From 4a3176578579934ee5327921a48354ee95f44892 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 23 Jul 2022 16:01:49 +0200 Subject: [PATCH] 5.18-stable patches added patches: bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch bus-mhi-host-pci_generic-add-telit-fn990.patch drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch net-usb-ax88179_178a-needs-flag_send_zlp.patch pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch pinctrl-stm32-fix-optional-irq-support-to-gpios.patch riscv-add-as-options-for-modules-with-assembly-compontents.patch --- queue-4.14/series | 0 queue-4.19/series | 1 + queue-4.9/series | 0 queue-5.10/series | 5 + queue-5.15/series | 7 + ...add-telit-fn980-v1-hardware-revision.patch | 76 ++++++++ ...mhi-host-pci_generic-add-telit-fn990.patch | 82 +++++++++ ...new-dmub-notification-enabling-in-dm.patch | 97 ++++++++++ ...don-t-kill-jobs-in-interrupt-context.patch | 68 +++++++ ...cking-in-vmap-vunmap-ttm-gem-helpers.patch | 58 ++++++ ...exec-lockdown-bypass-with-ima-policy.patch | 57 ++++++ ...-fix-ipv4-nexthop-gateway-indication.patch | 44 +++++ ...-lockdep-warning-for-pm-runtime-init.patch | 66 +++++++ ...timeout-based-on-program-erase-times.patch | 71 ++++++++ ...usb-ax88179_178a-needs-flag_send_zlp.patch | 166 ++++++++++++++++++ ...regmap-to-avoid-invalid-wait-context.patch | 86 +++++++++ ...32-fix-optional-irq-support-to-gpios.patch | 63 +++++++ ...or-modules-with-assembly-compontents.patch | 48 +++++ queue-5.18/series | 13 ++ 19 files changed, 1008 insertions(+) create mode 100644 queue-4.14/series create mode 100644 queue-4.19/series create mode 100644 queue-4.9/series create mode 100644 queue-5.10/series create mode 100644 queue-5.15/series create mode 100644 queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch create mode 100644 queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch create mode 100644 queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch create mode 100644 queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch create mode 100644 queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch create mode 100644 queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch create mode 100644 queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch create mode 100644 queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch create mode 100644 queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch create mode 100644 queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch create mode 100644 queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch create mode 100644 queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch create mode 100644 queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch create mode 100644 queue-5.18/series diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..e69de29bb2d diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..e3187f7f466 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1 @@ +riscv-add-as-options-for-modules-with-assembly-compontents.patch diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..e69de29bb2d diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..752fa954c3f --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,5 @@ +pinctrl-stm32-fix-optional-irq-support-to-gpios.patch +riscv-add-as-options-for-modules-with-assembly-compontents.patch +mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch +lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch +io_uring-use-original-task-for-req-identity-in-io_identity_cow.patch diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..4d27de59fa7 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,7 @@ +pinctrl-stm32-fix-optional-irq-support-to-gpios.patch +riscv-add-as-options-for-modules-with-assembly-compontents.patch +mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch +lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch +drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch +bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch +bus-mhi-host-pci_generic-add-telit-fn990.patch diff --git a/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch b/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch new file mode 100644 index 00000000000..9b337470b11 --- /dev/null +++ b/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch @@ -0,0 +1,76 @@ +From a96ef8b504efb2ad445dfb6d54f9488c3ddf23d2 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Wed, 27 Apr 2022 09:26:48 +0200 +Subject: bus: mhi: host: pci_generic: add Telit FN980 v1 hardware revision + +From: Daniele Palmas + +commit a96ef8b504efb2ad445dfb6d54f9488c3ddf23d2 upstream. + +Add Telit FN980 v1 hardware revision: + +01:00.0 Unassigned class [ff00]: Qualcomm Device [17cb:0306] + Subsystem: Device [1c5d:2000] + +Signed-off-by: Daniele Palmas +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20220427072648.17635-1-dnlplm@gmail.com +[mani: Added "host" to the