From bfb983b2000998c58966a82a30e676348d575393 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 9 Dec 2023 01:02:23 -0500 Subject: [PATCH] Fixes for 6.6 Signed-off-by: Sasha Levin --- ...1-rpi-400-fix-delete-node-of-led_act.patch | 48 +++++ ...ts-imx28-xea-pass-the-model-property.patch | 39 ++++ ...q-skov-fix-ethernet-clock-regression.patch | 44 +++++ ...pico-describe-the-ethernet-phy-clock.patch | 43 +++++ ...lare-timers-compatible-with-fsl-imx6.patch | 65 +++++++ ...-fix-sdmmc_pwren-s-pinmux-setting-fo.patch | 40 ++++ ...turn-value-of-devm_kasprintf-in-imx_.patch | 55 ++++++ ...qma9352-mba93xxla-fix-lpuart2-pad-co.patch | 36 ++++ ...freescale-imx8-ss-lsio-fix-pwm-cells.patch | 67 +++++++ ...palis-set-wifi-regulator-to-always-o.patch | 43 +++++ ...-dts-imx8-ss-lsio-add-pwm-interrupts.patch | 67 +++++++ ...-imx8mq-add-parkmode-disable-ss-quir.patch | 115 ++++++++++++ ...m64-dts-imx93-correct-mediamix-power.patch | 42 +++++ ...ip-expand-reg-size-of-vdec-node-for-.patch | 37 ++++ ...and-reg-size-of-vdec-node-for-.patch-17227 | 50 +++++ ...ip-fix-emmc-data-strobe-pd-on-rk3588.patch | 63 +++++++ ...s-tx-macro-set-active_decimator-corr.patch | 45 +++++ ...-no-frame-sync-clock-issue-on-i.mx8m.patch | 68 +++++++ ...x-memleak-in-wm_adsp_buffer_populate.patch | 57 ++++++ ...8768-select-config_videomode_helpers.patch | 42 +++++ ...i-extend-perf-protocol-ops-to-get-in.patch | 175 ++++++++++++++++++ ...i-extend-perf-protocol-ops-to-get-nu.patch | 73 ++++++++ ...i-fix-frequency-truncation-by-promot.patch | 54 ++++++ ...i-fix-possible-frequency-truncation-.patch | 87 +++++++++ ...i-simplify-error-path-in-scmi_dvfs_d.patch | 65 +++++++ ...mon-acpi_power_meter-fix-4.29-mw-bug.patch | 55 ++++++ ...n2-fix-error-handling-path-in-kraken.patch | 49 +++++ ...eck-for-buffer-list-readiness-after-.patch | 45 +++++ ...x-an-null-vs-is_err-bug-in-io_alloc_.patch | 39 ++++ ...exec-drop-select-of-kexec-for-crash_.patch | 98 ++++++++++ ...d_recovery_frozen-in-error-path-of-m.patch | 91 +++++++++ ...re-correct-module-description-string.patch | 38 ++++ ...em-iterator-when-page_size-is-greate.patch | 145 +++++++++++++++ ...init-value-access-in-ib_get_eth_spee.patch | 82 ++++++++ ...ecessary-err-return-when-using-inval.patch | 49 +++++ ...ma-irdma-add-wait-for-suspend-on-sqd.patch | 132 +++++++++++++ ...oid-free-the-non-cqp_request-scratch.patch | 89 +++++++++ ...-irdma-do-not-modify-to-sqd-on-error.patch | 42 +++++ ...e-iwarp-qp-queue-memory-is-os-paged-.patch | 45 +++++ ...rdma-irdma-fix-support-for-64k-pages.patch | 41 ++++ ...fix-uaf-in-irdma_sc_ccq_get_cqe_info.patch | 76 ++++++++ ...rtrs-clt-fix-the-max_send_wr-setting.patch | 39 ++++ ...move-the-warnings-for-req-in_use-che.patch | 42 +++++ ...rdma-rtrs-clt-start-hb-after-path_up.patch | 47 +++++ ...eck-return-values-while-processing-i.patch | 92 +++++++++ ...stroy-path-files-after-making-sure-n.patch | 57 ++++++ ...rv-do-not-unconditionally-enable-irq.patch | 54 ++++++ ...ee-srv_mr-iu-only-when-always_invali.patch | 42 +++++ ...es-probe-for-iocp-only-once-in-boot-.patch | 119 ++++++++++++ ...gned-access-handling-of-c.swsp-and-c.patch | 56 ++++++ ...lx-device-list-bus-and-lx-device-lis.patch | 99 ++++++++++ ...x-a-memleak-in-beiscsi_init_wrb_hand.patch | 38 ++++ queue-6.6/series | 54 ++++++ ...-supplicant-based-device-enumeration.patch | 100 ++++++++++ ...rning-when-allocating-buffered-event.patch | 83 +++++++++ 55 files changed, 3558 insertions(+) create mode 100644 queue-6.6/arm-dts-bcm2711-rpi-400-fix-delete-node-of-led_act.patch create mode 100644 queue-6.6/arm-dts-imx28-xea-pass-the-model-property.patch create mode 100644 queue-6.6/arm-dts-imx6q-skov-fix-ethernet-clock-regression.patch create mode 100644 queue-6.6/arm-dts-imx6ul-pico-describe-the-ethernet-phy-clock.patch create mode 100644 queue-6.6/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch create mode 100644 queue-6.6/arm-dts-rockchip-fix-sdmmc_pwren-s-pinmux-setting-fo.patch create mode 100644 queue-6.6/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch create mode 100644 queue-6.6/arm64-dt-imx93-tqma9352-mba93xxla-fix-lpuart2-pad-co.patch create mode 100644 