Dumazet +Cc: Steve Glendinning +Cc: UNGLinuxDriver@microchip.com +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240509083313.2113832-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 5f962f58ff496..10fae3989fbdb 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1785,9 +1785,11 @@ static int smsc95xx_reset_resume(struct usb_interface *intf) + + static void smsc95xx_rx_csum_offload(struct sk_buff *skb) + { +- skb->csum = *(u16 *)(skb_tail_pointer(skb) - 2); ++ u16 *csum_ptr = (u16 *)(skb_tail_pointer(skb) - 2); ++ ++ skb->csum = (__force __wsum)get_unaligned(csum_ptr); + skb->ip_summed = CHECKSUM_COMPLETE; +- skb_trim(skb, skb->len - 2); ++ skb_trim(skb, skb->len - 2); /* remove csum */ + } + + static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) +@@ -1845,25 +1847,22 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + if (dev->net->features & NETIF_F_RXCSUM) + smsc95xx_rx_csum_offload(skb); + skb_trim(skb, skb->len - 4); /* remove fcs */ +- skb->truesize = size + sizeof(struct sk_buff); + + return 1; + } + +- ax_skb = skb_clone(skb, GFP_ATOMIC); ++ ax_skb = netdev_alloc_skb_ip_align(dev->net, size); + if (unlikely(!ax_skb)) { + netdev_warn(dev->net, "Error allocating skb\n"); + return 0; + } + +- ax_skb->len = size; +- ax_skb->data = packet; +- skb_set_tail_pointer(ax_skb, size); ++ skb_put(ax_skb, size); ++ memcpy(ax_skb->data, packet, size); + + if (dev->net->features & NETIF_F_RXCSUM) + smsc95xx_rx_csum_offload(ax_skb); + skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */ +- ax_skb->truesize = size + sizeof(struct sk_buff); + + usbnet_skb_return(dev, ax_skb); + } +-- +2.43.0 + diff --git a/queue-5.15/net-usb-sr9700-stop-lying-about-skb-truesize.patch b/queue-5.15/net-usb-sr9700-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..75ef70cf3b6 --- /dev/null +++ b/queue-5.15/net-usb-sr9700-stop-lying-about-skb-truesize.patch @@ -0,0 +1,59 @@ +From b468e60a4bce926b608c03df75f34610453d74ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 14:39:39 +0000 +Subject: net: usb: sr9700: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit 05417aa9c0c038da2464a0c504b9d4f99814a23b ] + +Some usb drivers set small skb->truesize and break +core networking stacks. + +In this patch, I removed one of the skb->truesize override. + +I also replaced one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a: +stop lying about skb->truesize") + +Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240506143939.3673865-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/sr9700.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 279a540aef107..1c4a4bd46be64 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -419,19 +419,15 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + skb_pull(skb, 3); + skb->len = len; + skb_set_tail_pointer(skb, len); +- skb->truesize = len + sizeof(struct sk_buff); + return 2; + } + +- /* skb_clone is used for address align */ +- sr_skb = skb_clone(skb, GFP_ATOMIC); ++ sr_skb = netdev_alloc_skb_ip_align(dev->net, len); + if (!sr_skb) + return 0; + +- sr_skb->len = len; +- sr_skb->data = skb->data + 3; +- skb_set_tail_pointer(sr_skb, len); +- sr_skb->truesize = len + sizeof(struct sk_buff); ++ skb_put(sr_skb, len); ++ memcpy(sr_skb->data, skb->data + 3, len); + usbnet_skb_return(dev, sr_skb); + + skb_pull(skb, len + SR_RX_OVERHEAD); +-- +2.43.0 + diff --git a/queue-5.15/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch b/queue-5.15/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch new file mode 100644 index 00000000000..235073e50b8 --- /dev/null +++ b/queue-5.15/netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch @@ -0,0 +1,192 @@ +From 13714b594c28e20e6ecad8351778cdf64161019d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 14:29:34 +0000 +Subject: netrom: fix possible dead-lock in nr_rt_ioctl() + +From: Eric Dumazet + +[ Upstream commit e03e7f20ebf7e1611d40d1fdc1bde900fd3335f6 ] + +syzbot loves netrom, and found a possible deadlock in nr_rt_ioctl [1] + +Make sure we always acquire nr_node_list_lock before nr_node_lock(nr_node) + +[1] +WARNING: possible circular locking dependency detected +6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 Not tainted +------------------------------------------------------ +syz-executor350/5129 is trying to acquire lock: + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_node_lock include/net/netrom.h:152 [inline] + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:464 [inline] + ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 + +but task is already holding lock: + ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline] + ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (nr_node_list_lock){+...}-{2:2}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] + _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:356 [inline] + nr_remove_node net/netrom/nr_route.c:299 [inline] + nr_del_node+0x4b4/0x820 net/netrom/nr_route.c:355 + nr_rt_ioctl+0xa95/0x1090 net/netrom/nr_route.c:683 + sock_do_ioctl+0x158/0x460 net/socket.c:1222 + sock_ioctl+0x629/0x8e0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (&nr_node->node_lock){+...}-{2:2}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] + _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:356 [inline] + nr_node_lock include/net/netrom.h:152 [inline] + nr_dec_obs net/netrom/nr_route.c:464 [inline] + nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 + sock_do_ioctl+0x158/0x460 net/socket.c:1222 + sock_ioctl+0x629/0x8e0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(nr_node_list_lock); + lock(&nr_node->node_lock); + lock(nr_node_list_lock); + lock(&nr_node->node_lock); + + *** DEADLOCK *** + +1 lock held by syz-executor350/5129: + #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline] + #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697 + +stack backtrace: +CPU: 0 PID: 5129 Comm: syz-executor350 Not tainted 6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] + _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:356 [inline] + nr_node_lock include/net/netrom.h:152 [inline] + nr_dec_obs net/netrom/nr_route.c:464 [inline] + nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 + sock_do_ioctl+0x158/0x460 net/socket.c:1222 + sock_ioctl+0x629/0x8e0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:904 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240515142934.3708038-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index 983c5ad9724f1..dc39ae20c6aa6 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -285,22 +285,14 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic, + return 0; + } + +-static inline void __nr_remove_node(struct nr_node *nr_node) ++static void nr_remove_node_locked(struct nr_node *nr_node) + { ++ lockdep_assert_held(&nr_node_list_lock); ++ + hlist_del_init(&nr_node->node_node); + nr_node_put(nr_node); + } + +-#define nr_remove_node_locked(__node) \ +- __nr_remove_node(__node) +- +-static void nr_remove_node(struct nr_node *nr_node) +-{ +- spin_lock_bh(&nr_node_list_lock); +- __nr_remove_node(nr_node); +- spin_unlock_bh(&nr_node_list_lock); +-} +- + static inline void __nr_remove_neigh(struct nr_neigh *nr_neigh) + { + hlist_del_init(&nr_neigh->neigh_node); +@@ -339,6 +331,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n + return -EINVAL; + } + ++ spin_lock_bh(&nr_node_list_lock); + nr_node_lock(nr_node); + for (i = 0; i < nr_node->count; i++) { + if (nr_node->routes[i].neighbour == nr_neigh) { +@@ -352,7 +345,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n + nr_node->count--; + + if (nr_node->count == 0) { +- nr_remove_node(nr_node); ++ nr_remove_node_locked(nr_node); + } else { + switch (i) { + case 0: +@@ -367,12 +360,14 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n + nr_node_put(nr_node); + } + nr_node_unlock(nr_node); ++ spin_unlock_bh(&nr_node_list_lock); + + return 0; + } + } + nr_neigh_put(nr_neigh); + nr_node_unlock(nr_node); ++ spin_unlock_bh(&nr_node_list_lock); + nr_node_put(nr_node); + + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.15/nilfs2-fix-out-of-range-warning.patch b/queue-5.15/nilfs2-fix-out-of-range-warning.patch new file mode 100644 index 00000000000..dc2c346df63 --- /dev/null +++ b/queue-5.15/nilfs2-fix-out-of-range-warning.patch @@ -0,0 +1,45 @@ +From 7ee3af298cefc8ad14590b137b477ad96c66986d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 15:30:44 +0100 +Subject: nilfs2: fix out-of-range warning + +From: Arnd Bergmann + +[ Upstream commit c473bcdd80d4ab2ae79a7a509a6712818366e32a ] + +clang-14 points out that v_size is always smaller than a 64KB +page size if that is configured by the CPU architecture: + +fs/nilfs2/ioctl.c:63:19: error: result of comparison of constant 65536 with expression of type '__u16' (aka 'unsigned short') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + if (argv->v_size > PAGE_SIZE) + ~~~~~~~~~~~~ ^ ~~~~~~~~~ + +This is ok, so just shut up that warning with a cast. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240328143051.1069575-7-arnd@kernel.org +Fixes: 3358b4aaa84f ("nilfs2: fix problems of memory allocation in ioctl") +Acked-by: Ryusuke Konishi +Reviewed-by: Justin Stitt +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/nilfs2/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c +index a39206705dd12..6a2f779e0bad4 100644 +--- a/fs/nilfs2/ioctl.c ++++ b/fs/nilfs2/ioctl.c +@@ -60,7 +60,7 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs, + if (argv->v_nmembs == 0) + return 0; + +- if (argv->v_size > PAGE_SIZE) ++ if ((size_t)argv->v_size > PAGE_SIZE) + return -EINVAL; + + /* +-- +2.43.0 + diff --git a/queue-5.15/null_blk-fix-missing-mutex_destroy-at-module-removal.patch b/queue-5.15/null_blk-fix-missing-mutex_destroy-at-module-removal.patch new file mode 100644 index 00000000000..f88bef04345 --- /dev/null +++ b/queue-5.15/null_blk-fix-missing-mutex_destroy-at-module-removal.patch @@ -0,0 +1,37 @@ +From 621ed8fc3972f3bb7b7ec25ed31225db6f0d31a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 19:16:35 +0200 +Subject: null_blk: Fix missing mutex_destroy() at module removal + +From: Zhu Yanjun + +[ Upstream commit 07d1b99825f40f9c0d93e6b99d79a08d0717bac1 ] + +When a mutex lock is not used any more, the function mutex_destroy +should be called to mark the mutex lock uninitialized. + +Fixes: f2298c0403b0 ("null_blk: multi queue aware block test driver") +Signed-off-by: Zhu Yanjun +Link: https://lore.kernel.org/r/20240425171635.4227-1-yanjun.zhu@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 87791265e09bf..1fe5d33a5798d 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -2045,6 +2045,8 @@ static void __exit null_exit(void) + + if (g_queue_mode == NULL_Q_MQ && shared_tags) + blk_mq_free_tag_set(&tag_set); ++ ++ mutex_destroy(&lock); + } + + module_init(null_init); +-- +2.43.0 + diff --git a/queue-5.15/nvme-find-numa-distance-only-if-controller-has-valid.patch b/queue-5.15/nvme-find-numa-distance-only-if-controller-has-valid.patch new file mode 100644 index 00000000000..9d7ae149294 --- /dev/null +++ b/queue-5.15/nvme-find-numa-distance-only-if-controller-has-valid.patch @@ -0,0 +1,47 @@ +From 126085005dfbe233c91ed0a9af31f24130dea7db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 13:49:23 +0530 +Subject: nvme: find numa distance only if controller has valid numa id + +From: Nilay Shroff + +[ Upstream commit 863fe60ed27f2c85172654a63c5b827e72c8b2e6 ] + +On system where native nvme multipath is configured and iopolicy +is set to numa but the nvme controller numa node id is undefined +or -1 (NUMA_NO_NODE) then avoid calculating node distance for +finding optimal io path. In such case we may access numa distance +table with invalid index and that may potentially refer to incorrect +memory. So this patch ensures that if the nvme controller numa node +id is -1 then instead of calculating node distance for finding optimal +io path, we set the numa node distance of such controller to default 10 +(LOCAL_DISTANCE). + +Link: https://lore.kernel.org/all/20240413090614.678353-1-nilay@linux.ibm.com/ +Signed-off-by: Nilay Shroff +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 73eddb67f0d24..f8ad43b5f0690 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -190,7 +190,8 @@ static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node) + if (nvme_path_is_disabled(ns)) + continue; + +- if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_NUMA) ++ if (ns->ctrl->numa_node != NUMA_NO_NODE && ++ READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_NUMA) + distance = node_distance(node, ns->ctrl->numa_node); + else + distance = LOCAL_DISTANCE; +-- +2.43.0 + diff --git a/queue-5.15/openpromfs-finish-conversion-to-the-new-mount-api.patch b/queue-5.15/openpromfs-finish-conversion-to-the-new-mount-api.patch new file mode 100644 index 00000000000..f72ee709763 --- /dev/null +++ b/queue-5.15/openpromfs-finish-conversion-to-the-new-mount-api.patch @@ -0,0 +1,58 @@ +From 64858816c513bebd87904405759677602f608300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 16:33:11 -0600 +Subject: openpromfs: finish conversion to the new mount API + +From: Eric Sandeen + +[ Upstream commit 8f27829974b025d4df2e78894105d75e3bf349f0 ] + +The original mount API conversion inexplicably left out the change +from ->remount_fs to ->reconfigure; do that now. + +Fixes: 7ab2fa7693c3 ("vfs: Convert openpromfs to use the new mount API") +Signed-off-by: Eric Sandeen +Link: https://lore.kernel.org/r/90b968aa-c979-420f-ba37-5acc3391b28f@redhat.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/openpromfs/inode.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/openpromfs/inode.c b/fs/openpromfs/inode.c +index f825176ff4ed7..07a312bf9be71 100644 +--- a/fs/openpromfs/inode.c ++++ b/fs/openpromfs/inode.c +@@ -355,10 +355,10 @@ static struct inode *openprom_iget(struct super_block *sb, ino_t ino) + return inode; + } + +-static int openprom_remount(struct super_block *sb, int *flags, char *data) ++static int openpromfs_reconfigure(struct fs_context *fc) + { +- sync_filesystem(sb); +- *flags |= SB_NOATIME; ++ sync_filesystem(fc->root->d_sb); ++ fc->sb_flags |= SB_NOATIME; + return 0; + } + +@@ -366,7 +366,6 @@ static const struct super_operations openprom_sops = { + .alloc_inode = openprom_alloc_inode, + .free_inode = openprom_free_inode, + .statfs = simple_statfs, +- .remount_fs = openprom_remount, + }; + + static int openprom_fill_super(struct super_block *s, struct fs_context *fc) +@@ -416,6 +415,7 @@ static int openpromfs_get_tree(struct fs_context *fc) + + static const struct fs_context_operations openpromfs_context_ops = { + .get_tree = openpromfs_get_tree, ++ .reconfigure = openpromfs_reconfigure, + }; + + static int openpromfs_init_fs_context(struct fs_context *fc) +-- +2.43.0 + diff --git a/queue-5.15/parisc-add-missing-export-of-__cmpxchg_u8.patch b/queue-5.15/parisc-add-missing-export-of-__cmpxchg_u8.patch new file mode 100644 index 00000000000..1285a3c03cb --- /dev/null +++ b/queue-5.15/parisc-add-missing-export-of-__cmpxchg_u8.patch @@ -0,0 +1,36 @@ +From a1ffa12f3f625bd0358aae7a50fa44d67f45b166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 22:35:54 -0400 +Subject: parisc: add missing export of __cmpxchg_u8() + +From: Al Viro + +[ Upstream commit c57e5dccb06decf3cb6c272ab138c033727149b5 ] + +__cmpxchg_u8() had been added (initially) for the sake of +drivers/phy/ti/phy-tusb1210.c; the thing is, that drivers is +modular, so we need an export + +Fixes: b344d6a83d01 "parisc: add support for cmpxchg on u8 pointers" +Signed-off-by: Al Viro +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/parisc_ksyms.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 00297e8e1c888..317508493b81c 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -21,6 +21,7 @@ EXPORT_SYMBOL(memset); + #include + EXPORT_SYMBOL(__xchg8); + EXPORT_SYMBOL(__xchg32); ++EXPORT_SYMBOL(__cmpxchg_u8); + EXPORT_SYMBOL(__cmpxchg_u32); + EXPORT_SYMBOL(__cmpxchg_u64); + #ifdef CONFIG_SMP +-- +2.43.0 + diff --git a/queue-5.15/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch b/queue-5.15/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch new file mode 100644 index 00000000000..edce1558a16 --- /dev/null +++ b/queue-5.15/platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch @@ -0,0 +1,95 @@ +From 1f436551dd453c28c23f800e7273136e526197cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 16:30:57 +0200 +Subject: platform/x86: xiaomi-wmi: Fix race condition when reporting key + events + +From: Armin Wolf + +[ Upstream commit 290680c2da8061e410bcaec4b21584ed951479af ] + +Multiple WMI events can be received concurrently, so multiple instances +of xiaomi_wmi_notify() can be active at the same time. Since the input +device is shared between those handlers, the key input sequence can be +disturbed. + +Fix this by protecting the key input sequence with a mutex. + +Compile-tested only. + +Fixes: edb73f4f0247 ("platform/x86: wmi: add Xiaomi WMI key driver") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20240402143059.8456-2-W_Armin@gmx.de +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/xiaomi-wmi.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/platform/x86/xiaomi-wmi.c b/drivers/platform/x86/xiaomi-wmi.c +index 54a2546bb93bf..be80f0bda9484 100644 +--- a/drivers/platform/x86/xiaomi-wmi.c ++++ b/drivers/platform/x86/xiaomi-wmi.c +@@ -2,8 +2,10 @@ + /* WMI driver for Xiaomi Laptops */ + + #include ++#include + #include + #include ++#include + #include + + #include +@@ -20,12 +22,21 @@ + + struct xiaomi_wmi { + struct input_dev *input_dev; ++ struct mutex key_lock; /* Protects the key event sequence */ + unsigned int key_code; + }; + ++static void xiaomi_mutex_destroy(void *data) ++{ ++ struct mutex *lock = data; ++ ++ mutex_destroy(lock); ++} ++ + static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context) + { + struct xiaomi_wmi *data; ++ int ret; + + if (wdev == NULL || context == NULL) + return -EINVAL; +@@ -35,6 +46,11 @@ static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context) + return -ENOMEM; + dev_set_drvdata(&wdev->dev, data); + ++ mutex_init(&data->key_lock); ++ ret = devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data->key_lock); ++ if (ret < 0) ++ return ret; ++ + data->input_dev = devm_input_allocate_device(&wdev->dev); + if (data->input_dev == NULL) + return -ENOMEM; +@@ -59,10 +75,12 @@ static void xiaomi_wmi_notify(struct wmi_device *wdev, union acpi_object *dummy) + if (data == NULL) + return; + ++ mutex_lock(&data->key_lock); + input_report_key(data->input_dev, data->key_code, 1); + input_sync(data->input_dev); + input_report_key(data->input_dev, data->key_code, 0); + input_sync(data->input_dev); ++ mutex_unlock(&data->key_lock); + } + + static const struct wmi_device_id xiaomi_wmi_id_table[] = { +-- +2.43.0 + diff --git a/queue-5.15/powerpc-fsl-soc-hide-unused-const-variable.patch b/queue-5.15/powerpc-fsl-soc-hide-unused-const-variable.patch new file mode 100644 index 00000000000..a9cca2308b9 --- /dev/null +++ b/queue-5.15/powerpc-fsl-soc-hide-unused-const-variable.patch @@ -0,0 +1,48 @@ +From e0416191c26e981207931e63f5262c4901eda203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:19 +0200 +Subject: powerpc/fsl-soc: hide unused const variable + +From: Arnd Bergmann + +[ Upstream commit 01acaf3aa75e1641442cc23d8fe0a7bb4226efb1 ] + +vmpic_msi_feature is only used conditionally, which triggers a rare +-Werror=unused-const-variable= warning with gcc: + +arch/powerpc/sysdev/fsl_msi.c:567:37: error: 'vmpic_msi_feature' defined but not used [-Werror=unused-const-variable=] + 567 | static const struct fsl_msi_feature vmpic_msi_feature = + +Hide this one in the same #ifdef as the reference so we can turn on +the warning by default. + +Fixes: 305bcf26128e ("powerpc/fsl-soc: use CONFIG_EPAPR_PARAVIRT for hcalls") +Signed-off-by: Arnd Bergmann +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240403080702.3509288-2-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/fsl_msi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c +index c55ccec0a1690..d9d3668293707 100644 +--- a/arch/powerpc/sysdev/fsl_msi.c ++++ b/arch/powerpc/sysdev/fsl_msi.c +@@ -569,10 +569,12 @@ static const struct fsl_msi_feature ipic_msi_feature = { + .msiir_offset = 0x38, + }; + ++#ifdef CONFIG_EPAPR_PARAVIRT + static const struct fsl_msi_feature vmpic_msi_feature = { + .fsl_pic_ip = FSL_PIC_IP_VMPIC, + .msiir_offset = 0, + }; ++#endif + + static const struct of_device_id fsl_of_msi_ids[] = { + { +-- +2.43.0 + diff --git a/queue-5.15/printk-let-no_printk-use-_printk.patch b/queue-5.15/printk-let-no_printk-use-_printk.patch new file mode 100644 index 00000000000..7f429b1fd94 --- /dev/null +++ b/queue-5.15/printk-let-no_printk-use-_printk.patch @@ -0,0 +1,55 @@ +From 2122487e36237d35d273d73831e4ea558f512b95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:00:02 +0100 +Subject: printk: Let no_printk() use _printk() + +From: Geert Uytterhoeven + +[ Upstream commit 8522f6b760ca588928eede740d5d69dd1e936b49 ] + +When printk-indexing is enabled, each printk() invocation emits a +pi_entry structure, containing the format string and other information +related to its location in the kernel sources. This is even true for +no_printk(): while the actual code to print the message is optimized out +by the compiler due to the always-false check, the pi_entry structure is +still emitted. + +As the main purpose of no_printk() is to provide a helper to maintain +printf()-style format checking when debugging is disabled, this leads to +the inclusion in the index of lots of printk formats that cannot be +emitted by the current kernel. + +Fix this by switching no_printk() from printk() to _printk(). + +This reduces the size of an arm64 defconfig kernel with +CONFIG_PRINTK_INDEX=y by 576 KiB. + +Fixes: 337015573718b161 ("printk: Userspace format indexing support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Andy Shevchenko +Reviewed-by: Xiubo Li +Reviewed-by: Chris Down +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/56cf92edccffea970e1f40a075334dd6cf5bb2a4.1709127473.git.geert+renesas@glider.be +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + include/linux/printk.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/printk.h b/include/linux/printk.h +index 9497f6b983399..c4fb84822111d 100644 +--- a/include/linux/printk.h ++++ b/include/linux/printk.h +@@ -129,7 +129,7 @@ struct va_format { + #define no_printk(fmt, ...) \ + ({ \ + if (0) \ +- printk(fmt, ##__VA_ARGS__); \ ++ _printk(fmt, ##__VA_ARGS__); \ + 0; \ + }) + +-- +2.43.0 + diff --git a/queue-5.15/pwm-sti-convert-to-platform-remove-callback-returnin.patch b/queue-5.15/pwm-sti-convert-to-platform-remove-callback-returnin.patch new file mode 100644 index 00000000000..69678ee38df --- /dev/null +++ b/queue-5.15/pwm-sti-convert-to-platform-remove-callback-returnin.patch @@ -0,0 +1,65 @@ +From fbb69d528164827be38300514bcf8839143ff064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 19:54:38 +0100 +Subject: pwm: sti: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit e13cec3617c6ace4fc389b60d2a7d5b305b62683 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Stable-dep-of: 5bb0b194aeee ("pwm: sti: Simplify probe function using devm functions") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-sti.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c +index 0a7920cbd4949..c782378dff5e5 100644 +--- a/drivers/pwm/pwm-sti.c ++++ b/drivers/pwm/pwm-sti.c +@@ -677,7 +677,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + return 0; + } + +-static int sti_pwm_remove(struct platform_device *pdev) ++static void sti_pwm_remove(struct platform_device *pdev) + { + struct sti_pwm_chip *pc = platform_get_drvdata(pdev); + +@@ -685,8 +685,6 @@ static int sti_pwm_remove(struct platform_device *pdev) + + clk_unprepare(pc->pwm_clk); + clk_unprepare(pc->cpt_clk); +- +- return 0; + } + + static const struct of_device_id sti_pwm_of_match[] = { +@@ -701,7 +699,7 @@ static struct platform_driver sti_pwm_driver = { + .of_match_table = sti_pwm_of_match, + }, + .probe = sti_pwm_probe, +- .remove = sti_pwm_remove, ++ .remove_new = sti_pwm_remove, + }; + module_platform_driver(sti_pwm_driver); + +-- +2.43.0 + diff --git a/queue-5.15/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch b/queue-5.15/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch new file mode 100644 index 00000000000..0a388b6389d --- /dev/null +++ b/queue-5.15/pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch @@ -0,0 +1,90 @@ +From 15ee3f214c337a273828ea2a5edba8b22eab3f52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 10:32:38 +0100 +Subject: pwm: sti: Prepare removing pwm_chip from driver data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 54272761ce7c475fa30a31b59b0cb89f7652b39e ] + +This prepares the driver for further changes that will drop struct +pwm_chip chip from struct sti_pwm_chip. Use the pwm_chip as driver data +instead of the sti_pwm_chip to get access to the pwm_chip in +sti_pwm_remove() without using pc->chip. + +Link: https://lore.kernel.org/r/56d53372aacff6871df4d6c6779c9dac94592696.1707900770.git.u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Stable-dep-of: 5bb0b194aeee ("pwm: sti: Simplify probe function using devm functions") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-sti.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c +index c782378dff5e5..8f7aff51787be 100644 +--- a/drivers/pwm/pwm-sti.c ++++ b/drivers/pwm/pwm-sti.c +@@ -571,6 +571,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct sti_pwm_compat_data *cdata; ++ struct pwm_chip *chip; + struct sti_pwm_chip *pc; + unsigned int i; + int irq, ret; +@@ -578,6 +579,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + pc = devm_kzalloc(dev, sizeof(*pc), GFP_KERNEL); + if (!pc) + return -ENOMEM; ++ chip = &pc->chip; + + cdata = devm_kzalloc(dev, sizeof(*cdata), GFP_KERNEL); + if (!cdata) +@@ -654,9 +656,9 @@ static int sti_pwm_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- pc->chip.dev = dev; +- pc->chip.ops = &sti_pwm_ops; +- pc->chip.npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs); ++ chip->dev = dev; ++ chip->ops = &sti_pwm_ops; ++ chip->npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs); + + for (i = 0; i < cdata->cpt_num_devs; i++) { + struct sti_cpt_ddata *ddata = &cdata->ddata[i]; +@@ -665,23 +667,24 @@ static int sti_pwm_probe(struct platform_device *pdev) + mutex_init(&ddata->lock); + } + +- ret = pwmchip_add(&pc->chip); ++ ret = pwmchip_add(chip); + if (ret < 0) { + clk_unprepare(pc->pwm_clk); + clk_unprepare(pc->cpt_clk); + return ret; + } + +- platform_set_drvdata(pdev, pc); ++ platform_set_drvdata(pdev, chip); + + return 0; + } + + static void sti_pwm_remove(struct platform_device *pdev) + { +- struct sti_pwm_chip *pc = platform_get_drvdata(pdev); ++ struct pwm_chip *chip = platform_get_drvdata(pdev); ++ struct sti_pwm_chip *pc = to_sti_pwmchip(chip); + +- pwmchip_remove(&pc->chip); ++ pwmchip_remove(chip); + + clk_unprepare(pc->pwm_clk); + clk_unprepare(pc->cpt_clk); +-- +2.43.0 + diff --git a/queue-5.15/pwm-sti-simplify-probe-function-using-devm-functions.patch b/queue-5.15/pwm-sti-simplify-probe-function-using-devm-functions.patch new file mode 100644 index 00000000000..82aa170c9e2 --- /dev/null +++ b/queue-5.15/pwm-sti-simplify-probe-function-using-devm-functions.patch @@ -0,0 +1,115 @@ +From 00a3d23f05bf68f08104c4a02ffdad9b3d62e9a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 12:00:54 +0100 +Subject: pwm: sti: Simplify probe function using devm functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 5bb0b194aeee5d5da6881232f4e9989b35957c25 ] + +Instead of of_clk_get_by_name() use devm_clk_get_prepared() which has +several advantages: + + - Combines getting the clock and a call to clk_prepare(). The latter + can be dropped from sti_pwm_probe() accordingly. + - Cares for calling clk_put() which is missing in both probe's error + path and the remove function. + - Cares for calling clk_unprepare() which can be dropped from the error + paths and the remove function. (Note that not all error path got this + right.) + +With additionally using devm_pwmchip_add() instead of pwmchip_add() the +remove callback can be dropped completely. With it the last user of +platform_get_drvdata() goes away and so platform_set_drvdata() can be +dropped from the probe function, too. + +Fixes: 378fe115d19d ("pwm: sti: Add new driver for ST's PWM IP") +Link: https://lore.kernel.org/r/81f0e1d173652f435afda6719adaed1922fe059a.1710068192.git.u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-sti.c | 39 +++------------------------------------ + 1 file changed, 3 insertions(+), 36 deletions(-) + +diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c +index 8f7aff51787be..a0467f0b549c2 100644 +--- a/drivers/pwm/pwm-sti.c ++++ b/drivers/pwm/pwm-sti.c +@@ -625,32 +625,20 @@ static int sti_pwm_probe(struct platform_device *pdev) + return ret; + + if (cdata->pwm_num_devs) { +- pc->pwm_clk = of_clk_get_by_name(dev->of_node, "pwm"); ++ pc->pwm_clk = devm_clk_get_prepared(dev, "pwm"); + if (IS_ERR(pc->pwm_clk)) { + dev_err(dev, "failed to get PWM clock\n"); + return PTR_ERR(pc->pwm_clk); + } +- +- ret = clk_prepare(pc->pwm_clk); +- if (ret) { +- dev_err(dev, "failed to prepare clock\n"); +- return ret; +- } + } + + if (cdata->cpt_num_devs) { +- pc->cpt_clk = of_clk_get_by_name(dev->of_node, "capture"); ++ pc->cpt_clk = devm_clk_get_prepared(dev, "capture"); + if (IS_ERR(pc->cpt_clk)) { + dev_err(dev, "failed to get PWM capture clock\n"); + return PTR_ERR(pc->cpt_clk); + } + +- ret = clk_prepare(pc->cpt_clk); +- if (ret) { +- dev_err(dev, "failed to prepare clock\n"); +- return ret; +- } +- + cdata->ddata = devm_kzalloc(dev, cdata->cpt_num_devs * sizeof(*cdata->ddata), GFP_KERNEL); + if (!cdata->ddata) + return -ENOMEM; +@@ -667,27 +655,7 @@ static int sti_pwm_probe(struct platform_device *pdev) + mutex_init(&ddata->lock); + } + +- ret = pwmchip_add(chip); +- if (ret < 0) { +- clk_unprepare(pc->pwm_clk); +- clk_unprepare(pc->cpt_clk); +- return ret; +- } +- +- platform_set_drvdata(pdev, chip); +- +- return 0; +-} +- +-static void sti_pwm_remove(struct platform_device *pdev) +-{ +- struct pwm_chip *chip = platform_get_drvdata(pdev); +- struct sti_pwm_chip *pc = to_sti_pwmchip(chip); +- +- pwmchip_remove(chip); +- +- clk_unprepare(pc->pwm_clk); +- clk_unprepare(pc->cpt_clk); ++ return devm_pwmchip_add(dev, chip); + } + + static const struct of_device_id sti_pwm_of_match[] = { +@@ -702,7 +670,6 @@ static struct platform_driver sti_pwm_driver = { + .of_match_table = sti_pwm_of_match, + }, + .probe = sti_pwm_probe, +- .remove_new = sti_pwm_remove, + }; + module_platform_driver(sti_pwm_driver); + +-- +2.43.0 + diff --git a/queue-5.15/qed-avoid-truncating-work-queue-length.patch b/queue-5.15/qed-avoid-truncating-work-queue-length.patch new file mode 100644 index 00000000000..76c7301b909 --- /dev/null +++ b/queue-5.15/qed-avoid-truncating-work-queue-length.patch @@ -0,0 +1,58 @@ +From 1556b9cd62a459db8f2f85f75f0b0303bb52924f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:02 +0100 +Subject: qed: avoid truncating work queue length + +From: Arnd Bergmann + +[ Upstream commit 954fd908f177604d4cce77e2a88cc50b29bad5ff ] + +clang complains that the temporary string for the name passed into +alloc_workqueue() is too short for its contents: + +drivers/net/ethernet/qlogic/qed/qed_main.c:1218:3: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 18 [-Werror,-Wformat-truncation] + +There is no need for a temporary buffer, and the actual name of a workqueue +is 32 bytes (WQ_NAME_LEN), so just use the interface as intended to avoid +the truncation. + +Fixes: 59ccf86fe69a ("qed: Add driver infrastucture for handling mfw requests.") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240326223825.4084412-4-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 6e902d57c793c..99a6d11fec62c 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1238,7 +1238,6 @@ static void qed_slowpath_task(struct work_struct *work) + static int qed_slowpath_wq_start(struct qed_dev *cdev) + { + struct qed_hwfn *hwfn; +- char name[NAME_SIZE]; + int i; + + if (IS_VF(cdev)) +@@ -1247,11 +1246,11 @@ static int qed_slowpath_wq_start(struct qed_dev *cdev) + for_each_hwfn(cdev, i) { + hwfn = &cdev->hwfns[i]; + +- snprintf(name, NAME_SIZE, "slowpath-%02x:%02x.%02x", +- cdev->pdev->bus->number, +- PCI_SLOT(cdev->pdev->devfn), hwfn->abs_pf_id); ++ hwfn->slowpath_wq = alloc_workqueue("slowpath-%02x:%02x.%02x", ++ 0, 0, cdev->pdev->bus->number, ++ PCI_SLOT(cdev->pdev->devfn), ++ hwfn->abs_pf_id); + +- hwfn->slowpath_wq = alloc_workqueue(name, 0, 0); + if (!hwfn->slowpath_wq) { + DP_NOTICE(hwfn, "Cannot create slowpath workqueue\n"); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-fix-deadlock-on-srq-async-events.patch b/queue-5.15/rdma-hns-fix-deadlock-on-srq-async-events.patch new file mode 100644 index 00000000000..4d8aa6b3e21 --- /dev/null +++ b/queue-5.15/rdma-hns-fix-deadlock-on-srq-async-events.patch @@ -0,0 +1,69 @@ +From e7841600dc6b77f093ea662800f53296d7046c44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:10 +0800 +Subject: RDMA/hns: Fix deadlock on SRQ async events. + +From: Chengchang Tang + +[ Upstream commit b46494b6f9c19f141114a57729e198698f40af37 ] + +xa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/ +xa_erase_irq() to avoid deadlock. + +Fixes: 81fce6291d99 ("RDMA/hns: Add SRQ asynchronous event support") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 1 + + drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index 80b9a9a45c68e..e2d2f8f2bdbcf 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include "hnae3.h" + #include "hns_roce_common.h" + #include "hns_roce_device.h" + #include "hns_roce_hem.h" +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index e64ef6903fb4f..35001fb99b944 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -100,7 +100,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) + goto err_out; + } + +- ret = xa_err(xa_store(&srq_table->xa, srq->srqn, srq, GFP_KERNEL)); ++ ret = xa_err(xa_store_irq(&srq_table->xa, srq->srqn, srq, GFP_KERNEL)); + if (ret) { + ibdev_err(ibdev, "failed to store SRQC, ret = %d.\n", ret); + goto err_put; +@@ -132,7 +132,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) + err_mbox: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + err_xa: +- xa_erase(&srq_table->xa, srq->srqn); ++ xa_erase_irq(&srq_table->xa, srq->srqn); + err_put: + hns_roce_table_put(hr_dev, &srq_table->table, srq->srqn); + err_out: +@@ -151,7 +151,7 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) + dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n", + ret, srq->srqn); + +- xa_erase(&srq_table->xa, srq->srqn); ++ xa_erase_irq(&srq_table->xa, srq->srqn); + + if (refcount_dec_and_test(&srq->refcount)) + complete(&srq->free); +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-fix-gmv-table-pagesize.patch b/queue-5.15/rdma-hns-fix-gmv-table-pagesize.patch new file mode 100644 index 00000000000..3974030b673 --- /dev/null +++ b/queue-5.15/rdma-hns-fix-gmv-table-pagesize.patch @@ -0,0 +1,39 @@ +From a2eeaa0adf1cd32fa65a5991caf263a7fcacc5aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:13 +0800 +Subject: RDMA/hns: Fix GMV table pagesize + +From: Chengchang Tang + +[ Upstream commit ee045493283403969591087bd405fa280103282a ] + +GMV's BA table only supports 4K pages. Currently, PAGESIZE is used to +calculate gmv_bt_num, which will cause an abnormal number of gmv_bt_num +in a 64K OS. + +Fixes: d6d91e46210f ("RDMA/hns: Add support for configuring GMV table") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 7376f012ece12..e541de3e6165b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2202,7 +2202,7 @@ static void apply_func_caps(struct hns_roce_dev *hr_dev) + caps->gid_table_len[0] = caps->gmv_bt_num * + (HNS_HW_PAGE_SIZE / caps->gmv_entry_sz); + +- caps->gmv_entry_num = caps->gmv_bt_num * (PAGE_SIZE / ++ caps->gmv_entry_num = caps->gmv_bt_num * (HNS_HW_PAGE_SIZE / + caps->gmv_entry_sz); + } else { + u32 func_num = max_t(u32, 1, hr_dev->func_num); +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch b/queue-5.15/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch new file mode 100644 index 00000000000..c8c09ec4806 --- /dev/null +++ b/queue-5.15/rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch @@ -0,0 +1,75 @@ +From 624cc5ba897f06083877b4e3a48a8b63bbc64f33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 11:38:51 +0800 +Subject: RDMA/hns: Fix return value in hns_roce_map_mr_sg + +From: Zhengchao Shao + +[ Upstream commit 203b70fda63425a4eb29f03f9074859afe821a39 ] + +As described in the ib_map_mr_sg function comment, it returns the number +of sg elements that were mapped to the memory region. However, +hns_roce_map_mr_sg returns the number of pages required for mapping the +DMA area. Fix it. + +Fixes: 9b2cf76c9f05 ("RDMA/hns: Optimize PBL buffer allocation process") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20240411033851.2884771-1-shaozhengchao@huawei.com +Reviewed-by: Junxian Huang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_mr.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 12c482f4a1c48..7106e51d5fad1 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -444,18 +444,18 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, + struct ib_device *ibdev = &hr_dev->ib_dev; + struct hns_roce_mr *mr = to_hr_mr(ibmr); + struct hns_roce_mtr *mtr = &mr->pbl_mtr; +- int ret = 0; ++ int ret, sg_num = 0; + + mr->npages = 0; + mr->page_list = kvcalloc(mr->pbl_mtr.hem_cfg.buf_pg_count, + sizeof(dma_addr_t), GFP_KERNEL); + if (!mr->page_list) +- return ret; ++ return sg_num; + +- ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); +- if (ret < 1) { ++ sg_num = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); ++ if (sg_num < 1) { + ibdev_err(ibdev, "failed to store sg pages %u %u, cnt = %d.\n", +- mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, ret); ++ mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, sg_num); + goto err_page_list; + } + +@@ -466,17 +466,16 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, + ret = hns_roce_mtr_map(hr_dev, mtr, mr->page_list, mr->npages); + if (ret) { + ibdev_err(ibdev, "failed to map sg mtr, ret = %d.\n", ret); +- ret = 0; ++ sg_num = 0; + } else { + mr->pbl_mtr.hem_cfg.buf_pg_shift = (u32)ilog2(ibmr->page_size); +- ret = mr->npages; + } + + err_page_list: + kvfree(mr->page_list); + mr->page_list = NULL; + +- return ret; ++ return sg_num; + } + + static void hns_roce_mw_free(struct hns_roce_dev *hr_dev, +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-modify-the-print-level-of-cqe-error.patch b/queue-5.15/rdma-hns-modify-the-print-level-of-cqe-error.patch new file mode 100644 index 00000000000..2373dab8471 --- /dev/null +++ b/queue-5.15/rdma-hns-modify-the-print-level-of-cqe-error.patch @@ -0,0 +1,42 @@ +From a60dd6f148575059fc5fca8cad2f8910de6f7a01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:16 +0800 +Subject: RDMA/hns: Modify the print level of CQE error + +From: Chengchang Tang + +[ Upstream commit 349e859952285ab9689779fb46de163f13f18f43 ] + +Too much print may lead to a panic in kernel. Change ibdev_err() to +ibdev_err_ratelimited(), and change the printing level of cqe dump +to debug level. + +Fixes: 7c044adca272 ("RDMA/hns: Simplify the cqe code of poll cq") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-11-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index e541de3e6165b..4accc9efa6946 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -3514,8 +3514,9 @@ static void get_cqe_status(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp, + wc->status == IB_WC_WR_FLUSH_ERR)) + return; + +- ibdev_err(&hr_dev->ib_dev, "error cqe status 0x%x:\n", cqe_status); +- print_hex_dump(KERN_ERR, "", DUMP_PREFIX_NONE, 16, 4, cqe, ++ ibdev_err_ratelimited(&hr_dev->ib_dev, "error cqe status 0x%x:\n", ++ cqe_status); ++ print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE, 16, 4, cqe, + cq->cqe_size, false); + wc->vendor_err = hr_reg_read(cqe, CQE_SUB_STATUS); + +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-use-complete-parentheses-in-macros.patch b/queue-5.15/rdma-hns-use-complete-parentheses-in-macros.patch new file mode 100644 index 00000000000..80739fd7620 --- /dev/null +++ b/queue-5.15/rdma-hns-use-complete-parentheses-in-macros.patch @@ -0,0 +1,52 @@ +From e0a1b64bca991181bbc5550b7ac76e1de74f9ff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:15 +0800 +Subject: RDMA/hns: Use complete parentheses in macros + +From: Chengchang Tang + +[ Upstream commit 4125269bb9b22e1d8cdf4412c81be8074dbc61ca ] + +Use complete parentheses to ensure that macro expansion does +not produce unexpected results. + +Fixes: a25d13cbe816 ("RDMA/hns: Add the interfaces to support multi hop addressing for the contexts in hip08") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-10-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index 2d84a6b3f05df..fa84ce33076ac 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -61,16 +61,16 @@ enum { + (sizeof(struct scatterlist) + sizeof(void *))) + + #define check_whether_bt_num_3(type, hop_num) \ +- (type < HEM_TYPE_MTT && hop_num == 2) ++ ((type) < HEM_TYPE_MTT && (hop_num) == 2) + + #define check_whether_bt_num_2(type, hop_num) \ +- ((type < HEM_TYPE_MTT && hop_num == 1) || \ +- (type >= HEM_TYPE_MTT && hop_num == 2)) ++ (((type) < HEM_TYPE_MTT && (hop_num) == 1) || \ ++ ((type) >= HEM_TYPE_MTT && (hop_num) == 2)) + + #define check_whether_bt_num_1(type, hop_num) \ +- ((type < HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0) || \ +- (type >= HEM_TYPE_MTT && hop_num == 1) || \ +- (type >= HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0)) ++ (((type) < HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0) || \ ++ ((type) >= HEM_TYPE_MTT && (hop_num) == 1) || \ ++ ((type) >= HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0)) + + struct hns_roce_hem_chunk { + struct list_head list; +-- +2.43.0 + diff --git a/queue-5.15/rdma-ipoib-fix-format-truncation-compilation-errors.patch b/queue-5.15/rdma-ipoib-fix-format-truncation-compilation-errors.patch new file mode 100644 index 00000000000..8618b5c9983 --- /dev/null +++ b/queue-5.15/rdma-ipoib-fix-format-truncation-compilation-errors.patch @@ -0,0 +1,66 @@ +From 3198ce24761470329c63e26c2b9d3f04d4462716 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 10:39:33 +0300 +Subject: RDMA/IPoIB: Fix format truncation compilation errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 49ca2b2ef3d003402584c68ae7b3055ba72e750a ] + +Truncate the device name to store IPoIB VLAN name. + +[leonro@5b4e8fba4ddd kernel]$ make -s -j 20 allmodconfig +[leonro@5b4e8fba4ddd kernel]$ make -s -j 20 W=1 drivers/infiniband/ulp/ipoib/ +drivers/infiniband/ulp/ipoib/ipoib_vlan.c: In function ‘ipoib_vlan_add’: +drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:52: error: ‘%04x’ +directive output may be truncated writing 4 bytes into a region of size +between 0 and 15 [-Werror=format-truncation=] + 187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x", + | ^~~~ +drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:48: note: directive +argument in the range [0, 65535] + 187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x", + | ^~~~~~~~~ +drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:9: note: ‘snprintf’ output +between 6 and 21 bytes into a destination of size 16 + 187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 188 | ppriv->dev->name, pkey); + | ~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/ulp/ipoib/ipoib_vlan.o] Error 1 +make[6]: *** Waiting for unfinished jobs.... + +Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support") +Link: https://lore.kernel.org/r/e9d3e1fef69df4c9beaf402cc3ac342bad680791.1715240029.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +index 0322dc75396f1..323d5d5db2473 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +@@ -185,8 +185,12 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey) + + ppriv = ipoib_priv(pdev); + +- snprintf(intf_name, sizeof(intf_name), "%s.%04x", +- ppriv->dev->name, pkey); ++ /* If you increase IFNAMSIZ, update snprintf below ++ * to allow longer names. ++ */ ++ BUILD_BUG_ON(IFNAMSIZ != 16); ++ snprintf(intf_name, sizeof(intf_name), "%.10s.%04x", ppriv->dev->name, ++ pkey); + + ndev = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name); + if (IS_ERR(ndev)) { +-- +2.43.0 + diff --git a/queue-5.15/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch b/queue-5.15/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch new file mode 100644 index 00000000000..d6a709e1922 --- /dev/null +++ b/queue-5.15/rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch @@ -0,0 +1,39 @@ +From 9d06522d6d69e20f4d95b99bfca287d9f2883dd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 13:36:01 +0300 +Subject: RDMA/mlx5: Adding remote atomic access flag to updatable flags + +From: Or Har-Toov + +[ Upstream commit 2ca7e93bc963d9ec2f5c24d117176851454967af ] + +Currently IB_ACCESS_REMOTE_ATOMIC is blocked from being updated via UMR +although in some cases it should be possible. These cases are checked in +mlx5r_umr_can_reconfig function. + +Fixes: ef3642c4f54d ("RDMA/mlx5: Fix error unwinds for rereg_mr") +Signed-off-by: Or Har-Toov +Link: https://lore.kernel.org/r/24dac73e2fa48cb806f33a932d97f3e402a5ea2c.1712140377.