subject] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Fabio Porcedda +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/pci_generic.c | 38 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +--- a/drivers/bus/mhi/host/pci_generic.c ++++ b/drivers/bus/mhi/host/pci_generic.c +@@ -446,10 +446,48 @@ static const struct mhi_pci_dev_info mhi + .sideband_wake = false, + }; + ++static const struct mhi_channel_config mhi_telit_fn980_hw_v1_channels[] = { ++ MHI_CHANNEL_CONFIG_UL(14, "QMI", 32, 0), ++ MHI_CHANNEL_CONFIG_DL(15, "QMI", 32, 0), ++ MHI_CHANNEL_CONFIG_UL(20, "IPCR", 16, 0), ++ MHI_CHANNEL_CONFIG_DL_AUTOQUEUE(21, "IPCR", 16, 0), ++ MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0", 128, 1), ++ MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0", 128, 2), ++}; ++ ++static struct mhi_event_config mhi_telit_fn980_hw_v1_events[] = { ++ MHI_EVENT_CONFIG_CTRL(0, 128), ++ MHI_EVENT_CONFIG_HW_DATA(1, 1024, 100), ++ MHI_EVENT_CONFIG_HW_DATA(2, 2048, 101) ++}; ++ ++static struct mhi_controller_config modem_telit_fn980_hw_v1_config = { ++ .max_channels = 128, ++ .timeout_ms = 20000, ++ .num_channels = ARRAY_SIZE(mhi_telit_fn980_hw_v1_channels), ++ .ch_cfg = mhi_telit_fn980_hw_v1_channels, ++ .num_events = ARRAY_SIZE(mhi_telit_fn980_hw_v1_events), ++ .event_cfg = mhi_telit_fn980_hw_v1_events, ++}; ++ ++static const struct mhi_pci_dev_info mhi_telit_fn980_hw_v1_info = { ++ .name = "telit-fn980-hwv1", ++ .fw = "qcom/sdx55m/sbl1.mbn", ++ .edl = "qcom/sdx55m/edl.mbn", ++ .config = &modem_telit_fn980_hw_v1_config, ++ .bar_num = MHI_PCI_DEFAULT_BAR_NUM, ++ .dma_data_width = 32, ++ .mru_default = 32768, ++ .sideband_wake = false, ++}; ++ + static const struct pci_device_id mhi_pci_id_table[] = { + /* EM919x (sdx55), use the same vid:pid as qcom-sdx55m */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, 0x18d7, 0x0200), + .driver_data = (kernel_ulong_t) &mhi_sierra_em919x_info }, ++ /* Telit FN980 hardware revision v1 */ ++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, 0x1C5D, 0x2000), ++ .driver_data = (kernel_ulong_t) &mhi_telit_fn980_hw_v1_info }, + { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0306), + .driver_data = (kernel_ulong_t) &mhi_qcom_sdx55_info }, + { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0304), diff --git a/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch b/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch new file mode 100644 index 00000000000..957f983ee88 --- /dev/null +++ b/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch @@ -0,0 +1,82 @@ +From 77fc41204734042861210b9d05338c9b8360affb Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Mon, 2 May 2022 13:20:36 +0200 +Subject: bus: mhi: host: pci_generic: add Telit FN990 + +From: Daniele Palmas + +commit 77fc41204734042861210b9d05338c9b8360affb upstream. + +Add Telit FN990: + +01:00.0 Unassigned class [ff00]: Qualcomm Device 0308 + Subsystem: Device 1c5d:2010 + +Signed-off-by: Daniele Palmas +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20220502112036.443618-1-dnlplm@gmail.com +[mani: Added "host" to the subject] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Fabio Porcedda +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/pci_generic.c | 41 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 41 insertions(+) + +--- a/drivers/bus/mhi/host/pci_generic.c ++++ b/drivers/bus/mhi/host/pci_generic.c +@@ -481,6 +481,44 @@ static const struct mhi_pci_dev_info mhi + .sideband_wake = false, + }; + ++static const struct mhi_channel_config mhi_telit_fn990_channels[] = { ++ MHI_CHANNEL_CONFIG_UL_SBL(2, "SAHARA", 32, 0), ++ MHI_CHANNEL_CONFIG_DL_SBL(3, "SAHARA", 32, 0), ++ MHI_CHANNEL_CONFIG_UL(4, "DIAG", 64, 1), ++ MHI_CHANNEL_CONFIG_DL(5, "DIAG", 64, 1), ++ MHI_CHANNEL_CONFIG_UL(12, "MBIM", 32, 0), ++ MHI_CHANNEL_CONFIG_DL(13, "MBIM", 32, 0), ++ MHI_CHANNEL_CONFIG_UL(32, "DUN", 32, 0), ++ MHI_CHANNEL_CONFIG_DL(33, "DUN", 32, 0), ++ MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0_MBIM", 128, 2), ++ MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0_MBIM", 128, 3), ++}; ++ ++static struct mhi_event_config mhi_telit_fn990_events[] = { ++ MHI_EVENT_CONFIG_CTRL(0, 128), ++ MHI_EVENT_CONFIG_DATA(1, 128), ++ MHI_EVENT_CONFIG_HW_DATA(2, 1024, 100), ++ MHI_EVENT_CONFIG_HW_DATA(3, 2048, 101) ++}; ++ ++static const struct mhi_controller_config modem_telit_fn990_config = { ++ .max_channels = 128, ++ .timeout_ms = 20000, ++ .num_channels = ARRAY_SIZE(mhi_telit_fn990_channels), ++ .ch_cfg = mhi_telit_fn990_channels, ++ .num_events = ARRAY_SIZE(mhi_telit_fn990_events), ++ .event_cfg = mhi_telit_fn990_events, ++}; ++ ++static const struct mhi_pci_dev_info mhi_telit_fn990_info = { ++ .name = "telit-fn990", ++ .config = &modem_telit_fn990_config, ++ .bar_num = MHI_PCI_DEFAULT_BAR_NUM, ++ .dma_data_width = 32, ++ .sideband_wake = false, ++ .mru_default = 32768, ++}; ++ + static const struct pci_device_id mhi_pci_id_table[] = { + /* EM919x (sdx55), use the same vid:pid as qcom-sdx55m */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, 0x18d7, 0x0200), +@@ -492,6 +530,9 @@ static const struct pci_device_id mhi_pc + .driver_data = (kernel_ulong_t) &mhi_qcom_sdx55_info }, + { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0304), + .driver_data = (kernel_ulong_t) &mhi_qcom_sdx24_info }, ++ /* Telit FN990 */ ++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, 0x1c5d, 0x2010), ++ .driver_data = (kernel_ulong_t) &mhi_telit_fn990_info }, + { PCI_DEVICE(0x1eac, 0x1001), /* EM120R-GL (sdx24) */ + .driver_data = (kernel_ulong_t) &mhi_quectel_em1xx_info }, + { PCI_DEVICE(0x1eac, 0x1002), /* EM160R-GL (sdx24) */ diff --git a/queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch b/queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch new file mode 100644 index 00000000000..f635f215942 --- /dev/null +++ b/queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch @@ -0,0 +1,97 @@ +From 2d4bd81fea1ad6ebba543bd6da3ef5179d130e6a Mon Sep 17 00:00:00 2001 +From: Stylon Wang +Date: Thu, 7 Jul 2022 16:23:29 +0800 +Subject: drm/amd/display: Fix new dmub notification enabling in DM + +From: Stylon Wang + +commit 2d4bd81fea1ad6ebba543bd6da3ef5179d130e6a upstream. + +[Why] +Changes from "Fix for dmub outbox notification enable" need to land +in DM or DMUB outbox notification would be disabled. + +[How] +Enable outbox notification only after interrupt are enabled and IRQ +handlers registered. Any pending notification will be sent by DMUB +once outbox notification is enabled. + +Fixes: ed7208706448 ("drm/amd/display: Fix for dmub outbox notification enable") +Reviewed-by: Nicholas Kazlauskas +Acked-by: Solomon Chiu +Signed-off-by: Stylon Wang +Acked-by: Harry Wentland +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 27 +++++++++++++++------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1670,7 +1670,7 @@ static int amdgpu_dm_init(struct amdgpu_ + #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) + adev->dm.crc_rd_wrk = amdgpu_dm_crtc_secure_display_create_work(); + #endif +- if (dc_enable_dmub_notifications(adev->dm.dc)) { ++ if (dc_is_dmub_outbox_supported(adev->dm.dc)) { + init_completion(&adev->dm.dmub_aux_transfer_done); + adev->dm.dmub_notify = kzalloc(sizeof(struct dmub_notification), GFP_KERNEL); + if (!adev->dm.dmub_notify) { +@@ -1708,6 +1708,13 @@ static int amdgpu_dm_init(struct amdgpu_ + goto error; + } + ++ /* Enable outbox notification only after IRQ handlers are registered and DMUB is alive. ++ * It is expected that DMUB will resend any pending notifications at this point, for ++ * example HPD from DPIA. ++ */ ++ if (dc_is_dmub_outbox_supported(adev->dm.dc)) ++ dc_enable_dmub_outbox(adev->dm.dc); ++ + /* create fake encoders for MST */ + dm_dp_create_fake_mst_encoders(adev); + +@@ -2701,9 +2708,6 @@ static int dm_resume(void *handle) + */ + link_enc_cfg_copy(adev->dm.dc->current_state, dc_state); + +- if (dc_enable_dmub_notifications(adev->dm.dc)) +- amdgpu_dm_outbox_init(adev); +- + r = dm_dmub_hw_init(adev); + if (r) + DRM_ERROR("DMUB interface failed to initialize: status=%d\n", r); +@@ -2721,6 +2725,11 @@ static int dm_resume(void *handle) + } + } + ++ if (dc_is_dmub_outbox_supported(adev->dm.dc)) { ++ amdgpu_dm_outbox_init(adev); ++ dc_enable_dmub_outbox(adev->dm.dc); ++ } ++ + WARN_ON(!dc_commit_state(dm->dc, dc_state)); + + dm_gpureset_commit_state(dm->cached_dc_state, dm); +@@ -2742,13 +2751,15 @@ static int dm_resume(void *handle) + /* TODO: Remove dc_state->dccg, use dc->dccg directly. */ + dc_resource_state_construct(dm->dc, dm_state->context); + +- /* Re-enable outbox interrupts for DPIA. */ +- if (dc_enable_dmub_notifications(adev->dm.dc)) +- amdgpu_dm_outbox_init(adev); +- + /* Before powering on DC we need to re-initialize DMUB. */ + dm_dmub_hw_resume(adev); + ++ /* Re-enable outbox interrupts for DPIA. */ ++ if (dc_is_dmub_outbox_supported(adev->dm.dc)) { ++ amdgpu_dm_outbox_init(adev); ++ dc_enable_dmub_outbox(adev->dm.dc); ++ } ++ + /* power on hardware */ + dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0); + diff --git a/queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch b/queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch new file mode 100644 index 00000000000..c8588be916f --- /dev/null +++ b/queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch @@ -0,0 +1,68 @@ +From 9b04369b060fd4885f728b7a4ab4851ffb1abb64 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Tue, 12 Apr 2022 01:15:36 +0300 +Subject: drm/scheduler: Don't kill jobs in interrupt context + +From: Dmitry Osipenko + +commit 9b04369b060fd4885f728b7a4ab4851ffb1abb64 upstream. + +Interrupt context can't sleep. Drivers like Panfrost and MSM are taking +mutex when job is released, and thus, that code can sleep. This results +into "BUG: scheduling while atomic" if locks are contented while job is +freed. There is no good reason for releasing scheduler's jobs in IRQ +context, hence use normal context to fix the trouble. + +Cc: stable@vger.kernel.org +Fixes: 542cff7893a3 ("drm/sched: Avoid lockdep spalt on killing a processes") +Signed-off-by: Dmitry Osipenko +Signed-off-by: Andrey Grodzovsky +Link: https://patchwork.freedesktop.org/patch/msgid/20220411221536.283312-1-dmitry.osipenko@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/scheduler/sched_entity.c | 6 +++--- + include/drm/gpu_scheduler.h | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/scheduler/sched_entity.c ++++ b/drivers/gpu/drm/scheduler/sched_entity.c +@@ -190,7 +190,7 @@ long drm_sched_entity_flush(struct drm_s + } + EXPORT_SYMBOL(drm_sched_entity_flush); + +-static void drm_sched_entity_kill_jobs_irq_work(struct irq_work *wrk) ++static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) + { + struct drm_sched_job *job = container_of(wrk, typeof(*job), work); + +@@ -207,8 +207,8 @@ static void drm_sched_entity_kill_jobs_c + struct drm_sched_job *job = container_of(cb, struct drm_sched_job, + finish_cb); + +- init_irq_work(&job->work, drm_sched_entity_kill_jobs_irq_work); +- irq_work_queue(&job->work); ++ INIT_WORK(&job->work, drm_sched_entity_kill_jobs_work); ++ schedule_work(&job->work); + } + + static struct dma_fence * +--- a/include/drm/gpu_scheduler.h ++++ b/include/drm/gpu_scheduler.h +@@ -28,7 +28,7 @@ + #include + #include + #include +-#include ++#include + + #define MAX_WAIT_SCHED_ENTITY_Q_EMPTY msecs_to_jiffies(1000) + +@@ -294,7 +294,7 @@ struct drm_sched_job { + */ + union { + struct dma_fence_cb finish_cb; +- struct irq_work work; ++ struct work_struct work; + }; + + uint64_t id; diff --git a/queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch b/queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch new file mode 100644 index 00000000000..3d634a72a3b --- /dev/null +++ b/queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch @@ -0,0 +1,58 @@ +From dbd0da2453c694f2f74651834d90fb280b57f151 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Fri, 15 Jul 2022 09:57:22 +0200 +Subject: drm/ttm: fix locking in vmap/vunmap TTM GEM helpers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit dbd0da2453c694f2f74651834d90fb280b57f151 upstream. + +I've stumbled over this while reviewing patches for DMA-buf and it looks +like we completely messed the locking up here. + +In general most TTM function should only be called while holding the +appropriate BO resv lock. Without this we could break the internal +buffer object state here. + +Only compile tested! + +Signed-off-by: Christian König +Fixes: 43676605f890 ("drm/ttm: Add vmap/vunmap to TTM and TTM GEM helpers") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Osipenko +Link: https://patchwork.freedesktop.org/patch/msgid/20220715111533.467012-1-christian.koenig@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gem_ttm_helper.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gem_ttm_helper.c ++++ b/drivers/gpu/drm/drm_gem_ttm_helper.c +@@ -64,8 +64,13 @@ int drm_gem_ttm_vmap(struct drm_gem_obje + struct iosys_map *map) + { + struct ttm_buffer_object *bo = drm_gem_ttm_of_gem(gem); ++ int ret; + +- return ttm_bo_vmap(bo, map); ++ dma_resv_lock(gem->resv, NULL); ++ ret = ttm_bo_vmap(bo, map); ++ dma_resv_unlock(gem->resv); ++ ++ return ret; + } + EXPORT_SYMBOL(drm_gem_ttm_vmap); + +@@ -82,7 +87,9 @@ void drm_gem_ttm_vunmap(struct drm_gem_o + { + struct ttm_buffer_object *bo = drm_gem_ttm_of_gem(gem); + ++ dma_resv_lock(gem->resv, NULL); + ttm_bo_vunmap(bo, map); ++ dma_resv_unlock(gem->resv); + } + EXPORT_SYMBOL(drm_gem_ttm_vunmap); + diff --git a/queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch b/queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch new file mode 100644 index 00000000000..8a1e9539a85 --- /dev/null +++ b/queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch @@ -0,0 +1,57 @@ +From 543ce63b664e2c2f9533d089a4664b559c3e6b5b Mon Sep 17 00:00:00 2001 +From: Eric Snowberg +Date: Wed, 20 Jul 2022 12:40:27 -0400 +Subject: lockdown: Fix kexec lockdown bypass with ima policy + +From: Eric Snowberg + +commit 543ce63b664e2c2f9533d089a4664b559c3e6b5b upstream. + +The lockdown LSM is primarily used in conjunction with UEFI Secure Boot. +This LSM may also be used on machines without UEFI. It can also be +enabled when UEFI Secure Boot is disabled. One of lockdown's features +is to prevent kexec from loading untrusted kernels. Lockdown can be +enabled through a bootparam or after the kernel has booted through +securityfs. + +If IMA appraisal is used with the "ima_appraise=log" boot param, +lockdown can be defeated with kexec on any machine when Secure Boot is +disabled or unavailable. IMA prevents setting "ima_appraise=log" from +the boot param when Secure Boot is enabled, but this does not cover +cases where lockdown is used without Secure Boot. + +To defeat lockdown, boot without Secure Boot and add ima_appraise=log to +the kernel command line; then: + + $ echo "integrity" > /sys/kernel/security/lockdown + $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \ + /sys/kernel/security/ima/policy + $ kexec -ls unsigned-kernel + +Add a call to verify ima appraisal is set to "enforce" whenever lockdown +is enabled. This fixes CVE-2022-21505. + +Cc: stable@vger.kernel.org +Fixes: 29d3c1c8dfe7 ("kexec: Allow kexec_file() with appropriate IMA policy when locked down") +Signed-off-by: Eric Snowberg +Acked-by: Mimi Zohar +Reviewed-by: John Haxby +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/ima/ima_policy.