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index cf203f879d340..191078b6e9129 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1687,7 +1687,8 @@ static bool can_use_umr_rereg_access(struct mlx5_ib_dev *dev, + unsigned int diffs = current_access_flags ^ target_access_flags; + + if (diffs & ~(IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE | +- IB_ACCESS_REMOTE_READ | IB_ACCESS_RELAXED_ORDERING)) ++ IB_ACCESS_REMOTE_READ | IB_ACCESS_RELAXED_ORDERING | ++ IB_ACCESS_REMOTE_ATOMIC)) + return false; + return mlx5_ib_can_reconfig_with_umr(dev, current_access_flags, + target_access_flags); +-- +2.43.0 + diff --git a/queue-5.15/regulator-irq_helpers-duplicate-irq-name.patch b/queue-5.15/regulator-irq_helpers-duplicate-irq-name.patch new file mode 100644 index 00000000000..f571ed62a9e --- /dev/null +++ b/queue-5.15/regulator-irq_helpers-duplicate-irq-name.patch @@ -0,0 +1,43 @@ +From 734a8b6d509171d7aee6cd23026e3f2d40f91ac0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 10:35:21 +0300 +Subject: regulator: irq_helpers: duplicate IRQ name + +From: Matti Vaittinen + +[ Upstream commit 7ab681ddedd4b6dd2b047c74af95221c5f827e1d ] + +The regulator IRQ helper requires caller to provide pointer to IRQ name +which is kept in memory by caller. All other data passed to the helper +in the regulator_irq_desc structure is copied. This can cause some +confusion and unnecessary complexity. + +Make the regulator_irq_helper() to copy also the provided IRQ name +information so caller can discard the name after the call to +regulator_irq_helper() completes. + +Signed-off-by: Matti Vaittinen +Link: https://msgid.link/r/ZhJMuUYwaZbBXFGP@drtxq0yyyyyyyyyyyyydy-3.rev.dnainternet.fi +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/irq_helpers.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/regulator/irq_helpers.c b/drivers/regulator/irq_helpers.c +index 5227644355750..a44a0b30a6516 100644 +--- a/drivers/regulator/irq_helpers.c ++++ b/drivers/regulator/irq_helpers.c +@@ -350,6 +350,9 @@ void *regulator_irq_helper(struct device *dev, + + h->irq = irq; + h->desc = *d; ++ h->desc.name = devm_kstrdup(dev, d->name, GFP_KERNEL); ++ if (!h->desc.name) ++ return ERR_PTR(-ENOMEM); + + ret = init_rdev_state(dev, h, rdev, common_errs, per_rdev_errs, + rdev_amount); +-- +2.43.0 + diff --git a/queue-5.15/regulator-vqmmc-ipq4019-fix-module-autoloading.patch b/queue-5.15/regulator-vqmmc-ipq4019-fix-module-autoloading.patch new file mode 100644 index 00000000000..c26756ecefc --- /dev/null +++ b/queue-5.15/regulator-vqmmc-ipq4019-fix-module-autoloading.patch @@ -0,0 +1,36 @@ +From 410b3782e32ca2db7f2baf0c99d5e7933fac3f69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 19:26:15 +0200 +Subject: regulator: vqmmc-ipq4019: fix module autoloading + +From: Krzysztof Kozlowski + +[ Upstream commit 68adb581a39ae63a0ed082c47f01fbbe515efa0e ] + +Add MODULE_DEVICE_TABLE(), so the module could be properly autoloaded +based on the alias from of_device_id table. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://msgid.link/r/20240410172615.255424-2-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/vqmmc-ipq4019-regulator.c b/drivers/regulator/vqmmc-ipq4019-regulator.c +index 6d5ae25d08d1e..e2a28788d8a22 100644 +--- a/drivers/regulator/vqmmc-ipq4019-regulator.c ++++ b/drivers/regulator/vqmmc-ipq4019-regulator.c +@@ -86,6 +86,7 @@ static const struct of_device_id regulator_ipq4019_of_match[] = { + { .compatible = "qcom,vqmmc-ipq4019-regulator", }, + {}, + }; ++MODULE_DEVICE_TABLE(of, regulator_ipq4019_of_match); + + static struct platform_driver ipq4019_regulator_driver = { + .probe = ipq4019_regulator_probe, +-- +2.43.0 + diff --git a/queue-5.15/revert-sh-handle-calling-csum_partial-with-misaligne.patch b/queue-5.15/revert-sh-handle-calling-csum_partial-with-misaligne.patch new file mode 100644 index 00000000000..b96340b0f3a --- /dev/null +++ b/queue-5.15/revert-sh-handle-calling-csum_partial-with-misaligne.patch @@ -0,0 +1,187 @@ +From b041bfb131cf966858007cbbb6bad1592ee65620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Mar 2024 16:18:04 -0700 +Subject: Revert "sh: Handle calling csum_partial with misaligned data" + +From: Guenter Roeck + +[ Upstream commit b5319c96292ff877f6b58d349acf0a9dc8d3b454 ] + +This reverts commit cadc4e1a2b4d20d0cc0e81f2c6ba0588775e54e5. + +Commit cadc4e1a2b4d ("sh: Handle calling csum_partial with misaligned +data") causes bad checksum calculations on unaligned data. Reverting +it fixes the problem. + + # Subtest: checksum + # module: checksum_kunit + 1..5 + # test_csum_fixed_random_inputs: ASSERTION FAILED at lib/checksum_kunit.c:500 + Expected ( u64)result == ( u64)expec, but + ( u64)result == 53378 (0xd082) + ( u64)expec == 33488 (0x82d0) + # test_csum_fixed_random_inputs: pass:0 fail:1 skip:0 total:1 + not ok 1 test_csum_fixed_random_inputs + # test_csum_all_carry_inputs: ASSERTION FAILED at lib/checksum_kunit.c:525 + Expected ( u64)result == ( u64)expec, but + ( u64)result == 65281 (0xff01) + ( u64)expec == 65280 (0xff00) + # test_csum_all_carry_inputs: pass:0 fail:1 skip:0 total:1 + not ok 2 test_csum_all_carry_inputs + # test_csum_no_carry_inputs: ASSERTION FAILED at lib/checksum_kunit.c:573 + Expected ( u64)result == ( u64)expec, but + ( u64)result == 65535 (0xffff) + ( u64)expec == 65534 (0xfffe) + # test_csum_no_carry_inputs: pass:0 fail:1 skip:0 total:1 + not ok 3 test_csum_no_carry_inputs + # test_ip_fast_csum: pass:1 fail:0 skip:0 total:1 + ok 4 test_ip_fast_csum + # test_csum_ipv6_magic: pass:1 fail:0 skip:0 total:1 + ok 5 test_csum_ipv6_magic + # checksum: pass:2 fail:3 skip:0 total:5 + # Totals: pass:2 fail:3 skip:0 total:5 +not ok 22 checksum + +Fixes: cadc4e1a2b4d ("sh: Handle calling csum_partial with misaligned data") +Signed-off-by: Guenter Roeck +Tested-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20240324231804.841099-1-linux@roeck-us.net +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/lib/checksum.S | 67 ++++++++++++------------------------------ + 1 file changed, 18 insertions(+), 49 deletions(-) + +diff --git a/arch/sh/lib/checksum.S b/arch/sh/lib/checksum.S +index 3e07074e00981..06fed5a21e8ba 100644 +--- a/arch/sh/lib/checksum.S ++++ b/arch/sh/lib/checksum.S +@@ -33,7 +33,8 @@ + */ + + /* +- * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum); ++ * unsigned int csum_partial(const unsigned char *buf, int len, ++ * unsigned int sum); + */ + + .text +@@ -45,31 +46,11 @@ ENTRY(csum_partial) + * Fortunately, it is easy to convert 2-byte alignment to 4-byte + * alignment for the unrolled loop. + */ ++ mov r5, r1 + mov r4, r0 +- tst #3, r0 ! Check alignment. +- bt/s 2f ! Jump if alignment is ok. +- mov r4, r7 ! Keep a copy to check for alignment ++ tst #2, r0 ! Check alignment. ++ bt 2f ! Jump if alignment is ok. + ! +- tst #1, r0 ! Check alignment. +- bt 21f ! Jump if alignment is boundary of 2bytes. +- +- ! buf is odd +- tst r5, r5 +- add #-1, r5 +- bt 9f +- mov.b @r4+, r0 +- extu.b r0, r0 +- addc r0, r6 ! t=0 from previous tst +- mov r6, r0 +- shll8 r6 +- shlr16 r0 +- shlr8 r0 +- or r0, r6 +- mov r4, r0 +- tst #2, r0 +- bt 2f +-21: +- ! buf is 2 byte aligned (len could be 0) + add #-2, r5 ! Alignment uses up two bytes. + cmp/pz r5 ! + bt/s 1f ! Jump if we had at least two bytes. +@@ -77,17 +58,16 @@ ENTRY(csum_partial) + bra 6f + add #2, r5 ! r5 was < 2. Deal with it. + 1: ++ mov r5, r1 ! Save new len for later use. + mov.w @r4+, r0 + extu.w r0, r0 + addc r0, r6 + bf 2f + add #1, r6 + 2: +- ! buf is 4 byte aligned (len could be 0) +- mov r5, r1 + mov #-5, r0 +- shld r0, r1 +- tst r1, r1 ++ shld r0, r5 ++ tst r5, r5 + bt/s 4f ! if it's =0, go to 4f + clrt + .align 2 +@@ -109,31 +89,30 @@ ENTRY(csum_partial) + addc r0, r6 + addc r2, r6 + movt r0 +- dt r1 ++ dt r5 + bf/s 3b + cmp/eq #1, r0 +- ! here, we know r1==0 +- addc r1, r6 ! add carry to r6 ++ ! here, we know r5==0 ++ addc r5, r6 ! add carry to r6 + 4: +- mov r5, r0 ++ mov r1, r0 + and #0x1c, r0 + tst r0, r0 +- bt 6f +- ! 4 bytes or more remaining +- mov r0, r1 +- shlr2 r1 ++ bt/s 6f ++ mov r0, r5 ++ shlr2 r5 + mov #0, r2 + 5: + addc r2, r6 + mov.l @r4+, r2 + movt r0 +- dt r1 ++ dt r5 + bf/s 5b + cmp/eq #1, r0 + addc r2, r6 +- addc r1, r6 ! r1==0 here, so it means add carry-bit ++ addc r5, r6 ! r5==0 here, so it means add carry-bit + 6: +- ! 3 bytes or less remaining ++ mov r1, r5 + mov #3, r0 + and r0, r5 + tst r5, r5 +@@ -159,16 +138,6 @@ ENTRY(csum_partial) + mov #0, r0 + addc r0, r6 + 9: +- ! Check if the buffer was misaligned, if so realign sum +- mov r7, r0 +- tst #1, r0 +- bt 10f +- mov r6, r0 +- shll8 r6 +- shlr16 r0 +- shlr8 r0 +- or r0, r6 +-10: + rts + mov r6, r0 + +-- +2.43.0 + diff --git a/queue-5.15/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch b/queue-5.15/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch new file mode 100644 index 00000000000..ba5a55457ab --- /dev/null +++ b/queue-5.15/s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch @@ -0,0 +1,62 @@ +From 7e51965ea5d959369479398110538d0950a07e3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 02:02:49 +0200 +Subject: s390/bpf: Emit a barrier for BPF_FETCH instructions + +From: Ilya Leoshkevich + +[ Upstream commit 68378982f0b21de02ac3c6a11e2420badefcb4bc ] + +BPF_ATOMIC_OP() macro documentation states that "BPF_ADD | BPF_FETCH" +should be the same as atomic_fetch_add(), which is currently not the +case on s390x: the serialization instruction "bcr 14,0" is missing. +This applies to "and", "or" and "xor" variants too. + +s390x is allowed to reorder stores with subsequent fetches from +different addresses, so code relying on BPF_FETCH acting as a barrier, +for example: + + stw [%r0], 1 + afadd [%r1], %r2 + ldxw %r3, [%r4] + +may be broken. Fix it by emitting "bcr 14,0". + +Note that a separate serialization instruction is not needed for +BPF_XCHG and BPF_CMPXCHG, because COMPARE AND SWAP performs +serialization itself. + +Fixes: ba3b86b9cef0 ("s390/bpf: Implement new atomic ops") +Reported-by: Puranjay Mohan +Closes: https://lore.kernel.org/bpf/mb61p34qvq3wf.fsf@kernel.org/ +Signed-off-by: Ilya Leoshkevich +Reviewed-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20240507000557.12048-1-iii@linux.ibm.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 1a374d021e256..88020b4ddbab6 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1229,8 +1229,12 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + EMIT6_DISP_LH(0xeb000000, is32 ? (op32) : (op64), \ + (insn->imm & BPF_FETCH) ? src_reg : REG_W0, \ + src_reg, dst_reg, off); \ +- if (is32 && (insn->imm & BPF_FETCH)) \ +- EMIT_ZERO(src_reg); \ ++ if (insn->imm & BPF_FETCH) { \ ++ /* bcr 14,0 - see atomic_fetch_{add,and,or,xor}() */ \ ++ _EMIT2(0x07e0); \ ++ if (is32) \ ++ EMIT_ZERO(src_reg); \ ++ } \ + } while (0) + case BPF_ADD: + case BPF_ADD | BPF_FETCH: +-- +2.43.0 + diff --git a/queue-5.15/s390-cio-fix-tracepoint-subchannel-type-field.patch b/queue-5.15/s390-cio-fix-tracepoint-subchannel-type-field.patch new file mode 100644 index 00000000000..f7f43472eca --- /dev/null +++ b/queue-5.15/s390-cio-fix-tracepoint-subchannel-type-field.patch @@ -0,0 +1,38 @@ +From 68f1e7ddeb153ac7f119c4e78522c6bcacb9d9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 17:04:56 +0100 +Subject: s390/cio: fix tracepoint subchannel type field + +From: Peter Oberparleiter + +[ Upstream commit 8692a24d0fae19f674d51726d179ad04ba95d958 ] + +The subchannel-type field "st" of s390_cio_stsch and s390_cio_msch +tracepoints is incorrectly filled with the subchannel-enabled SCHIB +value "ena". Fix this by assigning the correct value. + +Fixes: d1de8633d96a ("s390 cio: Rewrite trace point class s390_class_schib") +Reviewed-by: Heiko Carstens +Signed-off-by: Peter Oberparleiter +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/trace.h b/drivers/s390/cio/trace.h +index 86993de253451..a4c5c6736b310 100644 +--- a/drivers/s390/cio/trace.h ++++ b/drivers/s390/cio/trace.h +@@ -50,7 +50,7 @@ DECLARE_EVENT_CLASS(s390_class_schib, + __entry->devno = schib->pmcw.dev; + __entry->schib = *schib; + __entry->pmcw_ena = schib->pmcw.ena; +- __entry->pmcw_st = schib->pmcw.ena; ++ __entry->pmcw_st = schib->pmcw.st; + __entry->pmcw_dnv = schib->pmcw.dnv; + __entry->pmcw_dev = schib->pmcw.dev; + __entry->pmcw_lpm = schib->pmcw.lpm; +-- +2.43.0 + diff --git a/queue-5.15/sched-core-fix-incorrect-initialization-of-the-burst.patch b/queue-5.15/sched-core-fix-incorrect-initialization-of-the-burst.patch new file mode 100644 index 00000000000..2ce8fb2eb8c --- /dev/null +++ b/queue-5.15/sched-core-fix-incorrect-initialization-of-the-burst.patch @@ -0,0 +1,71 @@ +From 6a3c5a107046025fbe6b3f9b43ab3adbf91ffeb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:24:38 +0800 +Subject: sched/core: Fix incorrect initialization of the 'burst' parameter in + cpu_max_write() + +From: Cheng Yu + +[ Upstream commit 49217ea147df7647cb89161b805c797487783fc0 ] + +In the cgroup v2 CPU subsystem, assuming we have a +cgroup named 'test', and we set cpu.max and cpu.max.burst: + + # echo 1000000 > /sys/fs/cgroup/test/cpu.max + # echo 1000000 > /sys/fs/cgroup/test/cpu.max.burst + +then we check cpu.max and cpu.max.burst: + + # cat /sys/fs/cgroup/test/cpu.max + 1000000 100000 + # cat /sys/fs/cgroup/test/cpu.max.burst + 1000000 + +Next we set cpu.max again and check cpu.max and +cpu.max.burst: + + # echo 2000000 > /sys/fs/cgroup/test/cpu.max + # cat /sys/fs/cgroup/test/cpu.max + 2000000 100000 + + # cat /sys/fs/cgroup/test/cpu.max.burst + 1000 + +... we find that the cpu.max.burst value changed unexpectedly. + +In cpu_max_write(), the unit of the burst value returned +by tg_get_cfs_burst() is microseconds, while in cpu_max_write(), +the burst unit used for calculation should be nanoseconds, +which leads to the bug. + +To fix it, get the burst value directly from tg->cfs_bandwidth.burst. + +Fixes: f4183717b370 ("sched/fair: Introduce the burstable CFS controller") +Reported-by: Qixin Liao +Signed-off-by: Cheng Yu +Signed-off-by: Zhang Qiao +Signed-off-by: Ingo Molnar +Reviewed-by: Vincent Guittot +Tested-by: Vincent Guittot +Link: https://lore.kernel.org/r/20240424132438.514720-1-serein.chengyu@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 25b8ea91168ea..b43da6201b9aa 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -10828,7 +10828,7 @@ static ssize_t cpu_max_write(struct kernfs_open_file *of, + { + struct task_group *tg = css_tg(of_css(of)); + u64 period = tg_get_cfs_period(tg); +- u64 burst = tg_get_cfs_burst(tg); ++ u64 burst = tg->cfs_bandwidth.burst; + u64 quota; + int ret; + +-- +2.43.0 + diff --git a/queue-5.15/sched-fair-add-eas-checks-before-updating-root_domai.patch b/queue-5.15/sched-fair-add-eas-checks-before-updating-root_domai.patch new file mode 100644 index 00000000000..877368bc79e --- /dev/null +++ b/queue-5.15/sched-fair-add-eas-checks-before-updating-root_domai.patch @@ -0,0 +1,147 @@ +From 0208e2b9aab15ef84a6231a1c8adfa64662ce215 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 14:27:23 +0530 +Subject: sched/fair: Add EAS checks before updating root_domain::overutilized + +From: Shrikanth Hegde + +[ Upstream commit be3a51e68f2f1b17250ce40d8872c7645b7a2991 ] + +root_domain::overutilized is only used for EAS(energy aware scheduler) +to decide whether to do load balance or not. It is not used if EAS +not possible. + +Currently enqueue_task_fair and task_tick_fair accesses, sometime updates +this field. In update_sd_lb_stats it is updated often. This causes cache +contention due to true sharing and burns a lot of cycles. ::overload and +::overutilized are part of the same cacheline. Updating it often invalidates +the cacheline. That causes access to ::overload to slow down due to +false sharing. Hence add EAS check before accessing/updating this field. +EAS check is optimized at compile time or it is a static branch. +Hence it shouldn't cost much. + +With the patch, both enqueue_task_fair and newidle_balance don't show +up as hot routines in perf profile. + + 6.8-rc4: + 7.18% swapper [kernel.vmlinux] [k] enqueue_task_fair + 6.78% s [kernel.vmlinux] [k] newidle_balance + + +patch: + 0.14% swapper [kernel.vmlinux] [k] enqueue_task_fair + 0.00% swapper [kernel.vmlinux] [k] newidle_balance + +While at it: trace_sched_overutilized_tp expect that second argument to +be bool. So do a int to bool conversion for that. + +Fixes: 2802bf3cd936 ("sched/fair: Add over-utilization/tipping point indicator") +Signed-off-by: Shrikanth Hegde +Signed-off-by: Ingo Molnar +Reviewed-by: Qais Yousef +Reviewed-by: Srikar Dronamraju +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/20240307085725.444486-2-sshegde@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 53 +++++++++++++++++++++++++++++---------------- + 1 file changed, 34 insertions(+), 19 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 4a1393405a6fe..94fcd585eb7f0 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5746,21 +5746,41 @@ static inline unsigned long cpu_util(int cpu); + + static inline bool cpu_overutilized(int cpu) + { +- unsigned long rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN); +- unsigned long rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX); ++ unsigned long rq_util_min, rq_util_max; ++ ++ if (!sched_energy_enabled()) ++ return false; ++ ++ rq_util_min = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MIN); ++ rq_util_max = uclamp_rq_get(cpu_rq(cpu), UCLAMP_MAX); + + return !util_fits_cpu(cpu_util(cpu), rq_util_min, rq_util_max, cpu); + } + +-static inline void update_overutilized_status(struct rq *rq) ++static inline void set_rd_overutilized_status(struct root_domain *rd, ++ unsigned int status) + { +- if (!READ_ONCE(rq->rd->overutilized) && cpu_overutilized(rq->cpu)) { +- WRITE_ONCE(rq->rd->overutilized, SG_OVERUTILIZED); +- trace_sched_overutilized_tp(rq->rd, SG_OVERUTILIZED); +- } ++ if (!sched_energy_enabled()) ++ return; ++ ++ WRITE_ONCE(rd->overutilized, status); ++ trace_sched_overutilized_tp(rd, !!status); ++} ++ ++static inline void check_update_overutilized_status(struct rq *rq) ++{ ++ /* ++ * overutilized field is used for load balancing decisions only ++ * if energy aware scheduler is being used ++ */ ++ if (!sched_energy_enabled()) ++ return; ++ ++ if (!READ_ONCE(rq->rd->overutilized) && cpu_overutilized(rq->cpu)) ++ set_rd_overutilized_status(rq->rd, SG_OVERUTILIZED); + } + #else +-static inline void update_overutilized_status(struct rq *rq) { } ++static inline void check_update_overutilized_status(struct rq *rq) { } + #endif + + /* Runqueue only has SCHED_IDLE tasks enqueued */ +@@ -5868,7 +5888,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags) + * and the following generally works well enough in practice. + */ + if (!task_new) +- update_overutilized_status(rq); ++ check_update_overutilized_status(rq); + + enqueue_throttle: + if (cfs_bandwidth_used()) { +@@ -9577,19 +9597,14 @@ static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sd + env->fbq_type = fbq_classify_group(&sds->busiest_stat); + + if (!env->sd->parent) { +- struct root_domain *rd = env->dst_rq->rd; +- + /* update overload indicator if we are at root domain */ +- WRITE_ONCE(rd->overload, sg_status & SG_OVERLOAD); ++ WRITE_ONCE(env->dst_rq->rd->overload, sg_status & SG_OVERLOAD); + + /* Update over-utilization (tipping point, U >= 0) indicator */ +- WRITE_ONCE(rd->overutilized, sg_status & SG_OVERUTILIZED); +- trace_sched_overutilized_tp(rd, sg_status & SG_OVERUTILIZED); ++ set_rd_overutilized_status(env->dst_rq->rd, ++ sg_status & SG_OVERUTILIZED); + } else if (sg_status & SG_OVERUTILIZED) { +- struct root_domain *rd = env->dst_rq->rd; +- +- WRITE_ONCE(rd->overutilized, SG_OVERUTILIZED); +- trace_sched_overutilized_tp(rd, SG_OVERUTILIZED); ++ set_rd_overutilized_status(env->dst_rq->rd, SG_OVERUTILIZED); + } + + update_idle_cpu_scan(env, sum_util); +@@ -11460,7 +11475,7 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued) + task_tick_numa(rq, curr); + + update_misfit_status(curr, rq); +- update_overutilized_status(task_rq(curr)); ++ check_update_overutilized_status(task_rq(curr)); + + task_tick_core(rq, curr); + } +-- +2.43.0 + diff --git a/queue-5.15/sched-fair-allow-disabling-sched_balance_newidle-wit.patch b/queue-5.15/sched-fair-allow-disabling-sched_balance_newidle-wit.patch new file mode 100644 index 00000000000..54d900314ad --- /dev/null +++ b/queue-5.15/sched-fair-allow-disabling-sched_balance_newidle-wit.patch @@ -0,0 +1,64 @@ +From d738a7d45fb96abe13cb13298874205168cf6e41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 18:05:23 +0300 +Subject: sched/fair: Allow disabling sched_balance_newidle with + sched_relax_domain_level + +From: Vitalii Bursov + +[ Upstream commit a1fd0b9d751f840df23ef0e75b691fc00cfd4743 ] + +Change relax_domain_level checks so that it would be possible +to include or exclude all domains from newidle balancing. + +This matches the behavior described in the documentation: + + -1 no request. use system default or follow request of others. + 0 no search. + 1 search siblings (hyperthreads in a core). + +"2" enables levels 0 and 1, level_max excludes the last (level_max) +level, and level_max+1 includes all levels. + +Fixes: 1d3504fcf560 ("sched, cpuset: customize sched domains, core") +Signed-off-by: Vitalii Bursov +Signed-off-by: Ingo Molnar +Tested-by: Dietmar Eggemann +Reviewed-by: Vincent Guittot +Reviewed-by: Valentin Schneider +Link: https://lore.kernel.org/r/bd6de28e80073c79466ec6401cdeae78f0d4423d.1714488502.git.vitaly@bursov.com +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 2 +- + kernel/sched/topology.