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -2181,6 +2181,10 @@ bool ima_appraise_signature(enum kernel_ + if (id >= READING_MAX_ID) + return false; + ++ if (id == READING_KEXEC_IMAGE && !(ima_appraise & IMA_APPRAISE_ENFORCE) ++ && security_locked_down(LOCKDOWN_KEXEC)) ++ return false; ++ + func = read_idmap[id] ?: FILE_CHECK; + + rcu_read_lock(); diff --git a/queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch b/queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch new file mode 100644 index 00000000000..b76a442b765 --- /dev/null +++ b/queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch @@ -0,0 +1,44 @@ +From e5ec6a2513383fe2ecc2ee3b5f51d97acbbcd4d8 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Tue, 19 Jul 2022 15:26:26 +0300 +Subject: mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication + +From: Ido Schimmel + +commit e5ec6a2513383fe2ecc2ee3b5f51d97acbbcd4d8 upstream. + +mlxsw needs to distinguish nexthops with a gateway from connected +nexthops in order to write the former to the adjacency table of the +device. The check used to rely on the fact that nexthops with a gateway +have a 'link' scope whereas connected nexthops have a 'host' scope. This +is no longer correct after commit 747c14307214 ("ip: fix dflt addr +selection for connected nexthop"). + +Fix that by instead checking the address family of the gateway IP. This +is a more direct way and also consistent with the IPv6 counterpart in +mlxsw_sp_rt6_is_gateway(). + +Cc: stable@vger.kernel.org +Fixes: 747c14307214 ("ip: fix dflt addr selection for connected nexthop") +Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops") +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Reviewed-by: Nicolas Dichtel +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -5387,7 +5387,7 @@ static bool mlxsw_sp_fi_is_gateway(const + { + const struct fib_nh *nh = fib_info_nh(fi, 0); + +- return nh->fib_nh_scope == RT_SCOPE_LINK || ++ return nh->fib_nh_gw_family || + mlxsw_sp_nexthop4_ipip_type(mlxsw_sp, nh, NULL); + } + diff --git a/queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch b/queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch new file mode 100644 index 00000000000..ed095a1c76e --- /dev/null +++ b/queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch @@ -0,0 +1,66 @@ +From 51189eb9ddc88851edc42f539a0f9862fd0630c2 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Wed, 22 Jun 2022 08:12:15 +0300 +Subject: mmc: sdhci-omap: Fix a lockdep warning for PM runtime init + +From: Tony Lindgren + +commit 51189eb9ddc88851edc42f539a0f9862fd0630c2 upstream. + +We need runtime PM enabled early in probe before sdhci_setup_host() for +sdhci_omap_set_capabilities(). But on the first runtime resume we must +not call sdhci_runtime_resume_host() as sdhci_setup_host() has not been +called yet. Let's check for an initialized controller like we already do +for context restore to fix a lockdep warning. + +Fixes: f433e8aac6b9 ("mmc: sdhci-omap: Implement PM runtime functions") +Reported-by: Yegor Yefremov +Suggested-by: Arnd Bergmann +Signed-off-by: Tony Lindgren +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220622051215.34063-1-tony@atomide.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-omap.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -1303,8 +1303,9 @@ static int sdhci_omap_probe(struct platf + /* + * omap_device_pm_domain has callbacks to enable the main + * functional clock, interface clock and also configure the +- * SYSCONFIG register of omap devices. The callback will be invoked +- * as part of pm_runtime_get_sync. ++ * SYSCONFIG register to clear any boot loader set voltage ++ * capabilities before calling sdhci_setup_host(). The ++ * callback will be invoked as part of pm_runtime_get_sync. + */ + pm_runtime_use_autosuspend(dev); + pm_runtime_set_autosuspend_delay(dev, 50); +@@ -1446,7 +1447,8 @@ static int __maybe_unused sdhci_omap_run + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host); + +- sdhci_runtime_suspend_host(host); ++ if (omap_host->con != -EINVAL) ++ sdhci_runtime_suspend_host(host); + + sdhci_omap_context_save(omap_host); + +@@ -1463,10 +1465,10 @@ static int __maybe_unused sdhci_omap_run + + pinctrl_pm_select_default_state(dev); + +- if (omap_host->con != -EINVAL) ++ if (omap_host->con != -EINVAL) { + sdhci_omap_context_restore(omap_host); +- +- sdhci_runtime_resume_host(host, 0); ++ sdhci_runtime_resume_host(host, 0); ++ } + + return 0; + } diff --git a/queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch b/queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch new file mode 100644 index 00000000000..a5ba07f57f2 --- /dev/null +++ b/queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch @@ -0,0 +1,71 @@ +From 0fddf9ad06fd9f439f137139861556671673e31c Mon Sep 17 00:00:00 2001 +From: Sascha Hauer +Date: Fri, 1 Jul 2022 13:03:41 +0200 +Subject: mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sascha Hauer + +commit 0fddf9ad06fd9f439f137139861556671673e31c upstream. + +06781a5026350 Fixes the calculation of the DEVICE_BUSY_TIMEOUT register +value from busy_timeout_cycles. busy_timeout_cycles is calculated wrong +though: It is calculated based on the maximum page read time, but the +timeout is also used for page write and block erase operations which +require orders of magnitude bigger timeouts. + +Fix this by calculating busy_timeout_cycles from the maximum of +tBERS_max and tPROG_max. + +This is for now the easiest and most obvious way to fix the driver. +There's room for improvements though: The NAND_OP_WAITRDY_INSTR tells us +the desired timeout for the current operation, so we could program the +timeout dynamically for each operation instead of setting a fixed +timeout. Also we could wire up the interrupt handler to actually detect +and forward timeouts occurred when waiting for the chip being ready. + +As a sidenote I verified that the change in 06781a5026350 is really +correct. I wired up the interrupt handler in my tree and measured the +time between starting the operation and the timeout interrupt handler +coming in. The time increases 41us with each step in the timeout +register which corresponds to 4096 clock cycles with the 99MHz clock +that I have. + +Fixes: 06781a5026350 ("mtd: rawnand: gpmi: Fix setting busy timeout setting") +Fixes: b1206122069aa ("mtd: rawniand: gpmi: use core timings instead of an empirical derivation") +Cc: stable@vger.kernel.org +Signed-off-by: Sascha Hauer +Acked-by: Han Xu +Tested-by: Tomasz Moń +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -655,9 +655,10 @@ static int gpmi_nfc_compute_timings(stru + unsigned int tRP_ps; + bool use_half_period; + int sample_delay_ps, sample_delay_factor; +- u16 busy_timeout_cycles; ++ unsigned int busy_timeout_cycles; + u8 wrn_dly_sel; + unsigned long clk_rate, min_rate; ++ u64 busy_timeout_ps; + + if (sdr->tRC_min >= 30000) { + /* ONFI non-EDO modes [0-3] */ +@@ -690,7 +691,8 @@ static int gpmi_nfc_compute_timings(stru + addr_setup_cycles = TO_CYCLES(sdr->tALS_min, period_ps); + data_setup_cycles = TO_CYCLES(sdr->tDS_min, period_ps); + data_hold_cycles = TO_CYCLES(sdr->tDH_min, period_ps); +- busy_timeout_cycles = TO_CYCLES(sdr->tWB_max + sdr->tR_max, period_ps); ++ busy_timeout_ps = max(sdr->tBERS_max, sdr->tPROG_max); ++ busy_timeout_cycles = TO_CYCLES(busy_timeout_ps, period_ps); + + hw->timing0 = BF_GPMI_TIMING0_ADDRESS_SETUP(addr_setup_cycles) | + BF_GPMI_TIMING0_DATA_HOLD(data_hold_cycles) | diff --git a/queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch b/queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch new file mode 100644 index 00000000000..9d0e1b0f163 --- /dev/null +++ b/queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch @@ -0,0 +1,166 @@ +From 36a15e1cb134c0395261ba1940762703f778438c Mon Sep 17 00:00:00 2001 +From: Jose Alonso +Date: Mon, 13 Jun 2022 15:32:44 -0300 +Subject: net: usb: ax88179_178a needs FLAG_SEND_ZLP + +From: Jose Alonso + +commit 36a15e1cb134c0395261ba1940762703f778438c upstream. + +The extra byte inserted by usbnet.c when + (length % dev->maxpacket == 0) is causing problems to device. + +This patch sets FLAG_SEND_ZLP to avoid this. + +Tested with: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet + +Problems observed: +====================================================================== +1) Using ssh/sshfs. The remote sshd daemon can abort with the message: + "message authentication code incorrect" + This happens because the tcp message sent is corrupted during the + USB "Bulk out". The device calculate the tcp checksum and send a + valid tcp message to the remote sshd. Then the encryption detects + the error and aborts. +2) NETDEV WATCHDOG: ... (ax88179_178a): transmit queue 0 timed out +3) Stop normal work without any log message. + The "Bulk in" continue receiving packets normally. + The host sends "Bulk out" and the device responds with -ECONNRESET. + (The netusb.c code tx_complete ignore -ECONNRESET) +Under normal conditions these errors take days to happen and in +intense usage take hours. + +A test with ping gives packet loss, showing that something is wrong: +ping -4 -s 462 {destination} # 462 = 512 - 42 - 8 +Not all packets fail. +My guess is that the device tries to find another packet starting +at the extra byte and will fail or not depending on the next +bytes (old buffer content). +====================================================================== + +Signed-off-by: Jose Alonso +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ax88179_178a.