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 6905079c15c25..82df5a07a8696 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1938,7 +1938,7 @@ bool current_cpuset_is_being_rebound(void) + static int update_relax_domain_level(struct cpuset *cs, s64 val) + { + #ifdef CONFIG_SMP +- if (val < -1 || val >= sched_domain_level_max) ++ if (val < -1 || val > sched_domain_level_max + 1) + return -EINVAL; + #endif + +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 4e8698e62f075..8c82ca3aa652f 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1405,7 +1405,7 @@ static void set_domain_attribute(struct sched_domain *sd, + } else + request = attr->relax_domain_level; + +- if (sd->level > request) { ++ if (sd->level >= request) { + /* Turn off idle balance on this domain: */ + sd->flags &= ~(SD_BALANCE_WAKE|SD_BALANCE_NEWIDLE); + } +-- +2.43.0 + diff --git a/queue-5.15/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch b/queue-5.15/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch new file mode 100644 index 00000000000..7b355f6a8a7 --- /dev/null +++ b/queue-5.15/scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch @@ -0,0 +1,49 @@ +From e7843892f699152b739ddbe499f97034aa848be7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:44:20 +0700 +Subject: scsi: bfa: Ensure the copied buf is NUL terminated + +From: Bui Quang Minh + +[ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ] + +Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from +userspace to that buffer. Later, we use sscanf on this buffer but we don't +ensure that the string is terminated inside the buffer, this can lead to +OOB read when using sscanf. Fix this issue by using memdup_user_nul instead +of memdup_user. + +Fixes: 9f30b674759b ("bfa: replace 2 kzalloc/copy_from_user by memdup_user") +Signed-off-by: Bui Quang Minh +Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bfa/bfad_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c +index fd1b378a263a0..d3c7d4423c514 100644 +--- a/drivers/scsi/bfa/bfad_debugfs.c ++++ b/drivers/scsi/bfa/bfad_debugfs.c +@@ -250,7 +250,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, + unsigned long flags; + void *kern_buf; + +- kern_buf = memdup_user(buf, nbytes); ++ kern_buf = memdup_user_nul(buf, nbytes); + if (IS_ERR(kern_buf)) + return PTR_ERR(kern_buf); + +@@ -317,7 +317,7 @@ bfad_debugfs_write_regwr(struct file *file, const char __user *buf, + unsigned long flags; + void *kern_buf; + +- kern_buf = memdup_user(buf, nbytes); ++ kern_buf = memdup_user_nul(buf, nbytes); + if (IS_ERR(kern_buf)) + return PTR_ERR(kern_buf); + +-- +2.43.0 + diff --git a/queue-5.15/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch b/queue-5.15/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch new file mode 100644 index 00000000000..4345e143b68 --- /dev/null +++ b/queue-5.15/scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch @@ -0,0 +1,41 @@ +From d47d990fffb44456474d285fd0833593154a0ffd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 20:04:47 +0300 +Subject: scsi: hpsa: Fix allocation size for Scsi_Host private data + +From: Yuri Karpov + +[ Upstream commit 504e2bed5d50610c1836046c0c195b0a6dba9c72 ] + +struct Scsi_Host private data contains pointer to struct ctlr_info. + +Restore allocation of only 8 bytes to store pointer in struct Scsi_Host +private data area. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bbbd25499100 ("scsi: hpsa: Fix allocation size for scsi_host_alloc()") +Signed-off-by: Yuri Karpov +Link: https://lore.kernel.org/r/20240312170447.743709-1-YKarpov@ispras.ru +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 8aa5c22ae3ff9..b54c8aa8e8035 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -5848,7 +5848,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h) + { + struct Scsi_Host *sh; + +- sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info)); ++ sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info *)); + if (sh == NULL) { + dev_err(&h->pdev->dev, "scsi_host_alloc failed\n"); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.15/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch b/queue-5.15/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch new file mode 100644 index 00000000000..7610d4370ea --- /dev/null +++ b/queue-5.15/scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch @@ -0,0 +1,55 @@ +From 42aa19e6bf42f7acf203d9c51a3bada8080c13e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 14:11:03 +0000 +Subject: scsi: libsas: Fix the failure of adding phy with zero-address to port + +From: Xingui Yang + +[ Upstream commit 06036a0a5db34642c5dbe22021a767141f010b7a ] + +As of commit 7d1d86518118 ("[SCSI] libsas: fix false positive 'device +attached' conditions"), reset the phy->entacted_sas_addr address to a +zero-address when the link rate is less than 1.5G. + +Currently we find that when a new device is attached, and the link rate is +less than 1.5G, but the device type is not NO_DEVICE, for example: the link +rate is SAS_PHY_RESET_IN_PROGRESS and the device type is stp. After setting +the phy->entacted_sas_addr address to the zero address, the port will +continue to be created for the phy with the zero-address, and other phys +with the zero-address will be tried to be added to the new port: + +[562240.051197] sas: ex 500e004aaaaaaa1f phy19:U:0 attached: 0000000000000000 (no device) +// phy19 is deleted but still on the parent port's phy_list +[562240.062536] sas: ex 500e004aaaaaaa1f phy0 new device attached +[562240.062616] sas: ex 500e004aaaaaaa1f phy00:U:5 attached: 0000000000000000 (stp) +[562240.062680] port-7:7:0: trying to add phy phy-7:7:19 fails: it's already part of another port + +Therefore, it should be the same as sas_get_phy_attached_dev(). Only when +device_type is SAS_PHY_UNUSED, sas_address is set to the 0 address. + +Fixes: 7d1d86518118 ("[SCSI] libsas: fix false positive 'device attached' conditions") +Signed-off-by: Xingui Yang +Link: https://lore.kernel.org/r/20240312141103.31358-5-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 9ae35631135d8..ee6607dfcdfa5 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -256,8 +256,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp) + /* help some expanders that fail to zero sas_address in the 'no + * device' case + */ +- if (phy->attached_dev_type == SAS_PHY_UNUSED || +- phy->linkrate < SAS_LINK_RATE_1_5_GBPS) ++ if (phy->attached_dev_type == SAS_PHY_UNUSED) + memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE); + else + memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE); +-- +2.43.0 + diff --git a/queue-5.15/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch b/queue-5.15/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch new file mode 100644 index 00000000000..0a4dcfc021b --- /dev/null +++ b/queue-5.15/scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch @@ -0,0 +1,40 @@ +From 393ea85d12ae7fa64ccc4802dd1d96107c5c597d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 21:44:21 +0700 +Subject: scsi: qedf: Ensure the copied buf is NUL terminated + +From: Bui Quang Minh + +[ Upstream commit d0184a375ee797eb657d74861ba0935b6e405c62 ] + +Currently, we allocate a count-sized kernel buffer and copy count from +userspace to that buffer. Later, we use kstrtouint on this buffer but we +don't ensure that the string is terminated inside the buffer, this can +lead to OOB read when using kstrtouint. Fix this issue by using +memdup_user_nul instead of memdup_user. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Signed-off-by: Bui Quang Minh +Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-4-f1f1b53a10f4@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index 451fd236bfd05..96174353e3898 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -170,7 +170,7 @@ qedf_dbg_debug_cmd_write(struct file *filp, const char __user *buffer, + if (!count || *ppos) + return 0; + +- kern_buf = memdup_user(buffer, count); ++ kern_buf = memdup_user_nul(buffer, count); + if (IS_ERR(kern_buf)) + return PTR_ERR(kern_buf); + +-- +2.43.0 + diff --git a/queue-5.15/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch b/queue-5.15/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch new file mode 100644 index 00000000000..affb27a83e9 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch @@ -0,0 +1,43 @@ +From 47be757829865ae19dad821b604c05277a7b84b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 02:00:56 +0000 +Subject: scsi: qla2xxx: Fix debugfs output for fw_resource_count + +From: Himanshu Madhani + +[ Upstream commit 998d09c5ef6183bd8137d1a892ba255b15978bb4 ] + +DebugFS output for fw_resource_count shows: + +estimate exchange used[0] high water limit [1945] n estimate iocb2 used [0] high water limit [5141] + estimate exchange2 used[0] high water limit [1945] + +Which shows incorrect display due to missing newline in seq_print(). + +[mkp: fix checkpatch warning about space before newline] + +Fixes: 5f63a163ed2f ("scsi: qla2xxx: Fix exchange oversubscription for management commands") +Signed-off-by: Himanshu Madhani +Link: https://lore.kernel.org/r/20240426020056.3639406-1-himanshu.madhani@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_dfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c +index af921fd150d1e..73695c6815fac 100644 +--- a/drivers/scsi/qla2xxx/qla_dfs.c ++++ b/drivers/scsi/qla2xxx/qla_dfs.c +@@ -274,7 +274,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) + seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n", + iocbs_used, ha->base_qpair->fwres.iocbs_limit); + +- seq_printf(s, "estimate exchange used[%d] high water limit [%d] n", ++ seq_printf(s, "estimate exchange used[%d] high water limit [%d]\n", + exch_used, ha->base_qpair->fwres.exch_limit); + + if (ql2xenforce_iocb_limit == 2) { +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch b/queue-5.15/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch new file mode 100644 index 00000000000..1c785a5180b --- /dev/null +++ b/queue-5.15/scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch @@ -0,0 +1,50 @@ +From 8df3d3d47b5ba368fdeb17b04be3c77fdfafebc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:48 -0500 +Subject: scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV + +From: Andrew Halaney + +[ Upstream commit b715c55daf598aac8fa339048e4ca8a0916b332e ] + +Currently, HCLKDIV is written to and then completed with an mb(). + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: d90996dae8e4 ("scsi: ufs: Add UFS platform driver for Cadence UFS") +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-6-181252004586@redhat.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/cdns-pltfrm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/cdns-pltfrm.c b/drivers/scsi/ufs/cdns-pltfrm.c +index 7da8be2f35c42..07a2580e4e56c 100644 +--- a/drivers/scsi/ufs/cdns-pltfrm.c ++++ b/drivers/scsi/ufs/cdns-pltfrm.c +@@ -136,7 +136,7 @@ static int cdns_ufs_set_hclkdiv(struct ufs_hba *hba) + * Make sure the register was updated, + * UniPro layer will not work with an incorrect value. + */ +- mb(); ++ ufshcd_readl(hba, CDNS_UFS_REG_HCLKDIV); + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-inte.patch b/queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-inte.patch new file mode 100644 index 00000000000..d6ad14e121e --- /dev/null +++ b/queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-inte.patch @@ -0,0 +1,53 @@ +From b78298767f939de043d8feba1cf832d1cd812cd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:50 -0500 +Subject: scsi: ufs: core: Perform read back after disabling interrupts + +From: Andrew Halaney + +[ Upstream commit e4a628877119bd40164a651d20321247b6f94a8b ] + +Currently, interrupts are cleared and disabled prior to registering the +interrupt. An mb() is used to complete the clear/disable writes before the +interrupt is registered. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring these +bits have taken effect on the device is to perform a read back to force it +to make it all the way to the device. This is documented in device-io.rst +and a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure these bits hit the device. Because the mb()'s +purpose wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: 199ef13cac7d ("scsi: ufs: avoid spurious UFS host controller interrupts") +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Bart Van Assche +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-8-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 03b33c34f7024..1b8fdeb053529 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -9500,7 +9500,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + * Make sure that UFS interrupts are disabled and any pending interrupt + * status is cleared before registering UFS interrupt handler. + */ +- mb(); ++ ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + + /* IRQ registration */ + err = devm_request_irq(dev, irq, ufshcd_intr, IRQF_SHARED, UFSHCD, hba); +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch b/queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch new file mode 100644 index 00000000000..5d884a05285 --- /dev/null +++ b/queue-5.15/scsi-ufs-core-perform-read-back-after-disabling-uic_.patch @@ -0,0 +1,52 @@ +From 81a3e2dcae63be895248c081b27eaaee7455cfd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:51 -0500 +Subject: scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL + +From: Andrew Halaney + +[ Upstream commit 4bf3855497b60765ca03b983d064b25e99b97657 ] + +Currently, the UIC_COMMAND_COMPL interrupt is disabled and a wmb() is used +to complete the register write before any following writes. + +wmb() ensures the writes complete in that order, but completion doesn't +mean that it isn't stored in a buffer somewhere. The recommendation for +ensuring this bit has taken effect on the device is to perform a read back +to force it to make it all the way to the device. This is documented in +device-io.rst and a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the wmb()'s +purpose wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: d75f7fe495cf ("scsi: ufs: reduce the interrupts for power mode change requests") +Reviewed-by: Bart Van Assche +Reviewed-by: Can Guo +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-9-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 1b8fdeb053529..b7abf1f6410c8 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -3960,7 +3960,7 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd) + * Make sure UIC command completion interrupt is disabled before + * issuing UIC command. + */ +- wmb(); ++ ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + reenable_intr = true; + } + spin_unlock_irqrestore(hba->host->host_lock, flags); +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch new file mode 100644 index 00000000000..1aec95d6150 --- /dev/null +++ b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch @@ -0,0 +1,51 @@ +From 423df859f08e5441bebd3187aa43a2c69fa2aa55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:47 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing CGC enable + +From: Andrew Halaney + +[ Upstream commit d9488511b3ac7eb48a91bc5eded7027525525e03 ] + +Currently, the CGC enable bit is written and then an mb() is used to ensure +that completes before continuing. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Can Guo +Fixes: 81c0fc51b7a7 ("ufs-qcom: add support for Qualcomm Technologies Inc platforms") +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-5-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index ce45f3e8a35c3..361df2a2db5bf 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -353,7 +353,7 @@ static void ufs_qcom_enable_hw_clk_gating(struct ufs_hba *hba) + REG_UFS_CFG2); + + /* Ensure that HW clock gating is enabled before next operations */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_CFG2); + } + + static int ufs_qcom_hce_enable_notify(struct ufs_hba *hba, +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch new file mode 100644 index 00000000000..d56193d8553 --- /dev/null +++ b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch @@ -0,0 +1,51 @@ +From 418cff2c3074e762e43e14e1a4a2e9fc31be7e55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:44 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US + +From: Andrew Halaney + +[ Upstream commit a862fafa263aea0f427d51aca6ff7fd9eeaaa8bd ] + +Currently after writing to REG_UFS_SYS1CLK_1US a mb() is used to ensure +that write has gone through to the device. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. Because the mb()'s purpose +wasn't to add extra ordering (on top of the ordering guaranteed by +writel()/readl()), it can safely be removed. + +Fixes: f06fcc7155dc ("scsi: ufs-qcom: add QUniPro hardware support and power optimizations") +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-2-181252004586@redhat.com +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index f810b99ef5c51..4809ced13851e 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -449,7 +449,7 @@ static int ufs_qcom_cfg_timers(struct ufs_hba *hba, u32 gear, + * make sure above write gets applied before we return from + * this function. + */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_SYS1CLK_1US); + } + + if (ufs_qcom_cap_qunipro(host)) +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch new file mode 100644 index 00000000000..c777f168f01 --- /dev/null +++ b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch @@ -0,0 +1,71 @@ +From fbdf57eb5f23e0244fe6fd87ed1dbe98b33d0f8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:43 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing reset bit + +From: Andrew Halaney + +[ Upstream commit c4d28e06b0c94636f6e35d003fa9ebac0a94e1ae ] + +Currently, the reset bit for the UFS provided reset controller (used by its +phy) is written to, and then a mb() happens to try and ensure that hit the +device. Immediately afterwards a usleep_range() occurs. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +Let's do that to ensure the bit hits the device. By doing so and +guaranteeing the ordering against the immediately following usleep_range(), +the mb() can safely be removed. + +Fixes: 81c0fc51b7a7 ("ufs-qcom: add support for Qualcomm Technologies Inc platforms") +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Can Guo +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-1-181252004586@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.h b/drivers/scsi/ufs/ufs-qcom.h +index 8208e3a3ef59d..a2f32aa1ce1b8 100644 +--- a/drivers/scsi/ufs/ufs-qcom.h ++++ b/drivers/scsi/ufs/ufs-qcom.h +@@ -145,10 +145,10 @@ static inline void ufs_qcom_assert_reset(struct ufs_hba *hba) + 1 << OFFSET_UFS_PHY_SOFT_RESET, REG_UFS_CFG1); + + /* +- * Make sure assertion of ufs phy reset is written to +- * register before returning ++ * Dummy read to ensure the write takes effect before doing any sort ++ * of delay + */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_CFG1); + } + + static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba) +@@ -157,10 +157,10 @@ static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba) + 0 << OFFSET_UFS_PHY_SOFT_RESET, REG_UFS_CFG1); + + /* +- * Make sure de-assertion of ufs phy reset is written to +- * register before returning ++ * Dummy read to ensure the write takes effect before doing any sort ++ * of delay + */ +- mb(); ++ ufshcd_readl(hba, REG_UFS_CFG1); + } + + /* Host controller hardware version: major.minor.step */ +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch new file mode 100644 index 00000000000..bbc8e085fcc --- /dev/null +++ b/queue-5.15/scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch @@ -0,0 +1,52 @@ +From e968f240172bc7b15754edc32491992f93110ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 15:46:46 -0500 +Subject: scsi: ufs: qcom: Perform read back after writing unipro mode + +From: Andrew Halaney + +[ Upstream commit 823150ecf04f958213cf3bf162187cd1a91c885c ] + +Currently, the QUNIPRO_SEL bit is written to and then an mb() is used to +ensure that completes before continuing. + +mb() ensures that the write completes, but completion doesn't mean that it +isn't stored in a buffer somewhere. The recommendation for ensuring this +bit has taken effect on the device is to perform a read back to force it to +make it all the way to the device. This is documented in device-io.rst and +a talk by Will Deacon on this can be seen over here: + + https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678 + +But, there's really no reason to even ensure completion before +continuing. The only requirement here is that this write is ordered to this +endpoint (which readl()/writel() guarantees already). For that reason the +mb() can be dropped altogether without anything forcing completion. + +Fixes: f06fcc7155dc ("scsi: ufs-qcom: add QUniPro hardware support and power optimizations") +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20240329-ufs-reset-ensure-effect-before-delay-v5-4-181252004586@redhat.com +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index fb82a27ac9aaa..ce45f3e8a35c3 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -245,9 +245,6 @@ static void ufs_qcom_select_unipro_mode(struct ufs_qcom_host *host) + + if (host->hw_ver.major == 0x05) + ufshcd_rmwl(host->hba, QUNIPRO_G4_SEL, 0, REG_UFS_CFG0); +- +- /* make sure above configuration is applied before we return */ +- mb(); + } + + /* +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-ufs-qcom-clear-qunipro_g4_sel-for-hw-versio.patch b/queue-5.15/scsi-ufs-ufs-qcom-clear-qunipro_g4_sel-for-hw-versio.patch new file mode 100644 index 00000000000..0f8341130a5 --- /dev/null +++ b/queue-5.15/scsi-ufs-ufs-qcom-clear-qunipro_g4_sel-for-hw-versio.patch @@ -0,0 +1,76 @@ +From dd6b4daef4fcc0efffabe359d77f0a9133a548c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 17:14:05 +0200 +Subject: scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5 + +From: Abel Vesa + +[ Upstream commit 9c02aa24bf404a39ec509d9f50539056b9b128f7 ] + +On SM8550, depending on the Qunipro, we can run with G5 or G4. For now, +when the major version is 5 or above, we go with G5. Therefore, we need to +specifically tell UFS HC that. + +Signed-off-by: Abel Vesa +Signed-off-by: Martin K. Petersen +Stable-dep-of: 823150ecf04f ("scsi: ufs: qcom: Perform read back after writing unipro mode") +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.c | 8 ++++++-- + drivers/scsi/ufs/ufs-qcom.h | 6 +++++- + 2 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index 4809ced13851e..fb82a27ac9aaa 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -242,6 +242,10 @@ static void ufs_qcom_select_unipro_mode(struct ufs_qcom_host *host) + ufshcd_rmwl(host->hba, QUNIPRO_SEL, + ufs_qcom_cap_qunipro(host) ? QUNIPRO_SEL : 0, + REG_UFS_CFG1); ++ ++ if (host->hw_ver.major == 0x05) ++ ufshcd_rmwl(host->hba, QUNIPRO_G4_SEL, 0, REG_UFS_CFG0); ++ + /* make sure above configuration is applied before we return */ + mb(); + } +@@ -515,9 +519,9 @@ static int ufs_qcom_cfg_timers(struct ufs_hba *hba, u32 gear, + mb(); + } + +- if (update_link_startup_timer) { ++ if (update_link_startup_timer && host->hw_ver.major != 0x5) { + ufshcd_writel(hba, ((core_clk_rate / MSEC_PER_SEC) * 100), +- REG_UFS_PA_LINK_STARTUP_TIMER); ++ REG_UFS_CFG0); + /* + * make sure that this configuration is applied before + * we return +diff --git