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1801,7 +1801,7 @@ static const struct driver_info ax88179_ + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1814,7 +1814,7 @@ static const struct driver_info ax88178a + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1827,7 +1827,7 @@ static const struct driver_info cypress_ + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1840,7 +1840,7 @@ static const struct driver_info dlink_du + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1853,7 +1853,7 @@ static const struct driver_info sitecom_ + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1866,7 +1866,7 @@ static const struct driver_info samsung_ + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1879,7 +1879,7 @@ static const struct driver_info lenovo_i + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1892,7 +1892,7 @@ static const struct driver_info belkin_i + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1905,7 +1905,7 @@ static const struct driver_info toshiba_ + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1918,7 +1918,7 @@ static const struct driver_info mct_info + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1931,7 +1931,7 @@ static const struct driver_info at_umc20 + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1944,7 +1944,7 @@ static const struct driver_info at_umc20 + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1957,7 +1957,7 @@ static const struct driver_info at_umc20 + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; diff --git a/queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch b/queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch new file mode 100644 index 00000000000..1b425593230 --- /dev/null +++ b/queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch @@ -0,0 +1,86 @@ +From 4546760619cfa9b718fe2059ceb07101cf9ff61e Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Sun, 17 Jul 2022 02:37:45 +0300 +Subject: pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context + +From: Vladimir Oltean + +commit 4546760619cfa9b718fe2059ceb07101cf9ff61e upstream. + +The irqchip->irq_set_type method is called by __irq_set_trigger() under +the desc->lock raw spinlock. + +The armada-37xx implementation, armada_37xx_irq_set_type(), uses an MMIO +regmap created by of_syscon_register(), which uses plain spinlocks +(the kind that are sleepable on RT). + +Therefore, this is an invalid locking scheme for which we get a kernel +splat stating just that ("[ BUG: Invalid wait context ]"), because the +context in which the plain spinlock may sleep is atomic due to the raw +spinlock. We need to go raw spinlocks all the way. + +Make this driver create its own MMIO regmap, with use_raw_spinlock=true, +and stop relying on syscon to provide it. + +This patch depends on commit 67021f25d952 ("regmap: teach regmap to use +raw spinlocks if requested in the config"). + +Cc: # 5.15+ +Fixes: 2f227605394b ("pinctrl: armada-37xx: Add irqchip support") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220716233745.1704677-3-vladimir.oltean@nxp.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -1121,25 +1121,40 @@ static const struct of_device_id armada_ + { }, + }; + ++static const struct regmap_config armada_37xx_pinctrl_regmap_config = { ++ .reg_bits = 32, ++ .val_bits = 32, ++ .reg_stride = 4, ++ .use_raw_spinlock = true, ++}; ++ + static int __init armada_37xx_pinctrl_probe(struct platform_device *pdev) + { + struct armada_37xx_pinctrl *info; + struct device *dev = &pdev->dev; +- struct device_node *np = dev->of_node; + struct regmap *regmap; ++ void __iomem *base; + int ret; + ++ base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL); ++ if (IS_ERR(base)) { ++ dev_err(dev, "failed to ioremap base address: %pe\n", base); ++ return PTR_ERR(base); ++ } ++ ++ regmap = devm_regmap_init_mmio(dev, base, ++ &armada_37xx_pinctrl_regmap_config); ++ if (IS_ERR(regmap)) { ++ dev_err(dev, "failed to create regmap: %pe\n", regmap); ++ return PTR_ERR(regmap); ++ } ++ + info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + + info->dev = dev; +- +- regmap = syscon_node_to_regmap(np); +- if (IS_ERR(regmap)) +- return dev_err_probe(dev, PTR_ERR(regmap), "cannot get regmap\n"); + info->regmap = regmap; +- + info->data = of_device_get_match_data(dev); + + ret = armada_37xx_pinctrl_register(pdev, info); diff --git a/queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch b/queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch new file mode 100644 index 00000000000..9e118b76639 --- /dev/null +++ b/queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch @@ -0,0 +1,63 @@ +From a1d4ef1adf8bbd302067534ead671a94759687ed Mon Sep 17 00:00:00 2001 +From: Fabien Dessenne +Date: Mon, 27 Jun 2022 16:23:50 +0200 +Subject: pinctrl: stm32: fix optional IRQ support to gpios + +From: Fabien Dessenne + +commit a1d4ef1adf8bbd302067534ead671a94759687ed upstream. + +To act as an interrupt controller, a gpio bank relies on the +"interrupt-parent" of the pin controller. +When this optional "interrupt-parent" misses, do not create any IRQ domain. + +This fixes a "NULL pointer in stm32_gpio_domain_alloc()" kernel crash when +the interrupt-parent = property is not declared in the Device Tree. + +Fixes: 0eb9f683336d ("pinctrl: Add IRQ support to STM32 gpios") +Signed-off-by: Fabien Dessenne +Link: https://lore.kernel.org/r/20220627142350.742973-1-fabien.dessenne@foss.st.