a/drivers/scsi/ufs/ufs-qcom.h b/drivers/scsi/ufs/ufs-qcom.h +index b9f9b246c43b3..6b4584893c30a 100644 +--- a/drivers/scsi/ufs/ufs-qcom.h ++++ b/drivers/scsi/ufs/ufs-qcom.h +@@ -37,7 +37,8 @@ enum { + REG_UFS_PA_ERR_CODE = 0xCC, + /* On older UFS revisions, this register is called "RETRY_TIMER_REG" */ + REG_UFS_PARAM0 = 0xD0, +- REG_UFS_PA_LINK_STARTUP_TIMER = 0xD8, ++ /* On older UFS revisions, this register is called "REG_UFS_PA_LINK_STARTUP_TIMER" */ ++ REG_UFS_CFG0 = 0xD8, + REG_UFS_CFG1 = 0xDC, + REG_UFS_CFG2 = 0xE0, + REG_UFS_HW_VERSION = 0xE4, +@@ -75,6 +76,9 @@ enum { + #define UFS_CNTLR_2_x_x_VEN_REGS_OFFSET(x) (0x000 + x) + #define UFS_CNTLR_3_x_x_VEN_REGS_OFFSET(x) (0x400 + x) + ++/* bit definitions for REG_UFS_CFG0 register */ ++#define QUNIPRO_G4_SEL BIT(5) ++ + /* bit definitions for REG_UFS_CFG1 register */ + #define QUNIPRO_SEL 0x1 + #define UTP_DBG_RAMS_EN 0x20000 +-- +2.43.0 + diff --git a/queue-5.15/scsi-ufs-ufs-qcom-fix-the-qcom-register-name-for-off.patch b/queue-5.15/scsi-ufs-ufs-qcom-fix-the-qcom-register-name-for-off.patch new file mode 100644 index 00000000000..3f8cd494cde --- /dev/null +++ b/queue-5.15/scsi-ufs-ufs-qcom-fix-the-qcom-register-name-for-off.patch @@ -0,0 +1,41 @@ +From ef0faaec0ea5fc21528a5095ca4b138d7fe8c035 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 19:39:55 +0530 +Subject: scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0 + +From: Manivannan Sadhasivam + +[ Upstream commit 7959587f3284bf163e4f1baff3c6fa71fc6a55b1 ] + +On newer UFS revisions, the register at offset 0xD0 is called, +REG_UFS_PARAM0. Since the existing register, RETRY_TIMER_REG is not used +anywhere, it is safe to use the new name. + +Reviewed-by: Andrew Halaney +Reviewed-by: Asutosh Das +Tested-by: Andrew Halaney # Qdrive3/sa8540p-ride +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Martin K. Petersen +Stable-dep-of: 823150ecf04f ("scsi: ufs: qcom: Perform read back after writing unipro mode") +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.h b/drivers/scsi/ufs/ufs-qcom.h +index a2f32aa1ce1b8..b9f9b246c43b3 100644 +--- a/drivers/scsi/ufs/ufs-qcom.h ++++ b/drivers/scsi/ufs/ufs-qcom.h +@@ -35,7 +35,8 @@ enum { + REG_UFS_TX_SYMBOL_CLK_NS_US = 0xC4, + REG_UFS_LOCAL_PORT_ID_REG = 0xC8, + REG_UFS_PA_ERR_CODE = 0xCC, +- REG_UFS_RETRY_TIMER_REG = 0xD0, ++ /* On older UFS revisions, this register is called "RETRY_TIMER_REG" */ ++ REG_UFS_PARAM0 = 0xD0, + REG_UFS_PA_LINK_STARTUP_TIMER = 0xD8, + REG_UFS_CFG1 = 0xDC, + REG_UFS_CFG2 = 0xE0, +-- +2.43.0 + diff --git a/queue-5.15/selftests-binderfs-use-the-makefile-s-rules-not-make.patch b/queue-5.15/selftests-binderfs-use-the-makefile-s-rules-not-make.patch new file mode 100644 index 00000000000..d562dba2f6c --- /dev/null +++ b/queue-5.15/selftests-binderfs-use-the-makefile-s-rules-not-make.patch @@ -0,0 +1,71 @@ +From 90b4b9fa2fb27181c0b20aa715f0c9b7aff3df34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 18:58:20 -0700 +Subject: selftests/binderfs: use the Makefile's rules, not Make's implicit + rules + +From: John Hubbard + +[ Upstream commit 019baf635eb6ffe8d6c1343f81788f02a7e0ed98 ] + +First of all, in order to build with clang at all, one must first apply +Valentin Obst's build fix for LLVM [1]. Once that is done, then when +building with clang, via: + + make LLVM=1 -C tools/testing/selftests + +...the following error occurs: + + clang: error: cannot specify -o when generating multiple output files + +This is because clang, unlike gcc, won't accept invocations of this +form: + + clang file1.c header2.h + +While trying to fix this, I noticed that: + +a) selftests/lib.mk already avoids the problem, and + +b) The binderfs Makefile indavertently bypasses the selftests/lib.mk +build system, and quitely uses Make's implicit build rules for .c files +instead. + +The Makefile attempts to set up both a dependency and a source file, +neither of which was needed, because lib.mk is able to automatically +handle both. This line: + + binderfs_test: binderfs_test.c + +...causes Make's implicit rules to run, which builds binderfs_test +without ever looking at lib.mk. + +Fix this by simply deleting the "binderfs_test:" Makefile target and +letting lib.mk handle it instead. + +[1] https://lore.kernel.org/all/20240329-selftests-libmk-llvm-rfc-v1-1-2f9ed7d1c49f@valentinobst.de/ + +Fixes: 6e29225af902 ("binderfs: port tests to test harness infrastructure") +Cc: Christian Brauner +Signed-off-by: John Hubbard +Reviewed-by: Christian Brauner +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/filesystems/binderfs/Makefile | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/filesystems/binderfs/Makefile b/tools/testing/selftests/filesystems/binderfs/Makefile +index 8af25ae960498..24d8910c7ab58 100644 +--- a/tools/testing/selftests/filesystems/binderfs/Makefile ++++ b/tools/testing/selftests/filesystems/binderfs/Makefile +@@ -3,6 +3,4 @@ + CFLAGS += -I../../../../../usr/include/ -pthread + TEST_GEN_PROGS := binderfs_test + +-binderfs_test: binderfs_test.c ../../kselftest.h ../../kselftest_harness.h +- + include ../../lib.mk +-- +2.43.0 + diff --git a/queue-5.15/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch b/queue-5.15/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch new file mode 100644 index 00000000000..517d6e1a3a3 --- /dev/null +++ b/queue-5.15/selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch @@ -0,0 +1,43 @@ +From 2f6a59f5ec112a35f6c96ce62143dbfa65f9d203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 13:18:40 +0800 +Subject: selftests/bpf: Fix umount cgroup2 error in test_sockmap + +From: Geliang Tang + +[ Upstream commit d75142dbeb2bd1587b9cc19f841578f541275a64 ] + +This patch fixes the following "umount cgroup2" error in test_sockmap.c: + + (cgroup_helpers.c:353: errno: Device or resource busy) umount cgroup2 + +Cgroup fd cg_fd should be closed before cleanup_cgroup_environment(). + +Fixes: 13a5f3ffd202 ("bpf: Selftests, sockmap test prog run without setting cgroup") +Signed-off-by: Geliang Tang +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/0399983bde729708773416b8488bac2cd5e022b8.1712639568.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index eefd445b96fc7..7465cbe19bb08 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -2014,9 +2014,9 @@ int main(int argc, char **argv) + free(options.whitelist); + if (options.blacklist) + free(options.blacklist); ++ close(cg_fd); + if (cg_created) + cleanup_cgroup_environment(); +- close(cg_fd); + return err; + } + +-- +2.43.0 + diff --git a/queue-5.15/selftests-kcmp-make-the-test-output-consistent-and-c.patch b/queue-5.15/selftests-kcmp-make-the-test-output-consistent-and-c.patch new file mode 100644 index 00000000000..970b614a661 --- /dev/null +++ b/queue-5.15/selftests-kcmp-make-the-test-output-consistent-and-c.patch @@ -0,0 +1,82 @@ +From 5baadecdfd4ce0cc55831c7e855f2a6d8ddf0197 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 00:58:22 +0530 +Subject: selftests/kcmp: Make the test output consistent and clear + +From: Gautam Menghani + +[ Upstream commit ff682226a353d88ffa5db9c2a9b945066776311e ] + +Make the output format of this test consistent. Currently the output is +as follows: + ++TAP version 13 ++1..1 ++# selftests: kcmp: kcmp_test ++# pid1: 45814 pid2: 45815 FD: 1 FILES: 1 VM: 2 FS: 1 SIGHAND: 2 ++ IO: 0 SYSVSEM: 0 INV: -1 ++# PASS: 0 returned as expected ++# PASS: 0 returned as expected ++# PASS: 0 returned as expected ++# # Planned tests != run tests (0 != 3) ++# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 ++# # Planned tests != run tests (0 != 3) ++# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 ++# # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 ++ok 1 selftests: kcmp: kcmp_test + +With this patch applied the output is as follows: + ++TAP version 13 ++1..1 ++# selftests: kcmp: kcmp_test ++# TAP version 13 ++# 1..3 ++# pid1: 46330 pid2: 46331 FD: 1 FILES: 2 VM: 2 FS: 2 SIGHAND: 1 ++ IO: 0 SYSVSEM: 0 INV: -1 ++# PASS: 0 returned as expected ++# PASS: 0 returned as expected ++# PASS: 0 returned as expected ++# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 ++ok 1 selftests: kcmp: kcmp_test + +Signed-off-by: Gautam Menghani +Signed-off-by: Shuah Khan +Stable-dep-of: eb59a5811371 ("selftests/kcmp: remove unused open mode") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kcmp/kcmp_test.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/kcmp/kcmp_test.c b/tools/testing/selftests/kcmp/kcmp_test.c +index 6ea7b9f37a411..25110c7c0b3ed 100644 +--- a/tools/testing/selftests/kcmp/kcmp_test.c ++++ b/tools/testing/selftests/kcmp/kcmp_test.c +@@ -88,6 +88,9 @@ int main(int argc, char **argv) + int pid2 = getpid(); + int ret; + ++ ksft_print_header(); ++ ksft_set_plan(3); ++ + fd2 = open(kpath, O_RDWR, 0644); + if (fd2 < 0) { + perror("Can't open file"); +@@ -152,7 +155,6 @@ int main(int argc, char **argv) + ksft_inc_pass_cnt(); + } + +- ksft_print_cnts(); + + if (ret) + ksft_exit_fail(); +@@ -162,5 +164,5 @@ int main(int argc, char **argv) + + waitpid(pid2, &status, P_ALL); + +- return ksft_exit_pass(); ++ return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/selftests-kcmp-remove-unused-open-mode.patch b/queue-5.15/selftests-kcmp-remove-unused-open-mode.patch new file mode 100644 index 00000000000..58bca71ad3d --- /dev/null +++ b/queue-5.15/selftests-kcmp-remove-unused-open-mode.patch @@ -0,0 +1,42 @@ +From bb77d8ddc85d03a0d706998a32402fe68e8ab8d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 23:46:09 +0000 +Subject: selftests/kcmp: remove unused open mode + +From: Edward Liaw + +[ Upstream commit eb59a58113717df04b8a8229befd8ab1e5dbf86e ] + +Android bionic warns that open modes are ignored if O_CREAT or O_TMPFILE +aren't specified. The permissions for the file are set above: + + fd1 = open(kpath, O_RDWR | O_CREAT | O_TRUNC, 0644); + +Link: https://lkml.kernel.org/r/20240429234610.191144-1-edliaw@google.com +Fixes: d97b46a64674 ("syscalls, x86: add __NR_kcmp syscall") +Signed-off-by: Edward Liaw +Reviewed-by: Cyrill Gorcunov +Cc: Eric Biederman +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kcmp/kcmp_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kcmp/kcmp_test.c b/tools/testing/selftests/kcmp/kcmp_test.c +index 25110c7c0b3ed..d7a8e321bb16b 100644 +--- a/tools/testing/selftests/kcmp/kcmp_test.c ++++ b/tools/testing/selftests/kcmp/kcmp_test.c +@@ -91,7 +91,7 @@ int main(int argc, char **argv) + ksft_print_header(); + ksft_set_plan(3); + +- fd2 = open(kpath, O_RDWR, 0644); ++ fd2 = open(kpath, O_RDWR); + if (fd2 < 0) { + perror("Can't open file"); + ksft_exit_fail(); +-- +2.43.0 + diff --git a/queue-5.15/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch b/queue-5.15/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch new file mode 100644 index 00000000000..4fb73b44561 --- /dev/null +++ b/queue-5.15/selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch @@ -0,0 +1,82 @@ +From fc6e455d08e91be6d6c2e54606118f3142782e21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:52:57 +0300 +Subject: selftests: net: bridge: increase IGMP/MLD exclude timeout membership + interval + +From: Nikolay Aleksandrov + +[ Upstream commit 06080ea23095afe04a2cb7a8d05fab4311782623 ] + +When running the bridge IGMP/MLD selftests on debug kernels we can get +spurious errors when setting up the IGMP/MLD exclude timeout tests +because the membership interval is just 3 seconds and the setup has 2 +seconds of sleep plus various validations, the one second that is left +is not enough. Increase the membership interval from 3 to 5 seconds to +make room for the setup validation and 2 seconds of sleep. + +Fixes: 34d7ecb3d4f7 ("selftests: net: bridge: update IGMP/MLD membership interval value") +Reported-by: Jakub Kicinski +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/bridge_igmp.sh | 6 +++--- + tools/testing/selftests/net/forwarding/bridge_mld.sh | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/bridge_igmp.sh b/tools/testing/selftests/net/forwarding/bridge_igmp.sh +index 1162836f8f329..6dc3cb4ac6081 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_igmp.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_igmp.sh +@@ -481,10 +481,10 @@ v3exc_timeout_test() + RET=0 + local X=("192.0.2.20" "192.0.2.30") + +- # GMI should be 3 seconds ++ # GMI should be 5 seconds + ip link set dev br0 type bridge mcast_query_interval 100 \ + mcast_query_response_interval 100 \ +- mcast_membership_interval 300 ++ mcast_membership_interval 500 + + v3exclude_prepare $h1 $ALL_MAC $ALL_GROUP + ip link set dev br0 type bridge mcast_query_interval 500 \ +@@ -492,7 +492,7 @@ v3exc_timeout_test() + mcast_membership_interval 1500 + + $MZ $h1 -c 1 -b $ALL_MAC -B $ALL_GROUP -t ip "proto=2,p=$MZPKT_ALLOW2" -q +- sleep 3 ++ sleep 5 + bridge -j -d -s mdb show dev br0 \ + | jq -e ".[].mdb[] | \ + select(.grp == \"$TEST_GROUP\" and \ +diff --git a/tools/testing/selftests/net/forwarding/bridge_mld.sh b/tools/testing/selftests/net/forwarding/bridge_mld.sh +index e2b9ff773c6b6..f84ab2e657547 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_mld.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_mld.sh +@@ -478,10 +478,10 @@ mldv2exc_timeout_test() + RET=0 + local X=("2001:db8:1::20" "2001:db8:1::30") + +- # GMI should be 3 seconds ++ # GMI should be 5 seconds + ip link set dev br0 type bridge mcast_query_interval 100 \ + mcast_query_response_interval 100 \ +- mcast_membership_interval 300 ++ mcast_membership_interval 500 + + mldv2exclude_prepare $h1 + ip link set dev br0 type bridge mcast_query_interval 500 \ +@@ -489,7 +489,7 @@ mldv2exc_timeout_test() + mcast_membership_interval 1500 + + $MZ $h1 -c 1 $MZPKT_ALLOW2 -q +- sleep 3 ++ sleep 5 + bridge -j -d -s mdb show dev br0 \ + | jq -e ".[].mdb[] | \ + select(.grp == \"$TEST_GROUP\" and \ +-- +2.43.0 + diff --git a/queue-5.15/selftests-resctrl-fix-clang-build-failure-use-local_.patch b/queue-5.15/selftests-resctrl-fix-clang-build-failure-use-local_.patch new file mode 100644 index 00000000000..bc954092381 --- /dev/null +++ b/queue-5.15/selftests-resctrl-fix-clang-build-failure-use-local_.patch @@ -0,0 +1,60 @@ +From 562171695321d30209d1475ba965f6114f97fc1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 19:17:12 -0700 +Subject: selftests/resctrl: fix clang build failure: use LOCAL_HDRS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Hubbard + +[ Upstream commit d8171aa4ca72f1a67bf3c14c59441d63c1d2585f ] + +First of all, in order to build with clang at all, one must first apply +Valentin Obst's build fix for LLVM [1]. Once that is done, then when +building with clang, via: + + make LLVM=1 -C tools/testing/selftests + +...the following error occurs: + + clang: error: cannot specify -o when generating multiple output files + +This is because clang, unlike gcc, won't accept invocations of this +form: + + clang file1.c header2.h + +Fix this by using selftests/lib.mk facilities for tracking local header +file dependencies: add them to LOCAL_HDRS, leaving only the .c files to +be passed to the compiler. + +[1] https://lore.kernel.org/all/20240329-selftests-libmk-llvm-rfc-v1-1-2f9ed7d1c49f@valentinobst.de/ + +Fixes: 8e289f454289 ("selftests/resctrl: Add resctrl.h into build deps") +Cc: Ilpo Järvinen +Signed-off-by: John Hubbard +Acked-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/Makefile b/tools/testing/selftests/resctrl/Makefile +index 2deac2031de9e..021863f86053a 100644 +--- a/tools/testing/selftests/resctrl/Makefile ++++ b/tools/testing/selftests/resctrl/Makefile +@@ -5,6 +5,8 @@ CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := resctrl_tests + ++LOCAL_HDRS += $(wildcard *.h) ++ + include ../lib.mk + +-$(OUTPUT)/resctrl_tests: $(wildcard *.[ch]) ++$(OUTPUT)/resctrl_tests: $(wildcard *.c) +-- +2.43.0 + diff --git a/queue-5.15/selftests-sud_test-return-correct-emulated-syscall-v.patch b/queue-5.15/selftests-sud_test-return-correct-emulated-syscall-v.patch new file mode 100644 index 00000000000..afa9189227a --- /dev/null +++ b/queue-5.15/selftests-sud_test-return-correct-emulated-syscall-v.patch @@ -0,0 +1,56 @@ +From 8e6de7485dcbb5d062fa64ebe828db32ad319cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 14:44:37 +0100 +Subject: selftests: sud_test: return correct emulated syscall value on RISC-V +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 17c67ed752d6a456602b3dbb25c5ae4d3de5deab ] + +Currently, the sud_test expects the emulated syscall to return the +emulated syscall number. This assumption only works on architectures +were the syscall calling convention use the same register for syscall +number/syscall return value. This is not the case for RISC-V and thus +the return value must be also emulated using the provided ucontext. + +Signed-off-by: Clément Léger +Reviewed-by: Palmer Dabbelt +Acked-by: Palmer Dabbelt +Link: https://lore.kernel.org/r/20231206134438.473166-1-cleger@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + .../selftests/syscall_user_dispatch/sud_test.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/tools/testing/selftests/syscall_user_dispatch/sud_test.c b/tools/testing/selftests/syscall_user_dispatch/sud_test.c +index b5d592d4099e8..d975a67673299 100644 +--- a/tools/testing/selftests/syscall_user_dispatch/sud_test.c ++++ b/tools/testing/selftests/syscall_user_dispatch/sud_test.c +@@ -158,6 +158,20 @@ static void handle_sigsys(int sig, siginfo_t *info, void *ucontext) + + /* In preparation for sigreturn. */ + SYSCALL_DISPATCH_OFF(glob_sel); ++ ++ /* ++ * The tests for argument handling assume that `syscall(x) == x`. This ++ * is a NOP on x86 because the syscall number is passed in %rax, which ++ * happens to also be the function ABI return register. Other ++ * architectures may need to swizzle the arguments around. ++ */ ++#if defined(__riscv) ++/* REG_A7 is not defined in libc headers */ ++# define REG_A7 (REG_A0 + 7) ++ ++ ((ucontext_t *)ucontext)->uc_mcontext.__gregs[REG_A0] = ++ ((ucontext_t *)ucontext)->uc_mcontext.__gregs[REG_A7]; ++#endif + } + + TEST(dispatch_and_return) +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index e7a86004b0b..c8b251dfebe 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -16,3 +16,162 @@ fs-ntfs3-break-dir-enumeration-if-directory-contents-error.patch alsa-core-fix-null-module-pointer-assignment-at-card-init.patch alsa-timer-set-lower-bound-of-start-tick-time.patch alsa-fix-deadlocks-with-kctl-removals-at-disconnection.patch +wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch +dt-bindings-rockchip-grf-add-missing-type-to-pcie-ph.patch +net-usb-qmi_wwan-add-telit-fn920c04-compositions.patch +drm-amd-display-set-color_mgmt_changed-to-true-on-un.patch +selftests-sud_test-return-correct-emulated-syscall-v.patch +regulator-irq_helpers-duplicate-irq-name.patch +asoc-rt5645-fix-the-electric-noise-due-to-the-cbj-co.patch +asoc-dt-bindings-rt5645-add-cbj-sleeve-gpio-property.patch +regulator-vqmmc-ipq4019-fix-module-autoloading.patch +asoc-rt715-add-vendor-clear-control-register.patch +asoc-rt715-sdca-volume-step-modification.patch +softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch +asoc-da7219-aad-fix-usage-of-device_get_named_child_.patch +drm-amdkfd-flush-the-process-wq-before-creating-a-kf.patch +x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch +nvme-find-numa-distance-only-if-controller-has-valid.patch +epoll-be-better-about-file-lifetimes.patch +openpromfs-finish-conversion-to-the-new-mount-api.patch +crypto-bcm-fix-pointer-arithmetic.patch +mm-slub-kunit-use-inverted-data-to-corrupt-kmem-cach.patch +firmware-raspberrypi-use-correct-device-for-dma-mapp.patch +ecryptfs-fix-buffer-size-for-tag-66-packet.patch +nilfs2-fix-out-of-range-warning.patch +parisc-add-missing-export-of-__cmpxchg_u8.patch +crypto-ccp-drop-platform-ifdef-checks.patch +crypto-x86-nh-avx2-add-missing-vzeroupper.patch +crypto-x86-sha256-avx2-add-missing-vzeroupper.patch +crypto-x86-sha512-avx2-add-missing-vzeroupper.patch +s390-cio-fix-tracepoint-subchannel-type-field.patch +jffs2-prevent-xattr-node-from-overflowing-the-eraseb.patch +soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch +null_blk-fix-missing-mutex_destroy-at-module-removal.patch +md-fix-resync-softlockup-when-bitmap-size-is-less-th.patch +wifi-ath10k-poll-service-ready-message-before-failin.patch +x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch +sched-fair-add-eas-checks-before-updating-root_domai.patch +qed-avoid-truncating-work-queue-length.patch +bpf-pack-struct-bpf_fib_lookup.patch +scsi-ufs-qcom-perform-read-back-after-writing-reset-.patch +scsi-ufs-qcom-perform-read-back-after-writing-reg_uf.patch +scsi-ufs-ufs-qcom-fix-the-qcom-register-name-for-off.patch +scsi-ufs-ufs-qcom-clear-qunipro_g4_sel-for-hw-versio.patch +scsi-ufs-qcom-perform-read-back-after-writing-unipro.patch +scsi-ufs-qcom-perform-read-back-after-writing-cgc-en.patch +scsi-ufs-cdns-pltfrm-perform-read-back-after-writing.patch +scsi-ufs-core-perform-read-back-after-disabling-inte.patch +scsi-ufs-core-perform-read-back-after-disabling-uic_.patch +irqchip-alpine-msi-fix-off-by-one-in-allocation-erro.patch +irqchip-loongson-pch-msi-fix-off-by-one-on-allocatio.patch +acpi-disable-wstringop-truncation.patch +gfs2-don-t-forget-to-complete-delayed-withdraw.patch +gfs2-fix-ignore-unlock-failures-after-withdraw.patch +selftests-bpf-fix-umount-cgroup2-error-in-test_sockm.patch +cpufreq-reorganize-checks-in-cpufreq_offline.patch +cpufreq-split-cpufreq_offline.patch +cpufreq-rearrange-locking-in-cpufreq_remove_dev.patch +cpufreq-exit-callback-is-optional.patch +net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch +net-remove-duplicate-reuseport_lookup-functions.patch +udp-avoid-call-to-compute_score-on-multiple-sites.patch +cppc_cpufreq-fix-possible-null-pointer-dereference.patch +scsi-libsas-fix-the-failure-of-adding-phy-with-zero-.patch +scsi-hpsa-fix-allocation-size-for-scsi_host-private-.patch +x86-purgatory-switch-to-the-position-independent-sma.patch +thermal-drivers-tsens-fix-null-pointer-dereference.patch +wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch +wifi-ath10k-populate-board-data-for-wcn3990.patch +net-dsa-mv88e6xxx-add-support-for-model-specific-pre.patch +net-dsa-mv88e6xxx-avoid-eeprom-timeout-without-eepro.patch +tcp-avoid-premature-drops-in-tcp_add_backlog.patch +pwm-sti-convert-to-platform-remove-callback-returnin.patch +pwm-sti-prepare-removing-pwm_chip-from-driver-data.patch +pwm-sti-simplify-probe-function-using-devm-functions.patch +net-give-more-chances-to-rcu-in-netdev_wait_allrefs_.patch +macintosh-via-macii-fix-bug-sleeping-function-called.patch +wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch +wifi-ar5523-enable-proper-endpoint-verification.patch +sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch +revert-sh-handle-calling-csum_partial-with-misaligne.patch +selftests-binderfs-use-the-makefile-s-rules-not-make.patch +selftests-resctrl-fix-clang-build-failure-use-local_.patch +hid-intel-ish-hid-ipc-add-check-for-pci_alloc_irq_ve.patch +scsi-bfa-ensure-the-copied-buf-is-nul-terminated.patch +scsi-qedf-ensure-the-copied-buf-is-nul-terminated.patch +scsi-qla2xxx-fix-debugfs-output-for-fw_resource_coun.patch +wifi-mwl8k-initialize-cmd-addr-properly.patch +usb-aqc111-stop-lying-about-skb-truesize.patch +net-usb-sr9700-stop-lying-about-skb-truesize.patch +m68k-fix-spinlock-race-in-kernel-thread-creation.patch +m68k-mac-fix-reboot-hang-on-mac-iici.patch +net-ipv6-fix-wrong-start-position-when-receive-hop-b.patch +eth-sungem-remove-.ndo_poll_controller-to-avoid-dead.patch +net-ethernet-cortina-locking-fixes.patch +af_unix-fix-data-races-in-unix_release_sock-unix_str.patch +net-usb-smsc95xx-stop-lying-about-skb-truesize.patch +net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch +ipv6-sr-add-missing-seg6_local_exit.patch +ipv6-sr-fix-incorrect-unregister-order.patch +ipv6-sr-fix-invalid-unregister-error-path.patch +net-mlx5-discard-command-completions-in-internal-err.patch +s390-bpf-emit-a-barrier-for-bpf_fetch-instructions.patch +mptcp-so_keepalive-fix-getsockopt-support.patch +printk-let-no_printk-use-_printk.patch +dev_printk-add-and-use-dev_no_printk.patch +drm-amd-display-fix-potential-index-out-of-bounds-in.patch +asoc-intel-disable-route-checks-for-skylake-boards.patch +mtd-core-report-error-if-first-mtd_otp_size-call-fai.patch +mtd-rawnand-hynix-fixed-typo.patch +fbdev-shmobile-fix-snprintf-truncation.patch +asoc-kirkwood-fix-potential-null-dereference.patch +drm-meson-vclk-fix-calculation-of-59.94-fractional-r.patch +drm-mediatek-add-0-size-check-to-mtk_drm_gem_obj.patch +powerpc-fsl-soc-hide-unused-const-variable.patch +fbdev-sisfb-hide-unused-variables.patch +media-ngene-add-dvb_ca_en50221_init-return-value-che.patch +media-radio-shark2-avoid-led_names-truncations.patch +drm-bridge-cdns-mhdp8546-fix-possible-null-pointer-d.patch +platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch +media-ipu3-cio2-use-temporary-storage-for-struct-dev.patch +media-ipu3-cio2-request-irq-earlier.patch +media-dt-bindings-ovti-ov2680-fix-the-power-supply-n.patch +fbdev-sh7760fb-allow-modular-build.patch +media-atomisp-ssh_css-fix-a-null-pointer-dereference.patch +drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch +drm-vc4-fix-possible-null-pointer-dereference.patch +asoc-tracing-export-snd_soc_dapm_dir_out-to-its-valu.patch +drm-bridge-lt8912b-don-t-log-an-error-when-dsi-host-.patch +drm-bridge-lt9611-don-t-log-an-error-when-dsi-host-c.patch +drm-bridge-tc358775-don-t-log-an-error-when-dsi-host.patch +drm-panel-simple-add-missing-innolux-g121x1-l03-form.patch +drm-mipi-dsi-use-correct-return-type-for-the-dsc-fun.patch +rdma-mlx5-adding-remote-atomic-access-flag-to-updata.patch +rdma-hns-fix-return-value-in-hns_roce_map_mr_sg.patch +rdma-hns-fix-deadlock-on-srq-async-events.patch +rdma-hns-fix-gmv-table-pagesize.patch +rdma-hns-use-complete-parentheses-in-macros.patch +rdma-hns-modify-the-print-level-of-cqe-error.patch +clk-qcom-mmcc-msm8998-fix-venus-clock-issue.patch +x86-insn-fix-push-instruction-in-x86-instruction-dec.patch +ext4-avoid-excessive-credit-estimate-in-ext4_tmpfile.patch +virt-acrn-prefer-array_size-and-struct_size-over-ope.patch +virt-acrn-stop-using-follow_pfn.patch +drivers-virt-acrn-fix-pfnmap-pte-checks-in-acrn_vm_r.patch +sunrpc-removed-redundant-procp-check.patch +ext4-simplify-calculation-of-blkoff-in-ext4_mb_new_b.patch +ext4-fix-unit-mismatch-in-ext4_mb_new_blocks_simple.patch +ext4-try-all-groups-in-ext4_mb_new_blocks_simple.patch +ext4-remove-unused-parameter-from-ext4_mb_new_blocks.patch +ext4-fix-potential-unnitialized-variable.patch +sunrpc-fix-gss_free_in_token_pages.patch +selftests-kcmp-make-the-test-output-consistent-and-c.patch +selftests-kcmp-remove-unused-open-mode.patch +rdma-ipoib-fix-format-truncation-compilation-errors.patch +selftests-net-bridge-increase-igmp-mld-exclude-timeo.patch +net-qrtr-ns-fix-module-refcnt.patch +netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch +af_packet-do-not-call-packet_read_pending-from-tpack.patch +sched-fair-allow-disabling-sched_balance_newidle-wit.patch +sched-core-fix-incorrect-initialization-of-the-burst.patch diff --git a/queue-5.15/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch b/queue-5.15/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch new file mode 100644 index 00000000000..632312fb322 --- /dev/null +++ b/queue-5.15/sh-kprobes-merge-arch_copy_kprobe-into-arch_prepare_.patch @@ -0,0 +1,53 @@ +From 7d55047c04885e9eb0826cca3dcfa5d676cfc056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 22:02:30 +0100 +Subject: sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() + +From: Geert Uytterhoeven + +[ Upstream commit 1422ae080b66134fe192082d9b721ab7bd93fcc5 ] + +arch/sh/kernel/kprobes.c:52:16: warning: no previous prototype for 'arch_copy_kprobe' [-Wmissing-prototypes] + +Although SH kprobes support was only merged in v2.6.28, it missed the +earlier removal of the arch_copy_kprobe() callback in v2.6.15. + +Based on the powerpc part of commit 49a2a1b83ba6fa40 ("[PATCH] kprobes: +changed from using spinlock to mutex"). + +Fixes: d39f5450146ff39f ("sh: Add kprobes support.") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/717d47a19689cc944fae6e981a1ad7cae1642c89.1709326528.git.geert+renesas@glider.be +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/kprobes.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/arch/sh/kernel/kprobes.c b/arch/sh/kernel/kprobes.c +index 1c7f358ef0be1..5db45517bb1e6 100644 +--- a/arch/sh/kernel/kprobes.c ++++ b/arch/sh/kernel/kprobes.c +@@ -44,17 +44,12 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if (OPCODE_RTE(opcode)) + return -EFAULT; /* Bad breakpoint */ + ++ memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); + p->opcode = opcode; + + return 0; + } + +-void __kprobes arch_copy_kprobe(struct kprobe *p) +-{ +- memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); +- p->opcode = *p->addr; +-} +- + void __kprobes arch_arm_kprobe(struct kprobe *p) + { + *p->addr = BREAKPOINT_INSTRUCTION; +-- +2.43.0 + diff --git a/queue-5.15/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch b/queue-5.15/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch new file mode 100644 index 00000000000..bbac8a0f80a --- /dev/null +++ b/queue-5.15/soc-mediatek-cmdq-fix-typo-of-cmdq_jump_relative.patch @@ -0,0 +1,49 @@ +From 05e61af013e13300ec0544fc3332e5225cb4c934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 15:41:09 +0000 +Subject: soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE + +From: Chun-Kuang Hu + +[ Upstream commit ed4d5ab179b9f0a60da87c650a31f1816db9b4b4 ] + +For cmdq jump command, offset 0 means relative jump and offset 1 +means absolute jump. cmdq_pkt_jump() is absolute jump, so fix the +typo of CMDQ_JUMP_RELATIVE in cmdq_pkt_jump(). + +Fixes: 946f1792d3d7 ("soc: mediatek: cmdq: add jump function") +Signed-off-by: Chun-Kuang Hu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240222154120.16959-2-chunkuang.hu@kernel.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-cmdq-helper.c b/drivers/soc/mediatek/mtk-cmdq-helper.c +index 3c8e4212d9419..40fb935818f8b 100644 +--- a/drivers/soc/mediatek/mtk-cmdq-helper.c ++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c +@@ -13,7 +13,8 @@ + #define CMDQ_POLL_ENABLE_MASK BIT(0) + #define CMDQ_EOC_IRQ_EN BIT(0) + #define CMDQ_REG_TYPE 1 +-#define CMDQ_JUMP_RELATIVE 1 ++#define CMDQ_JUMP_RELATIVE 0 ++#define CMDQ_JUMP_ABSOLUTE 1 + + struct cmdq_instruction { + union { +@@ -396,7 +397,7 @@ int cmdq_pkt_jump(struct cmdq_pkt *pkt, dma_addr_t addr) + struct cmdq_instruction inst = {}; + + inst.op = CMDQ_CODE_JUMP; +- inst.offset = CMDQ_JUMP_RELATIVE; ++ inst.offset = CMDQ_JUMP_ABSOLUTE; + inst.value = addr >> + cmdq_get_shift_pa(((struct cmdq_client *)pkt->cl)->chan); + return cmdq_pkt_append_command(pkt, inst); +-- +2.43.0 + diff --git a/queue-5.15/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch b/queue-5.15/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch new file mode 100644 index 00000000000..e6a1dd5b86c --- /dev/null +++ b/queue-5.15/softirq-fix-suspicious-rcu-usage-in-__do_softirq.patch @@ -0,0 +1,102 @@ +From a8472d48d46b5354a1e261839476492ef48928c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Apr 2024 18:28:08 +0800 +Subject: softirq: Fix suspicious RCU usage in __do_softirq() + +From: Zqiang + +[ Upstream commit 1dd1eff161bd55968d3d46bc36def62d71fb4785 ] + +Currently, the condition "__this_cpu_read(ksoftirqd) == current" is used to +invoke rcu_softirq_qs() in ksoftirqd tasks context for non-RT kernels. + +This works correctly as long as the context is actually task context but +this condition is wrong when: + + - the current task is ksoftirqd + - the task is interrupted in a RCU read side critical section + - __do_softirq() is invoked on return from interrupt + +Syzkaller triggered the following scenario: + + -> finish_task_switch() + -> put_task_struct_rcu_user() + -> call_rcu(&task->rcu, delayed_put_task_struct) + -> __kasan_record_aux_stack() + -> pfn_valid() + -> rcu_read_lock_sched() + + __irq_exit_rcu() + -> __do_softirq)() + -> if (!IS_ENABLED(CONFIG_PREEMPT_RT) && + __this_cpu_read(ksoftirqd) == current) + -> rcu_softirq_qs() + -> RCU_LOCKDEP_WARN(lock_is_held(&rcu_sched_lock_map)) + +The rcu quiescent state is reported in the rcu-read critical section, so +the lockdep warning is triggered. + +Fix this by splitting out the inner working of __do_softirq() into a helper +function which takes an argument to distinguish between ksoftirqd task +context and interrupted context and invoke it from the relevant call sites +with the proper context information and use that for the conditional +invocation of rcu_softirq_qs(). + +Reported-by: syzbot+dce04ed6d1438ad69656@syzkaller.appspotmail.com +Suggested-by: Thomas Gleixner +Signed-off-by: Zqiang +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240427102808.29356-1-qiang.zhang1211@gmail.com +Link: https://lore.kernel.org/lkml/8f281a10-b85a-4586-9586-5bbc12dc784f@paulmck-laptop/T/#mea8aba4abfcb97bbf499d169ce7f30c4cff1b0e3 +Signed-off-by: Sasha Levin +--- + kernel/softirq.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/kernel/softirq.c b/kernel/softirq.c +index 41f470929e991..dc60f0c66a25f 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -512,7 +512,7 @@ static inline bool lockdep_softirq_start(void) { return false; } + static inline void lockdep_softirq_end(bool in_hardirq) { } + #endif + +-asmlinkage __visible void __softirq_entry __do_softirq(void) ++static void handle_softirqs(bool ksirqd) + { + unsigned long end = jiffies + MAX_SOFTIRQ_TIME; + unsigned long old_flags = current->flags; +@@ -567,8 +567,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) + pending >>= softirq_bit; + } + +- if (!IS_ENABLED(CONFIG_PREEMPT_RT) && +- __this_cpu_read(ksoftirqd) == current) ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT) && ksirqd) + rcu_softirq_qs(); + + local_irq_disable(); +@@ -588,6 +587,11 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) + current_restore_flags(old_flags, PF_MEMALLOC); + } + ++asmlinkage __visible void __softirq_entry __do_softirq(void) ++{ ++ handle_softirqs(false); ++} ++ + /** + * irq_enter_rcu - Enter an interrupt context with RCU watching + */ +@@ -918,7 +922,7 @@ static void run_ksoftirqd(unsigned int cpu) + * We can safely run softirq on inline stack, as we are not deep + * in the task stack here. + */ +- __do_softirq(); ++ handle_softirqs(true); + ksoftirqd_run_end(); + cond_resched(); + return; +-- +2.43.0 + diff --git a/queue-5.15/sunrpc-fix-gss_free_in_token_pages.patch b/queue-5.15/sunrpc-fix-gss_free_in_token_pages.patch new file mode 100644 index 00000000000..57bbc75da1b --- /dev/null +++ b/queue-5.15/sunrpc-fix-gss_free_in_token_pages.patch @@ -0,0 +1,78 @@ +From 8ff891d7ff5c04a6a0911984759a7c900f686a38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 09:10:41 -0400 +Subject: SUNRPC: Fix gss_free_in_token_pages() + +From: Chuck Lever + +[ Upstream commit bafa6b4d95d97877baa61883ff90f7e374427fae ] + +Dan Carpenter says: +> Commit 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") from Oct +> 24, 2019 (linux-next), leads to the following Smatch static checker +> warning: +> +> net/sunrpc/auth_gss/svcauth_gss.c:1039 gss_free_in_token_pages() +> warn: iterator 'i' not incremented +> +> net/sunrpc/auth_gss/svcauth_gss.c +> 1034 static void gss_free_in_token_pages(struct gssp_in_token *in_token) +> 1035 { +> 1036 u32 inlen; +> 1037 int i; +> 1038 +> --> 1039 i = 0; +> 1040 inlen = in_token->page_len; +> 1041 while (inlen) { +> 1042 if (in_token->pages[i]) +> 1043 put_page(in_token->pages[i]); +> ^ +> This puts page zero over and over. +> +> 1044 inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen; +> 1045 } +> 1046 +> 1047 kfree(in_token->pages); +> 1048 in_token->pages = NULL; +> 1049 } + +Based on the way that the ->pages[] array is constructed in +gss_read_proxy_verf(), we know that once the loop encounters a NULL +page pointer, the remaining array elements must also be NULL. + +Reported-by: Dan Carpenter +Suggested-by: Trond Myklebust +Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/svcauth_gss.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index 48b608cb5f5ec..6ad1757718505 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -1132,17 +1132,11 @@ gss_read_verf(struct rpc_gss_wire_cred *gc, + + static void gss_free_in_token_pages(struct gssp_in_token *in_token) + { +- u32 inlen; + int i; + + i = 0; +- inlen = in_token->page_len; +- while (inlen) { +- if (in_token->pages[i]) +- put_page(in_token->pages[i]); +- inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen; +- } +- ++ while (in_token->pages[i]) ++ put_page(in_token->pages[i++]); + kfree(in_token->pages); + in_token->pages = NULL; + } +-- +2.43.0 + diff --git a/queue-5.15/sunrpc-removed-redundant-procp-check.patch b/queue-5.15/sunrpc-removed-redundant-procp-check.patch new file mode 100644 index 00000000000..9e940bc1d25 --- /dev/null +++ b/queue-5.15/sunrpc-removed-redundant-procp-check.patch @@ -0,0 +1,39 @@ +From d4d200d00326fcb73c1e8e50bd5ef6795baa02a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 14:10:44 +0700 +Subject: sunrpc: removed redundant procp check + +From: Aleksandr Aprelkov + +[ Upstream commit a576f36971ab4097b6aa76433532aa1fb5ee2d3b ] + +since vs_proc pointer is dereferenced before getting it's address there's +no need to check for NULL. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 8e5b67731d08 ("SUNRPC: Add a callback to initialise server requests") +Signed-off-by: Aleksandr Aprelkov +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/svc.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c +index 9177b243a949d..8d5897ed2816f 100644 +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1238,8 +1238,6 @@ svc_generic_init_request(struct svc_rqst *rqstp, + if (rqstp->rq_proc >= versp->vs_nproc) + goto err_bad_proc; + rqstp->rq_procinfo = procp = &versp->vs_proc[rqstp->rq_proc]; +- if (!procp) +- goto err_bad_proc; + + /* Initialize storage for argp and resp */ + memset(rqstp->rq_argp, 0, procp->pc_argzero); +-- +2.43.0 + diff --git a/queue-5.15/tcp-avoid-premature-drops-in-tcp_add_backlog.patch b/queue-5.15/tcp-avoid-premature-drops-in-tcp_add_backlog.patch new file mode 100644 index 00000000000..5e508b9c7d0 --- /dev/null +++ b/queue-5.15/tcp-avoid-premature-drops-in-tcp_add_backlog.patch @@ -0,0 +1,87 @@ +From 926e38a67f64f3abf1d56bf614f472e7f9995b91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 12:56:20 +0000 +Subject: tcp: avoid premature drops in tcp_add_backlog() + +From: Eric Dumazet + +[ Upstream commit ec00ed472bdb7d0af840da68c8c11bff9f4d9caa ] + +While testing TCP performance with latest trees, +I saw suspect SOCKET_BACKLOG drops. + +tcp_add_backlog() computes its limit with : + + limit = (u32)READ_ONCE(sk->sk_rcvbuf) + + (u32)(READ_ONCE(sk->sk_sndbuf) >> 1); + limit += 64 * 1024; + +This does not take into account that sk->sk_backlog.len +is reset only at the very end of __release_sock(). + +Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach +sk_rcvbuf in normal conditions. + +We should double sk->sk_rcvbuf contribution in the formula +to absorb bubbles in the backlog, which happen more often +for very fast flows. + +This change maintains decent protection against abuses. + +Fixes: c377411f2494 ("net: sk_add_backlog() take rmem_alloc into account") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240423125620.3309458-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index e162bed1916ae..e9b1dcf2d463a 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1817,7 +1817,7 @@ int tcp_v4_early_demux(struct sk_buff *skb) + + bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb) + { +- u32 limit, tail_gso_size, tail_gso_segs; ++ u32 tail_gso_size, tail_gso_segs; + struct skb_shared_info *shinfo; + const struct tcphdr *th; + struct tcphdr *thtail; +@@ -1826,6 +1826,7 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb) + bool fragstolen; + u32 gso_segs; + u32 gso_size; ++ u64 limit; + int delta; + + /* In case all data was pulled from skb frags (in __pskb_pull_tail()), +@@ -1922,7 +1923,13 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb) + __skb_push(skb, hdrlen); + + no_coalesce: +- limit = (u32)READ_ONCE(sk->sk_rcvbuf) + (u32)(READ_ONCE(sk->sk_sndbuf) >> 1); ++ /* sk->sk_backlog.len is reset only at the end of __release_sock(). ++ * Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach ++ * sk_rcvbuf in normal conditions. ++ */ ++ limit = ((u64)READ_ONCE(sk->sk_rcvbuf)) << 1; ++ ++ limit += ((u32)READ_ONCE(sk->sk_sndbuf)) >> 1; + + /* Only socket owner can try to collapse/prune rx queues + * to reduce memory overhead, so add a little headroom here. +@@ -1930,6 +1937,8 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb) + */ + limit += 64 * 1024; + ++ limit = min_t(u64, limit, UINT_MAX); ++ + if (unlikely(sk_add_backlog(sk, skb, limit))) { + bh_unlock_sock(sk); + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPBACKLOGDROP); +-- +2.43.0 + diff --git a/queue-5.15/thermal-drivers-tsens-fix-null-pointer-dereference.patch b/queue-5.15/thermal-drivers-tsens-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..2c755d3061a --- /dev/null +++ b/queue-5.15/thermal-drivers-tsens-fix-null-pointer-dereference.patch @@ -0,0 +1,42 @@ +From 7dd660cd1694c5045d5cd1d64611484483c4a2ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 14:40:21 +0300 +Subject: thermal/drivers/tsens: Fix null pointer dereference + +From: Aleksandr Mishin + +[ Upstream commit d998ddc86a27c92140b9f7984ff41e3d1d07a48f ] + +compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c) +as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null +pointer dereference (if DEBUG or DYNAMIC_DEBUG set). +Fix this bug by adding null pointer check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: dfc1193d4dbd ("thermal/drivers/tsens: Replace custom 8960 apis with generic apis") +Signed-off-by: Aleksandr Mishin +Reviewed-by: Konrad Dybcio +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20240411114021.12203-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c +index 926cd8b41132c..2f31129cd5471 100644 +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -84,7 +84,7 @@ void compute_intercept_slope(struct tsens_priv *priv, u32 *p1, + for (i = 0; i < priv->num_sensors; i++) { + dev_dbg(priv->dev, + "%s: sensor%d - data_point1:%#x data_point2:%#x\n", +- __func__, i, p1[i], p2[i]); ++ __func__, i, p1[i], p2 ? p2[i] : 0); + + if (!priv->sensor[i].slope) + priv->sensor[i].slope = SLOPE_DEFAULT; +-- +2.43.0 + diff --git a/queue-5.15/udp-avoid-call-to-compute_score-on-multiple-sites.patch b/queue-5.15/udp-avoid-call-to-compute_score-on-multiple-sites.patch new file mode 100644 index 00000000000..1805f5daa86 --- /dev/null +++ b/queue-5.15/udp-avoid-call-to-compute_score-on-multiple-sites.patch @@ -0,0 +1,164 @@ +From 863a400e66c119a347afbe7e2f29749d9815566f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:20:04 -0400 +Subject: udp: Avoid call to compute_score on multiple sites + +From: Gabriel Krisman Bertazi + +[ Upstream commit 50aee97d15113b95a68848db1f0cb2a6c09f753a ] + +We've observed a 7-12% performance regression in iperf3 UDP ipv4 and +ipv6 tests with multiple sockets on Zen3 cpus, which we traced back to +commit f0ea27e7bfe1 ("udp: re-score reuseport groups when connected +sockets are present"). The failing tests were those that would spawn +UDP sockets per-cpu on systems that have a high number of cpus. + +Unsurprisingly, it is not caused by the extra re-scoring of the reused +socket, but due to the compiler no longer inlining compute_score, once +it has the extra call site in udp4_lib_lookup2. This is augmented by +the "Safe RET" mitigation for SRSO, needed in our Zen3 cpus. + +We could just explicitly inline it, but compute_score() is quite a large +function, around 300b. Inlining in two sites would almost double +udp4_lib_lookup2, which is a silly thing to do just to workaround a +mitigation. Instead, this patch shuffles the code a bit to avoid the +multiple calls to compute_score. Since it is a static function used in +one spot, the compiler can safely fold it in, as it did before, without +increasing the text size. + +With this patch applied I ran my original iperf3 testcases. The failing +cases all looked like this (ipv4): + iperf3 -c 127.0.0.1 --udp -4 -f K -b $R -l 8920 -t 30 -i 5 -P 64 -O 2 + +where $R is either 1G/10G/0 (max, unlimited). I ran 3 times each. +baseline is v6.9-rc3. harmean == harmonic mean; CV == coefficient of +variation. + +ipv4: + 1G 10G MAX + HARMEAN (CV) HARMEAN (CV) HARMEAN (CV) +baseline 1743852.66(0.0208) 1725933.02(0.0167) 1705203.78(0.0386) +patched 1968727.61(0.0035) 1962283.22(0.0195) 1923853.50(0.0256) + +ipv6: + 1G 10G MAX + HARMEAN (CV) HARMEAN (CV) HARMEAN (CV) +baseline 1729020.03(0.0028) 1691704.49(0.0243) 1692251.34(0.0083) +patched 1900422.19(0.0067) 1900968.01(0.0067) 1568532.72(0.1519) + +This restores the performance we had before the change above with this +benchmark. We obviously don't expect any real impact when mitigations +are disabled, but just to be sure it also doesn't regresses: + +mitigations=off ipv4: + 1G 10G MAX + HARMEAN (CV) HARMEAN (CV) HARMEAN (CV) +baseline 3230279.97(0.0066) 3229320.91(0.0060) 2605693.19(0.0697) +patched 3242802.36(0.0073) 3239310.71(0.0035) 2502427.19(0.0882) + +Cc: Lorenz Bauer +Fixes: f0ea27e7bfe1 ("udp: re-score reuseport groups when connected sockets are present") +Signed-off-by: Gabriel Krisman Bertazi +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/udp.c | 21 ++++++++++++++++----- + net/ipv6/udp.c | 20 ++++++++++++++++---- + 2 files changed, 32 insertions(+), 9 deletions(-) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index a2e5c6776966e..53d7a81d62584 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -420,15 +420,21 @@ static struct sock *udp4_lib_lookup2(struct net *net, + { + struct sock *sk, *result; + int score, badness; ++ bool need_rescore; + + result = NULL; + badness = 0; + udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) { +- score = compute_score(sk, net, saddr, sport, +- daddr, hnum, dif, sdif); ++ need_rescore = false; ++rescore: ++ score = compute_score(need_rescore ? result : sk, net, saddr, ++ sport, daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; + ++ if (need_rescore) ++ continue; ++ + if (sk->sk_state == TCP_ESTABLISHED) { + result = sk; + continue; +@@ -449,9 +455,14 @@ static struct sock *udp4_lib_lookup2(struct net *net, + if (IS_ERR(result)) + continue; + +- badness = compute_score(result, net, saddr, sport, +- daddr, hnum, dif, sdif); +- ++ /* compute_score is too long of a function to be ++ * inlined, and calling it again here yields ++ * measureable overhead for some ++ * workloads. Work around it by jumping ++ * backwards to rescore 'result'. ++ */ ++ need_rescore = true; ++ goto rescore; + } + } + return result; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 0a7f716a0aea3..c60162ea0aa8a 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -166,15 +166,21 @@ static struct sock *udp6_lib_lookup2(struct net *net, + { + struct sock *sk, *result; + int score, badness; ++ bool need_rescore; + + result = NULL; + badness = -1; + udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) { +- score = compute_score(sk, net, saddr, sport, +- daddr, hnum, dif, sdif); ++ need_rescore = false; ++rescore: ++ score = compute_score(need_rescore ? result : sk, net, saddr, ++ sport, daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; + ++ if (need_rescore) ++ continue; ++ + if (sk->sk_state == TCP_ESTABLISHED) { + result = sk; + continue; +@@ -195,8 +201,14 @@ static struct sock *udp6_lib_lookup2(struct net *net, + if (IS_ERR(result)) + continue; + +- badness = compute_score(sk, net, saddr, sport, +- daddr, hnum, dif, sdif); ++ /* compute_score is too long of a function to be ++ * inlined, and calling it again here yields ++ * measureable overhead for some ++ * workloads. Work around it by jumping ++ * backwards to rescore 'result'. ++ */ ++ need_rescore = true; ++ goto rescore; + } + } + return result; +-- +2.43.0 + diff --git a/queue-5.15/usb-aqc111-stop-lying-about-skb-truesize.patch b/queue-5.15/usb-aqc111-stop-lying-about-skb-truesize.patch new file mode 100644 index 00000000000..ab77a01c2f1 --- /dev/null +++ b/queue-5.15/usb-aqc111-stop-lying-about-skb-truesize.patch @@ -0,0 +1,55 @@ +From 87130dc70f403260c35404710eefc6c180a7bd07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 13:55:46 +0000 +Subject: usb: aqc111: stop lying about skb->truesize + +From: Eric Dumazet + +[ Upstream commit 9aad6e45c4e7d16b2bb7c3794154b828fb4384b4 ] + +Some usb drivers try to set small skb->truesize and break +core networking stacks. + +I replace one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a: +stop lying about skb->truesize") + +Fixes: 361459cd9642 ("net: usb: aqc111: Implement RX data path") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240506135546.3641185-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/aqc111.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c +index 6db37eb6c5cc8..4b48a5c09bd49 100644 +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -1141,17 +1141,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + continue; + } + +- /* Clone SKB */ +- new_skb = skb_clone(skb, GFP_ATOMIC); ++ new_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len); + + if (!new_skb) + goto err; + +- new_skb->len = pkt_len; ++ skb_put(new_skb, pkt_len); ++ memcpy(new_skb->data, skb->data, pkt_len); + skb_pull(new_skb, AQ_RX_HW_PAD); +- skb_set_tail_pointer(new_skb, new_skb->len); + +- new_skb->truesize = SKB_TRUESIZE(new_skb->len); + if (aqc111_data->rx_checksum) + aqc111_rx_checksum(new_skb, pkt_desc); + +-- +2.43.0 + diff --git a/queue-5.15/virt-acrn-prefer-array_size-and-struct_size-over-ope.patch b/queue-5.15/virt-acrn-prefer-array_size-and-struct_size-over-ope.patch new file mode 100644 index 00000000000..69252e73644 --- /dev/null +++ b/queue-5.15/virt-acrn-prefer-array_size-and-struct_size-over-ope.patch @@ -0,0 +1,106 @@ +From 76d495a0377111fd6b88fc3cc4ac4ef94e04ce9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 19:27:46 +0200 +Subject: virt: acrn: Prefer array_size and struct_size over open coded + arithmetic + +From: Len Baker + +[ Upstream commit 746f1b0ac5bf6ecfb71674af210ae476aa714f46 ] + +As noted in the "Deprecated Interfaces, Language Features, Attributes, +and Conventions" documentation [1], size calculations (especially +multiplication) should not be performed in memory allocator (or similar) +function arguments due to the risk of them overflowing. This could lead +to values wrapping around and a smaller allocation being made than the +caller was expecting. Using those allocations could lead to linear +overflows of heap memory and other misbehaviors. + +So, use the array_size() helper to do the arithmetic instead of the +argument "count * size" in the vzalloc() function. + +Also, take the opportunity to add a flexible array member of struct +vm_memory_region_op to the vm_memory_region_batch structure. And then, +change the code accordingly and use the struct_size() helper to do the +arithmetic instead of the argument "size + size * count" in the kzalloc +function. + +This code was detected with the help of Coccinelle and audited and fixed +manually. + +[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments + +Acked-by: Fei Li +Signed-off-by: Len Baker +Signed-off-by: Gustavo A. R. Silva +Stable-dep-of: 3d6586008f7b ("drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()") +Signed-off-by: Sasha Levin +--- + drivers/virt/acrn/acrn_drv.h | 10 ++++++---- + drivers/virt/acrn/mm.c | 9 ++++----- + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/virt/acrn/acrn_drv.h b/drivers/virt/acrn/acrn_drv.h +index 1be54efa666cb..5663c17ad37c7 100644 +--- a/drivers/virt/acrn/acrn_drv.h ++++ b/drivers/virt/acrn/acrn_drv.h +@@ -48,6 +48,7 @@ struct vm_memory_region_op { + * @reserved: Reserved. + * @regions_num: The number of vm_memory_region_op. + * @regions_gpa: Physical address of a vm_memory_region_op array. ++ * @regions_op: Flexible array of vm_memory_region_op. + * + * HC_VM_SET_MEMORY_REGIONS uses this structure to manage EPT mappings of + * multiple memory regions of a User VM. A &struct vm_memory_region_batch +@@ -55,10 +56,11 @@ struct vm_memory_region_op { + * ACRN Hypervisor. + */ + struct vm_memory_region_batch { +- u16 vmid; +- u16 reserved[3]; +- u32 regions_num; +- u64 regions_gpa; ++ u16 vmid; ++ u16 reserved[3]; ++ u32 regions_num; ++ u64 regions_gpa; ++ struct vm_memory_region_op regions_op[]; + }; + + /** +diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c +index 3b1b1e7a844b4..b4ad8d452e9a1 100644 +--- a/drivers/virt/acrn/mm.c ++++ b/drivers/virt/acrn/mm.c +@@ -192,7 +192,7 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + + /* Get the page number of the map region */ + nr_pages = memmap->len >> PAGE_SHIFT; +- pages = vzalloc(nr_pages * sizeof(struct page *)); ++ pages = vzalloc(array_size(nr_pages, sizeof(*pages))); + if (!pages) + return -ENOMEM; + +@@ -244,16 +244,15 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + } + + /* Prepare the vm_memory_region_batch */ +- regions_info = kzalloc(sizeof(*regions_info) + +- sizeof(*vm_region) * nr_regions, +- GFP_KERNEL); ++ regions_info = kzalloc(struct_size(regions_info, regions_op, ++ nr_regions), GFP_KERNEL); + if (!regions_info) { + ret = -ENOMEM; + goto unmap_kernel_map; + } + + /* Fill each vm_memory_region_op */ +- vm_region = (struct vm_memory_region_op *)(regions_info + 1); ++ vm_region = regions_info->regions_op; + regions_info->vmid = vm->vmid; + regions_info->regions_num = nr_regions; + regions_info->regions_gpa = virt_to_phys(vm_region); +-- +2.43.0 + diff --git a/queue-5.15/virt-acrn-stop-using-follow_pfn.patch b/queue-5.15/virt-acrn-stop-using-follow_pfn.patch new file mode 100644 index 00000000000..10be8bff8ea --- /dev/null +++ b/queue-5.15/virt-acrn-stop-using-follow_pfn.patch @@ -0,0 +1,71 @@ +From 90257ecbf2633cb6bdea31d10cb6a9c3c941a89e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 07:45:40 +0800 +Subject: virt: acrn: stop using follow_pfn + +From: Christoph Hellwig + +[ Upstream commit 1b265da7ea1e1ae997fa119c2846bb389eb39c6b ] + +Patch series "remove follow_pfn". + +This series open codes follow_pfn in the only remaining caller, although +the code there remains questionable. It then also moves follow_phys into +the only user and simplifies it a bit. + +This patch (of 3): + +Switch from follow_pfn to follow_pte so that we can get rid of follow_pfn. +Note that this doesn't fix any of the pre-existing raciness and lack of +permission checking in the code. + +Link: https://lkml.kernel.org/r/20240324234542.2038726-1-hch@lst.de +Link: https://lkml.kernel.org/r/20240324234542.2038726-2-hch@lst.de +Signed-off-by: Christoph Hellwig +Reviewed-by: David Hildenbrand +Cc: Andy Lutomirski +Cc: Dave Hansen +Cc: Fei Li +Cc: Peter Zijlstra +Cc: Ingo Molnar +Signed-off-by: Andrew Morton +Stable-dep-of: 3d6586008f7b ("drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()") +Signed-off-by: Sasha Levin +--- + drivers/virt/acrn/mm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c +index b4ad8d452e9a1..ffc1d1136f765 100644 +--- a/drivers/virt/acrn/mm.c ++++ b/drivers/virt/acrn/mm.c +@@ -171,18 +171,24 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) + mmap_read_lock(current->mm); + vma = vma_lookup(current->mm, memmap->vma_base); + if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) { ++ spinlock_t *ptl; ++ pte_t *ptep; ++ + if ((memmap->vma_base + memmap->len) > vma->vm_end) { + mmap_read_unlock(current->mm); + return -EINVAL; + } + +- ret = follow_pfn(vma, memmap->vma_base, &pfn); +- mmap_read_unlock(current->mm); ++ ret = follow_pte(vma->vm_mm, memmap->vma_base, &ptep, &ptl); + if (ret < 0) { ++ mmap_read_unlock(current->mm); + dev_dbg(acrn_dev.this_device, + "Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base); + return ret; + } ++ pfn = pte_pfn(ptep_get(ptep)); ++ pte_unmap_unlock(ptep, ptl); ++ mmap_read_unlock(current->mm); + + return acrn_mm_region_add(vm, memmap->user_vm_pa, + PFN_PHYS(pfn), memmap->len, +-- +2.43.0 + diff --git a/queue-5.15/wifi-ar5523-enable-proper-endpoint-verification.patch b/queue-5.15/wifi-ar5523-enable-proper-endpoint-verification.patch new file mode 100644 index 00000000000..7a67c9e7f55 --- /dev/null +++ b/queue-5.15/wifi-ar5523-enable-proper-endpoint-verification.patch @@ -0,0 +1,99 @@ +From 17f41bc74d4fb3228a2836129a44231d16ccc4dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 05:14:25 -0700 +Subject: wifi: ar5523: enable proper endpoint verification + +From: Nikita Zhandarovich + +[ Upstream commit e120b6388d7d88635d67dcae6483f39c37111850 ] + +Syzkaller reports [1] hitting a warning about an endpoint in use +not having an expected type to it. + +Fix the issue by checking for the existence of all proper +endpoints with their according types intact. + +Sadly, this patch has not been tested on real hardware. + +[1] Syzkaller report: +------------[ cut here ]------------ +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 +... +Call Trace: + + ar5523_cmd+0x41b/0x780 drivers/net/wireless/ath/ar5523/ar5523.c:275 + ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline] + ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline] + ar5523_probe+0x14b0/0x1d10 drivers/net/wireless/ath/ar5523/ar5523.c:1655 + usb_probe_interface+0x30f/0x7f0 drivers/usb/core/driver.c:396 + call_driver_probe drivers/base/dd.c:560 [inline] + really_probe+0x249/0xb90 drivers/base/dd.c:639 + __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 + driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 + __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 + bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 + __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 + bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 + device_add+0xbd9/0x1e90 drivers/base/core.c:3517 + usb_set_configuration+0x101d/0x1900 drivers/usb/core/message.c:2170 + usb_generic_driver_probe+0xbe/0x100 drivers/usb/core/generic.c:238 + usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293 + call_driver_probe drivers/base/dd.c:560 [inline] + really_probe+0x249/0xb90 drivers/base/dd.c:639 + __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 + driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 + __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 + bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 + __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 + bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 + device_add+0xbd9/0x1e90 drivers/base/core.c:3517 + usb_new_device.cold+0x685/0x10ad drivers/usb/core/hub.c:2573 + hub_port_connect drivers/usb/core/hub.c:5353 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] + port_event drivers/usb/core/hub.c:5653 [inline] + hub_event+0x26cb/0x45d0 drivers/usb/core/hub.c:5735 + process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 + worker_thread+0x669/0x1090 kernel/workqueue.c:2436 + kthread+0x2e8/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + + +Reported-and-tested-by: syzbot+1bc2c2afd44f820a669f@syzkaller.appspotmail.com +Fixes: b7d572e1871d ("ar5523: Add new driver") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240408121425.29392-1-n.zhandarovich@fintech.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ar5523/ar5523.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index efe38b2c1df73..71c2bf8817dc2 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -1590,6 +1590,20 @@ static int ar5523_probe(struct usb_interface *intf, + struct ar5523 *ar; + int error = -ENOMEM; + ++ static const u8 bulk_ep_addr[] = { ++ AR5523_CMD_TX_PIPE | USB_DIR_OUT, ++ AR5523_DATA_TX_PIPE | USB_DIR_OUT, ++ AR5523_CMD_RX_PIPE | USB_DIR_IN, ++ AR5523_DATA_RX_PIPE | USB_DIR_IN, ++ 0}; ++ ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr)) { ++ dev_err(&dev->dev, ++ "Could not find all expected endpoints\n"); ++ error = -ENODEV; ++ goto out; ++ } ++ + /* + * Load firmware if the device requires it. This will return + * -ENXIO on success and we'll get called back afer the usb +-- +2.43.0 + diff --git a/queue-5.15/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch b/queue-5.15/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch new file mode 100644 index 00000000000..a1576e0f83e --- /dev/null +++ b/queue-5.15/wifi-ath10k-fix-an-error-code-problem-in-ath10k_dbg_.patch @@ -0,0 +1,43 @@ +From bb8656a10ba2c94a4befd5fb073f85b630fb6b42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 11:42:44 +0800 +Subject: wifi: ath10k: Fix an error code problem in + ath10k_dbg_sta_write_peer_debug_trigger() + +From: Su Hui + +[ Upstream commit c511a9c12674d246916bb16c479d496b76983193 ] + +Clang Static Checker (scan-build) warns: + +drivers/net/wireless/ath/ath10k/debugfs_sta.c:line 429, column 3 +Value stored to 'ret' is never read. + +Return 'ret' rather than 'count' when 'ret' stores an error code. + +Fixes: ee8b08a1be82 ("ath10k: add debugfs support to get per peer tids log via tracing") +Signed-off-by: Su Hui +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240422034243.938962-1-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c +index 367539f2c3700..f7912c72cba34 100644 +--- a/drivers/net/wireless/ath/ath10k/debugfs_sta.c ++++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c +@@ -438,7 +438,7 @@ ath10k_dbg_sta_write_peer_debug_trigger(struct file *file, + } + out: + mutex_unlock(&ar->conf_mutex); +- return count; ++ return ret ?: count; + } + + static const struct file_operations fops_peer_debug_trigger = { +-- +2.43.0 + diff --git a/queue-5.15/wifi-ath10k-poll-service-ready-message-before-failin.patch b/queue-5.15/wifi-ath10k-poll-service-ready-message-before-failin.patch new file mode 100644 index 00000000000..f06d6334520 --- /dev/null +++ b/queue-5.15/wifi-ath10k-poll-service-ready-message-before-failin.patch @@ -0,0 +1,81 @@ +From e8aa29166660d9c948796a49a2d77e1493e95e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 07:15:14 +0200 +Subject: wifi: ath10k: poll service ready message before failing + +From: Baochen Qiang + +[ Upstream commit e57b7d62a1b2f496caf0beba81cec3c90fad80d5 ] + +Currently host relies on CE interrupts to get notified that +the service ready message is ready. This results in timeout +issue if the interrupt is not fired, due to some unknown +reasons. See below logs: + +[76321.937866] ath10k_pci 0000:02:00.0: wmi service ready event not received +... +[76322.016738] ath10k_pci 0000:02:00.0: Could not init core: -110 + +And finally it causes WLAN interface bring up failure. + +Change to give it one more chance here by polling CE rings, +before failing directly. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1 + +Fixes: 5e3dd157d7e7 ("ath10k: mac80211 driver for Qualcomm Atheros 802.11ac CQA98xx devices") +Reported-by: James Prestwood +Tested-By: James Prestwood # on QCA6174 hw3.2 +Link: https://lore.kernel.org/linux-wireless/304ce305-fbe6-420e-ac2a-d61ae5e6ca1a@gmail.com/ +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240227030409.89702-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 7c1c2658cb5f8..c8ccea542fec7 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1762,12 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { +- unsigned long time_left; ++ unsigned long time_left, i; + + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, + WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) +- return -ETIMEDOUT; ++ if (!time_left) { ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings once. ++ */ ++ ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); ++ ++ for (i = 0; i < CE_COUNT; i++) ++ ath10k_hif_send_complete_check(ar, i, 1); ++ ++ time_left = wait_for_completion_timeout(&ar->wmi.service_ready, ++ WMI_SERVICE_READY_TIMEOUT_HZ); ++ if (!time_left) { ++ ath10k_warn(ar, "polling timed out\n"); ++ return -ETIMEDOUT; ++ } ++ ++ ath10k_warn(ar, "service ready completion received, continuing normally\n"); ++ } ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-5.15/wifi-ath10k-populate-board-data-for-wcn3990.patch b/queue-5.15/wifi-ath10k-populate-board-data-for-wcn3990.patch new file mode 100644 index 00000000000..c656d1a8c1c --- /dev/null +++ b/queue-5.15/wifi-ath10k-populate-board-data-for-wcn3990.patch @@ -0,0 +1,65 @@ +From bc032b8476f2b5e9a40bd5deac32645ee3b13704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 08:47:06 +0200 +Subject: wifi: ath10k: populate board data for WCN3990 + +From: Dmitry Baryshkov + +[ Upstream commit f1f1b5b055c9f27a2f90fd0f0521f5920e9b3c18 ] + +Specify board data size (and board.bin filename) for the WCN3990 +platform. + +Reported-by: Yongqin Liu +Fixes: 03a72288c546 ("ath10k: wmi: add hw params entry for wcn3990") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240130-wcn3990-board-fw-v1-1-738f7c19a8c8@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/core.c | 3 +++ + drivers/net/wireless/ath/ath10k/hw.h | 1 + + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 +++ + 3 files changed, 7 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index eca24a61165ee..4a93c415db07b 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -640,6 +640,9 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .max_spatial_stream = 4, + .fw = { + .dir = WCN3990_HW_1_0_FW_DIR, ++ .board = WCN3990_HW_1_0_BOARD_DATA_FILE, ++ .board_size = WCN3990_BOARD_DATA_SZ, ++ .board_ext_size = WCN3990_BOARD_EXT_DATA_SZ, + }, + .sw_decrypt_mcast_mgmt = true, + .hw_ops = &wcn3990_ops, +diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h +index 591ef7416b613..0d8c8e948bb5a 100644 +--- a/drivers/net/wireless/ath/ath10k/hw.h ++++ b/drivers/net/wireless/ath/ath10k/hw.h +@@ -132,6 +132,7 @@ enum qca9377_chip_id_rev { + /* WCN3990 1.0 definitions */ + #define WCN3990_HW_1_0_DEV_VERSION ATH10K_HW_WCN3990 + #define WCN3990_HW_1_0_FW_DIR ATH10K_FW_DIR "/WCN3990/hw1.0" ++#define WCN3990_HW_1_0_BOARD_DATA_FILE "board.bin" + + #define ATH10K_FW_FILE_BASE "firmware" + #define ATH10K_FW_API_MAX 6 +diff --git a/drivers/net/wireless/ath/ath10k/targaddrs.h b/drivers/net/wireless/ath/ath10k/targaddrs.h +index ec556bb88d658..ba37e6c7ced08 100644 +--- a/drivers/net/wireless/ath/ath10k/targaddrs.h ++++ b/drivers/net/wireless/ath/ath10k/targaddrs.h +@@ -491,4 +491,7 @@ struct host_interest { + #define QCA4019_BOARD_DATA_SZ 12064 + #define QCA4019_BOARD_EXT_DATA_SZ 0 + ++#define WCN3990_BOARD_DATA_SZ 26328 ++#define WCN3990_BOARD_EXT_DATA_SZ 0 ++ + #endif /* __TARGADDRS_H__ */ +-- +2.43.0 + diff --git a/queue-5.15/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch b/queue-5.15/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch new file mode 100644 index 00000000000..6542ccf69c5 --- /dev/null +++ b/queue-5.15/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch @@ -0,0 +1,97 @@ +From 020cdb140be80fd44ba2ef7d7931e1fe181a39fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 11:33:55 -0700 +Subject: wifi: carl9170: add a proper sanity check for endpoints + +From: Nikita Zhandarovich + +[ Upstream commit b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0 ] + +Syzkaller reports [1] hitting a warning which is caused by presence +of a wrong endpoint type at the URB sumbitting stage. While there +was a check for a specific 4th endpoint, since it can switch types +between bulk and interrupt, other endpoints are trusted implicitly. +Similar warning is triggered in a couple of other syzbot issues [2]. + +Fix the issue by doing a comprehensive check of all endpoints +taking into account difference between high- and full-speed +configuration. + +[1] Syzkaller report: +... +WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 +... +Call Trace: + + carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 + carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] + carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] + carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 + request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 + process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 + worker_thread+0x669/0x1090 kernel/workqueue.c:2436 + kthread+0x2e8/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 + + +[2] Related syzkaller crashes: +Link: https://syzkaller.appspot.com/bug?extid=e394db78ae0b0032cb4d +Link: https://syzkaller.appspot.com/bug?extid=9468df99cb63a4a4c4e1 + +Reported-and-tested-by: syzbot+0ae4804973be759fa420@syzkaller.appspotmail.com +Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") +Signed-off-by: Nikita Zhandarovich +Acked-By: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240422183355.3785-1-n.zhandarovich@fintech.