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + + +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1299,15 +1299,17 @@ static int stm32_gpiolib_register_bank(s + bank->bank_ioport_nr = bank_ioport_nr; + spin_lock_init(&bank->lock); + +- /* create irq hierarchical domain */ +- bank->fwnode = of_node_to_fwnode(np); ++ if (pctl->domain) { ++ /* create irq hierarchical domain */ ++ bank->fwnode = of_node_to_fwnode(np); ++ ++ bank->domain = irq_domain_create_hierarchy(pctl->domain, 0, STM32_GPIO_IRQ_LINE, ++ bank->fwnode, &stm32_gpio_domain_ops, ++ bank); + +- bank->domain = irq_domain_create_hierarchy(pctl->domain, 0, +- STM32_GPIO_IRQ_LINE, bank->fwnode, +- &stm32_gpio_domain_ops, bank); +- +- if (!bank->domain) +- return -ENODEV; ++ if (!bank->domain) ++ return -ENODEV; ++ } + + err = gpiochip_add_data(&bank->gpio_chip, bank); + if (err) { +@@ -1466,6 +1468,8 @@ int stm32_pctl_probe(struct platform_dev + pctl->domain = stm32_pctrl_get_irq_domain(np); + if (IS_ERR(pctl->domain)) + return PTR_ERR(pctl->domain); ++ if (!pctl->domain) ++ dev_warn(dev, "pinctrl without interrupt support\n"); + + /* hwspinlock is optional */ + hwlock_id = of_hwspin_lock_get_id(pdev->dev.of_node, 0); diff --git a/queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch b/queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch new file mode 100644 index 00000000000..49c015af8c9 --- /dev/null +++ b/queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch @@ -0,0 +1,48 @@ +From c1f6eff304e4dfa4558b6a8c6b2d26a91db6c998 Mon Sep 17 00:00:00 2001 +From: Ben Dooks +Date: Sun, 29 May 2022 16:22:00 +0100 +Subject: riscv: add as-options for modules with assembly compontents + +From: Ben Dooks + +commit c1f6eff304e4dfa4558b6a8c6b2d26a91db6c998 upstream. + +When trying to load modules built for RISC-V which include assembly files +the kernel loader errors with "unexpected relocation type 'R_RISCV_ALIGN'" +due to R_RISCV_ALIGN relocations being generated by the assembler. + +The R_RISCV_ALIGN relocations can be removed at the expense of code space +by adding -mno-relax to gcc and as. In commit 7a8e7da42250138 +("RISC-V: Fixes to module loading") -mno-relax is added to the build +variable KBUILD_CFLAGS_MODULE. See [1] for more info. + +The issue is that when kbuild builds a .S file, it invokes gcc with +the -mno-relax flag, but this is not being passed through to the +assembler. Adding -Wa,-mno-relax to KBUILD_AFLAGS_MODULE ensures that +the assembler is invoked correctly. This may have now been fixed in +gcc[2] and this addition should not stop newer gcc and as from working. + +[1] https://github.com/riscv/riscv-elf-psabi-doc/issues/183 +[2] https://github.com/gcc-mirror/gcc/commit/3b0a7d624e64eeb81e4d5e8c62c46d86ef521857 + +Signed-off-by: Ben Dooks +Reviewed-by: Bin Meng +Link: https://lore.kernel.org/r/20220529152200.609809-1-ben.dooks@codethink.co.uk +Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module") +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -73,6 +73,7 @@ ifeq ($(CONFIG_PERF_EVENTS),y) + endif + + KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-relax) ++KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax) + + # GCC versions that support the "-mstrict-align" option default to allowing + # unaligned accesses. While unaligned accesses are explicitly allowed in the diff --git a/queue-5.18/series b/queue-5.18/series new file mode 100644 index 00000000000..2c6391443cf --- /dev/null +++ b/queue-5.18/series @@ -0,0 +1,13 @@ +pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch +pinctrl-stm32-fix-optional-irq-support-to-gpios.patch +riscv-add-as-options-for-modules-with-assembly-compontents.patch +mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch +lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch +mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch +mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch +drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch +drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch +drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch +net-usb-ax88179_178a-needs-flag_send_zlp.patch +bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch +bus-mhi-host-pci_generic-add-telit-fn990.patch -- 2.47.3