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/carl9170/usb.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c +index e4eb666c6eea4..a5265997b5767 100644 +--- a/drivers/net/wireless/ath/carl9170/usb.c ++++ b/drivers/net/wireless/ath/carl9170/usb.c +@@ -1069,6 +1069,38 @@ static int carl9170_usb_probe(struct usb_interface *intf, + ar->usb_ep_cmd_is_bulk = true; + } + ++ /* Verify that all expected endpoints are present */ ++ if (ar->usb_ep_cmd_is_bulk) { ++ u8 bulk_ep_addr[] = { ++ AR9170_USB_EP_RX | USB_DIR_IN, ++ AR9170_USB_EP_TX | USB_DIR_OUT, ++ AR9170_USB_EP_CMD | USB_DIR_OUT, ++ 0}; ++ u8 int_ep_addr[] = { ++ AR9170_USB_EP_IRQ | USB_DIR_IN, ++ 0}; ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || ++ !usb_check_int_endpoints(intf, int_ep_addr)) ++ err = -ENODEV; ++ } else { ++ u8 bulk_ep_addr[] = { ++ AR9170_USB_EP_RX | USB_DIR_IN, ++ AR9170_USB_EP_TX | USB_DIR_OUT, ++ 0}; ++ u8 int_ep_addr[] = { ++ AR9170_USB_EP_IRQ | USB_DIR_IN, ++ AR9170_USB_EP_CMD | USB_DIR_OUT, ++ 0}; ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || ++ !usb_check_int_endpoints(intf, int_ep_addr)) ++ err = -ENODEV; ++ } ++ ++ if (err) { ++ carl9170_free(ar); ++ return err; ++ } ++ + usb_set_intfdata(intf, ar); + SET_IEEE80211_DEV(ar->hw, &intf->dev); + +-- +2.43.0 + diff --git a/queue-5.15/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch b/queue-5.15/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch new file mode 100644 index 00000000000..2f6ce3acc01 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-fix-the-order-of-arguments-for-trace-e.patch @@ -0,0 +1,50 @@ +From 9d7c2b95e704b361c718e71c65fa8798e2e5afb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 18:24:30 +0300 +Subject: wifi: cfg80211: fix the order of arguments for trace events of the + tx_rx_evt class + +From: Igor Artemiev + +[ Upstream commit 9ef369973cd2c97cce3388d2c0c7e3c056656e8a ] + +The declarations of the tx_rx_evt class and the rdev_set_antenna event +use the wrong order of arguments in the TP_ARGS macro. + +Fix the order of arguments in the TP_ARGS macro. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Igor Artemiev +Link: https://msgid.link/20240405152431.270267-1-Igor.A.Artemiev@mcst.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/trace.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/trace.h b/net/wireless/trace.h +index dafea8bfcf3cb..9467193424150 100644 +--- a/net/wireless/trace.h ++++ b/net/wireless/trace.h +@@ -1687,7 +1687,7 @@ TRACE_EVENT(rdev_return_void_tx_rx, + + DECLARE_EVENT_CLASS(tx_rx_evt, + TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx), +- TP_ARGS(wiphy, rx, tx), ++ TP_ARGS(wiphy, tx, rx), + TP_STRUCT__entry( + WIPHY_ENTRY + __field(u32, tx) +@@ -1704,7 +1704,7 @@ DECLARE_EVENT_CLASS(tx_rx_evt, + + DEFINE_EVENT(tx_rx_evt, rdev_set_antenna, + TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx), +- TP_ARGS(wiphy, rx, tx) ++ TP_ARGS(wiphy, tx, rx) + ); + + DECLARE_EVENT_CLASS(wiphy_netdev_id_evt, +-- +2.43.0 + diff --git a/queue-5.15/wifi-mwl8k-initialize-cmd-addr-properly.patch b/queue-5.15/wifi-mwl8k-initialize-cmd-addr-properly.patch new file mode 100644 index 00000000000..8a744e06931 --- /dev/null +++ b/queue-5.15/wifi-mwl8k-initialize-cmd-addr-properly.patch @@ -0,0 +1,38 @@ +From 9c966dfb722e1459305d677211088ac7c019fe39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 14:38:15 +0300 +Subject: wifi: mwl8k: initialize cmd->addr[] properly + +From: Dan Carpenter + +[ Upstream commit 1d60eabb82694e58543e2b6366dae3e7465892a5 ] + +This loop is supposed to copy the mac address to cmd->addr but the +i++ increment is missing so it copies everything to cmd->addr[0] and +only the last address is recorded. + +Fixes: 22bedad3ce11 ("net: convert multicast list to list_head") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://msgid.link/b788be9a-15f5-4cca-a3fe-79df4c8ce7b2@moroto.mountain +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwl8k.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c +index 529e325498cdb..ad9678186c583 100644 +--- a/drivers/net/wireless/marvell/mwl8k.c ++++ b/drivers/net/wireless/marvell/mwl8k.c +@@ -2718,7 +2718,7 @@ __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti, + cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST); + cmd->numaddr = cpu_to_le16(mc_count); + netdev_hw_addr_list_for_each(ha, mc_list) { +- memcpy(cmd->addr[i], ha->addr, ETH_ALEN); ++ memcpy(cmd->addr[i++], ha->addr, ETH_ALEN); + } + } + +-- +2.43.0 + diff --git a/queue-5.15/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch b/queue-5.15/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch new file mode 100644 index 00000000000..e2438bec01e --- /dev/null +++ b/queue-5.15/x86-boot-ignore-relocations-in-.notes-sections-in-wa.patch @@ -0,0 +1,54 @@ +From 64b8a38e45b6e8f1770648e40d18a0f340274739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Mar 2024 23:05:47 +0800 +Subject: x86/boot: Ignore relocations in .notes sections in walk_relocs() too + +From: Guixiong Wei + +[ Upstream commit 76e9762d66373354b45c33b60e9a53ef2a3c5ff2 ] + +Commit: + + aaa8736370db ("x86, relocs: Ignore relocations in .notes section") + +... only started ignoring the .notes sections in print_absolute_relocs(), +but the same logic should also by applied in walk_relocs() to avoid +such relocations. + +[ mingo: Fixed various typos in the changelog, removed extra curly braces from the code. ] + +Fixes: aaa8736370db ("x86, relocs: Ignore relocations in .notes section") +Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") +Fixes: da1a679cde9b ("Add /sys/kernel/notes") +Signed-off-by: Guixiong Wei +Signed-off-by: Ingo Molnar +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20240317150547.24910-1-weiguixiong@bytedance.com +Signed-off-by: Sasha Levin +--- + arch/x86/tools/relocs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index 3167228ca1746..d7549953bb797 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -692,6 +692,15 @@ static void walk_relocs(int (*process)(struct section *sec, Elf_Rel *rel, + if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) { + continue; + } ++ ++ /* ++ * Do not perform relocations in .notes sections; any ++ * values there are meant for pre-boot consumption (e.g. ++ * startup_xen). ++ */ ++ if (sec_applies->shdr.sh_type == SHT_NOTE) ++ continue; ++ + sh_symtab = sec_symtab->symtab; + sym_strtab = sec_symtab->link->strtab; + for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) { +-- +2.43.0 + diff --git a/queue-5.15/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch b/queue-5.15/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch new file mode 100644 index 00000000000..eaa95a07ddd --- /dev/null +++ b/queue-5.15/x86-insn-fix-push-instruction-in-x86-instruction-dec.patch @@ -0,0 +1,98 @@ +From 72a449bdcdde344ff0a762844dd9bc4476e5589e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 13:58:45 +0300 +Subject: x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map + +From: Adrian Hunter + +[ Upstream commit 59162e0c11d7257cde15f907d19fefe26da66692 ] + +The x86 instruction decoder is used not only for decoding kernel +instructions. It is also used by perf uprobes (user space probes) and by +perf tools Intel Processor Trace decoding. Consequently, it needs to +support instructions executed by user space also. + +Opcode 0x68 PUSH instruction is currently defined as 64-bit operand size +only i.e. (d64). That was based on Intel SDM Opcode Map. However that is +contradicted by the Instruction Set Reference section for PUSH in the +same manual. + +Remove 64-bit operand size only annotation from opcode 0x68 PUSH +instruction. + +Example: + + $ cat pushw.s + .global _start + .text + _start: + pushw $0x1234 + mov $0x1,%eax # system call number (sys_exit) + int $0x80 + $ as -o pushw.o pushw.s + $ ld -s -o pushw pushw.o + $ objdump -d pushw | tail -4 + 0000000000401000 <.text>: + 401000: 66 68 34 12 pushw $0x1234 + 401004: b8 01 00 00 00 mov $0x1,%eax + 401009: cd 80 int $0x80 + $ perf record -e intel_pt//u ./pushw + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.014 MB perf.data ] + + Before: + + $ perf script --insn-trace=disasm + Warning: + 1 instruction trace errors + pushw 10349 [000] 10586.869237014: 401000 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) pushw $0x1234 + pushw 10349 [000] 10586.869237014: 401006 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb %al, (%rax) + pushw 10349 [000] 10586.869237014: 401008 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb %cl, %ch + pushw 10349 [000] 10586.869237014: 40100a [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb $0x2e, (%rax) + instruction trace error type 1 time 10586.869237224 cpu 0 pid 10349 tid 10349 ip 0x40100d code 6: Trace doesn't match instruction + + After: + + $ perf script --insn-trace=disasm + pushw 10349 [000] 10586.869237014: 401000 [unknown] (./pushw) pushw $0x1234 + pushw 10349 [000] 10586.869237014: 401004 [unknown] (./pushw) movl $1, %eax + +Fixes: eb13296cfaf6 ("x86: Instruction decoder API") +Signed-off-by: Adrian Hunter +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20240502105853.5338-3-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/lib/x86-opcode-map.txt | 2 +- + tools/arch/x86/lib/x86-opcode-map.txt | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index ec31f5b60323d..1c25c1072a84d 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -148,7 +148,7 @@ AVXcode: + 65: SEG=GS (Prefix) + 66: Operand-Size (Prefix) + 67: Address-Size (Prefix) +-68: PUSH Iz (d64) ++68: PUSH Iz + 69: IMUL Gv,Ev,Iz + 6a: PUSH Ib (d64) + 6b: IMUL Gv,Ev,Ib +diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt +index ec31f5b60323d..1c25c1072a84d 100644 +--- a/tools/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/arch/x86/lib/x86-opcode-map.txt +@@ -148,7 +148,7 @@ AVXcode: + 65: SEG=GS (Prefix) + 66: Operand-Size (Prefix) + 67: Address-Size (Prefix) +-68: PUSH Iz (d64) ++68: PUSH Iz + 69: IMUL Gv,Ev,Iz + 6a: PUSH Ib (d64) + 6b: IMUL Gv,Ev,Ib +-- +2.43.0 + diff --git a/queue-5.15/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch b/queue-5.15/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch new file mode 100644 index 00000000000..37610623392 --- /dev/null +++ b/queue-5.15/x86-mm-remove-broken-vsyscall-emulation-code-from-th.patch @@ -0,0 +1,232 @@ +From 1b54d4f78db680174e98ccf692c1d642473ae129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 10:00:51 +0200 +Subject: x86/mm: Remove broken vsyscall emulation code from the page fault + code + +From: Linus Torvalds + +[ Upstream commit 02b670c1f88e78f42a6c5aee155c7b26960ca054 ] + +The syzbot-reported stack trace from hell in this discussion thread +actually has three nested page faults: + + https://lore.kernel.org/r/000000000000d5f4fc0616e816d4@google.com + +... and I think that's actually the important thing here: + + - the first page fault is from user space, and triggers the vsyscall + emulation. + + - the second page fault is from __do_sys_gettimeofday(), and that should + just have caused the exception that then sets the return value to + -EFAULT + + - the third nested page fault is due to _raw_spin_unlock_irqrestore() -> + preempt_schedule() -> trace_sched_switch(), which then causes a BPF + trace program to run, which does that bpf_probe_read_compat(), which + causes that page fault under pagefault_disable(). + +It's quite the nasty backtrace, and there's a lot going on. + +The problem is literally the vsyscall emulation, which sets + + current->thread.sig_on_uaccess_err = 1; + +and that causes the fixup_exception() code to send the signal *despite* the +exception being caught. + +And I think that is in fact completely bogus. It's completely bogus +exactly because it sends that signal even when it *shouldn't* be sent - +like for the BPF user mode trace gathering. + +In other words, I think the whole "sig_on_uaccess_err" thing is entirely +broken, because it makes any nested page-faults do all the wrong things. + +Now, arguably, I don't think anybody should enable vsyscall emulation any +more, but this test case clearly does. + +I think we should just make the "send SIGSEGV" be something that the +vsyscall emulation does on its own, not this broken per-thread state for +something that isn't actually per thread. + +The x86 page fault code actually tried to deal with the "incorrect nesting" +by having that: + + if (in_interrupt()) + return; + +which ignores the sig_on_uaccess_err case when it happens in interrupts, +but as shown by this example, these nested page faults do not need to be +about interrupts at all. + +IOW, I think the only right thing is to remove that horrendously broken +code. + +The attached patch looks like the ObviouslyCorrect(tm) thing to do. + +NOTE! This broken code goes back to this commit in 2011: + + 4fc3490114bb ("x86-64: Set siginfo and context on vsyscall emulation faults") + +... and back then the reason was to get all the siginfo details right. +Honestly, I do not for a moment believe that it's worth getting the siginfo +details right here, but part of the commit says: + + This fixes issues with UML when vsyscall=emulate. + +... and so my patch to remove this garbage will probably break UML in this +situation. + +I do not believe that anybody should be running with vsyscall=emulate in +2024 in the first place, much less if you are doing things like UML. But +let's see if somebody screams. + +Reported-and-tested-by: syzbot+83e7f982ca045ab4405c@syzkaller.appspotmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Ingo Molnar +Tested-by: Jiri Olsa +Acked-by: Andy Lutomirski +Link: https://lore.kernel.org/r/CAHk-=wh9D6f7HUkDgZHKmDCHUQmp+Co89GP+b8+z+G56BKeyNg@mail.gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/entry/vsyscall/vsyscall_64.c | 28 ++--------------------- + arch/x86/include/asm/processor.h | 1 - + arch/x86/mm/fault.c | 33 +-------------------------- + 3 files changed, 3 insertions(+), 59 deletions(-) + +diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c +index fd2ee9408e914..ba3172d5b3286 100644 +--- a/arch/x86/entry/vsyscall/vsyscall_64.c ++++ b/arch/x86/entry/vsyscall/vsyscall_64.c +@@ -98,11 +98,6 @@ static int addr_to_vsyscall_nr(unsigned long addr) + + static bool write_ok_or_segv(unsigned long ptr, size_t size) + { +- /* +- * XXX: if access_ok, get_user, and put_user handled +- * sig_on_uaccess_err, this could go away. +- */ +- + if (!access_ok((void __user *)ptr, size)) { + struct thread_struct *thread = ¤t->thread; + +@@ -120,10 +115,8 @@ static bool write_ok_or_segv(unsigned long ptr, size_t size) + bool emulate_vsyscall(unsigned long error_code, + struct pt_regs *regs, unsigned long address) + { +- struct task_struct *tsk; + unsigned long caller; + int vsyscall_nr, syscall_nr, tmp; +- int prev_sig_on_uaccess_err; + long ret; + unsigned long orig_dx; + +@@ -172,8 +165,6 @@ bool emulate_vsyscall(unsigned long error_code, + goto sigsegv; + } + +- tsk = current; +- + /* + * Check for access_ok violations and find the syscall nr. + * +@@ -234,12 +225,8 @@ bool emulate_vsyscall(unsigned long error_code, + goto do_ret; /* skip requested */ + + /* +- * With a real vsyscall, page faults cause SIGSEGV. We want to +- * preserve that behavior to make writing exploits harder. ++ * With a real vsyscall, page faults cause SIGSEGV. + */ +- prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err; +- current->thread.sig_on_uaccess_err = 1; +- + ret = -EFAULT; + switch (vsyscall_nr) { + case 0: +@@ -262,23 +249,12 @@ bool emulate_vsyscall(unsigned long error_code, + break; + } + +- current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err; +- + check_fault: + if (ret == -EFAULT) { + /* Bad news -- userspace fed a bad pointer to a vsyscall. */ + warn_bad_vsyscall(KERN_INFO, regs, + "vsyscall fault (exploit attempt?)"); +- +- /* +- * If we failed to generate a signal for any reason, +- * generate one here. (This should be impossible.) +- */ +- if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) && +- !sigismember(&tsk->pending.signal, SIGSEGV))) +- goto sigsegv; +- +- return true; /* Don't emulate the ret. */ ++ goto sigsegv; + } + + regs->ax = ret; +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index bbbf27cfe7015..0702e0c5dbb8d 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -519,7 +519,6 @@ struct thread_struct { + unsigned long iopl_emul; + + unsigned int iopl_warn:1; +- unsigned int sig_on_uaccess_err:1; + + /* + * Protection Keys Register for Userspace. Loaded immediately on +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index abc6fbc3d5f21..31afd82b95245 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -716,39 +716,8 @@ kernelmode_fixup_or_oops(struct pt_regs *regs, unsigned long error_code, + WARN_ON_ONCE(user_mode(regs)); + + /* Are we prepared to handle this kernel fault? */ +- if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) { +- /* +- * Any interrupt that takes a fault gets the fixup. This makes +- * the below recursive fault logic only apply to a faults from +- * task context. +- */ +- if (in_interrupt()) +- return; +- +- /* +- * Per the above we're !in_interrupt(), aka. task context. +- * +- * In this case we need to make sure we're not recursively +- * faulting through the emulate_vsyscall() logic. +- */ +- if (current->thread.sig_on_uaccess_err && signal) { +- sanitize_error_code(address, &error_code); +- +- set_signal_archinfo(address, error_code); +- +- if (si_code == SEGV_PKUERR) { +- force_sig_pkuerr((void __user *)address, pkey); +- } else { +- /* XXX: hwpoison faults will set the wrong code. */ +- force_sig_fault(signal, si_code, (void __user *)address); +- } +- } +- +- /* +- * Barring that, we can do the fixup and be happy. +- */ ++ if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) + return; +- } + + /* + * AMD erratum #91 manifests as a spurious page fault on a PREFETCH +-- +2.43.0 + diff --git a/queue-5.15/x86-purgatory-switch-to-the-position-independent-sma.patch b/queue-5.15/x86-purgatory-switch-to-the-position-independent-sma.patch new file mode 100644 index 00000000000..d5520c6733c --- /dev/null +++ b/queue-5.15/x86-purgatory-switch-to-the-position-independent-sma.patch @@ -0,0 +1,81 @@ +From 5c7b76dca92ce46ff20e04bdfb807b30550bcd52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 22:17:06 +0200 +Subject: x86/purgatory: Switch to the position-independent small code model + +From: Ard Biesheuvel + +[ Upstream commit cba786af84a0f9716204e09f518ce3b7ada8555e ] + +On x86, the ordinary, position dependent small and kernel code models +only support placement of the executable in 32-bit addressable memory, +due to the use of 32-bit signed immediates to generate references to +global variables. For the kernel, this implies that all global variables +must reside in the top 2 GiB of the kernel virtual address space, where +the implicit address bits 63:32 are equal to sign bit 31. + +This means the kernel code model is not suitable for other bare metal +executables such as the kexec purgatory, which can be placed arbitrarily +in the physical address space, where its address may no longer be +representable as a sign extended 32-bit quantity. For this reason, +commit + + e16c2983fba0 ("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors") + +switched to the large code model, which uses 64-bit immediates for all +symbol references, including function calls, in order to avoid relying +on any assumptions regarding proximity of symbols in the final +executable. + +The large code model is rarely used, clunky and the least likely to +operate in a similar fashion when comparing GCC and Clang, so it is best +avoided. This is especially true now that Clang 18 has started to emit +executable code in two separate sections (.text and .ltext), which +triggers an issue in the kexec loading code at runtime. + +The SUSE bugzilla fixes tag points to gcc 13 having issues with the +large model too and that perhaps the large model should simply not be +used at all. + +Instead, use the position independent small code model, which makes no +assumptions about placement but only about proximity, where all +referenced symbols must be within -/+ 2 GiB, i.e., in range for a +RIP-relative reference. Use hidden visibility to suppress the use of a +GOT, which carries absolute addresses that are not covered by static ELF +relocations, and is therefore incompatible with the kexec loader's +relocation logic. + + [ bp: Massage commit message. ] + +Fixes: e16c2983fba0 ("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors") +Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1211853 +Closes: https://github.com/ClangBuiltLinux/linux/issues/2016 +Signed-off-by: Ard Biesheuvel +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Nathan Chancellor +Reviewed-by: Fangrui Song +Acked-by: Nick Desaulniers +Tested-by: Nathan Chancellor +Link: https://lore.kernel.org/all/20240417-x86-fix-kexec-with-llvm-18-v1-0-5383121e8fb7@kernel.org/ +Signed-off-by: Sasha Levin +--- + arch/x86/purgatory/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile +index 7a7701d1e18d0..59373a4abfb43 100644 +--- a/arch/x86/purgatory/Makefile ++++ b/arch/x86/purgatory/Makefile +@@ -41,7 +41,8 @@ KCOV_INSTRUMENT := n + # make up the standalone purgatory.ro + + PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel +-PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0 ++PURGATORY_CFLAGS := -mcmodel=small -ffreestanding -fno-zero-initialized-in-bss -g0 ++PURGATORY_CFLAGS += -fpic -fvisibility=hidden + PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING + PURGATORY_CFLAGS += -fno-stack-protector + +-- +2.43.0 + -- 2.47.3