queue-6.6/arm64-dts-freescale-imx8-ss-lsio-fix-pwm-cells.patch create mode 100644 queue-6.6/arm64-dts-imx8-apalis-set-wifi-regulator-to-always-o.patch create mode 100644 queue-6.6/arm64-dts-imx8-ss-lsio-add-pwm-interrupts.patch create mode 100644 queue-6.6/arm64-dts-imx8mp-imx8mq-add-parkmode-disable-ss-quir.patch create mode 100644 queue-6.6/arm64-dts-imx93-correct-mediamix-power.patch create mode 100644 queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch create mode 100644 queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch-17227 create mode 100644 queue-6.6/arm64-dts-rockchip-fix-emmc-data-strobe-pd-on-rk3588.patch create mode 100644 queue-6.6/asoc-codecs-lpass-tx-macro-set-active_decimator-corr.patch create mode 100644 queue-6.6/asoc-fsl_sai-fix-no-frame-sync-clock-issue-on-i.mx8m.patch create mode 100644 queue-6.6/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch create mode 100644 queue-6.6/drm-bridge-tc358768-select-config_videomode_helpers.patch create mode 100644 queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-in.patch create mode 100644 queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-nu.patch create mode 100644 queue-6.6/firmware-arm_scmi-fix-frequency-truncation-by-promot.patch create mode 100644 queue-6.6/firmware-arm_scmi-fix-possible-frequency-truncation-.patch create mode 100644 queue-6.6/firmware-arm_scmi-simplify-error-path-in-scmi_dvfs_d.patch create mode 100644 queue-6.6/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch create mode 100644 queue-6.6/hwmon-nzxt-kraken2-fix-error-handling-path-in-kraken.patch create mode 100644 queue-6.6/io_uring-kbuf-check-for-buffer-list-readiness-after-.patch create mode 100644 queue-6.6/io_uring-kbuf-fix-an-null-vs-is_err-bug-in-io_alloc_.patch create mode 100644 queue-6.6/kernel-kconfig.kexec-drop-select-of-kexec-for-crash_.patch create mode 100644 queue-6.6/md-don-t-leave-md_recovery_frozen-in-error-path-of-m.patch create mode 100644 queue-6.6/rdma-bnxt_re-correct-module-description-string.patch create mode 100644 queue-6.6/rdma-core-fix-umem-iterator-when-page_size-is-greate.patch create mode 100644 queue-6.6/rdma-core-fix-uninit-value-access-in-ib_get_eth_spee.patch create mode 100644 queue-6.6/rdma-hns-fix-unnecessary-err-return-when-using-inval.patch create mode 100644 queue-6.6/rdma-irdma-add-wait-for-suspend-on-sqd.patch create mode 100644 queue-6.6/rdma-irdma-avoid-free-the-non-cqp_request-scratch.patch create mode 100644 queue-6.6/rdma-irdma-do-not-modify-to-sqd-on-error.patch create mode 100644 queue-6.6/rdma-irdma-ensure-iwarp-qp-queue-memory-is-os-paged-.patch create mode 100644 queue-6.6/rdma-irdma-fix-support-for-64k-pages.patch create mode 100644 queue-6.6/rdma-irdma-fix-uaf-in-irdma_sc_ccq_get_cqe_info.patch create mode 100644 queue-6.6/rdma-rtrs-clt-fix-the-max_send_wr-setting.patch create mode 100644 queue-6.6/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch create mode 100644 queue-6.6/rdma-rtrs-clt-start-hb-after-path_up.patch create mode 100644 queue-6.6/rdma-rtrs-srv-check-return-values-while-processing-i.patch create mode 100644 queue-6.6/rdma-rtrs-srv-destroy-path-files-after-making-sure-n.patch create mode 100644 queue-6.6/rdma-rtrs-srv-do-not-unconditionally-enable-irq.patch create mode 100644 queue-6.6/rdma-rtrs-srv-free-srv_mr-iu-only-when-always_invali.patch create mode 100644 queue-6.6/riscv-errata-andes-probe-for-iocp-only-once-in-boot-.patch create mode 100644 queue-6.6/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch create mode 100644 queue-6.6/scripts-gdb-fix-lx-device-list-bus-and-lx-device-lis.patch create mode 100644 queue-6.6/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch create mode 100644 queue-6.6/tee-optee-fix-supplicant-based-device-enumeration.patch create mode 100644 queue-6.6/tracing-fix-a-warning-when-allocating-buffered-event.patch diff --git a/queue-6.6/arm-dts-bcm2711-rpi-400-fix-delete-node-of-led_act.patch b/queue-6.6/arm-dts-bcm2711-rpi-400-fix-delete-node-of-led_act.patch new file mode 100644 index 00000000000..f0b84f755d7 --- /dev/null +++ b/queue-6.6/arm-dts-bcm2711-rpi-400-fix-delete-node-of-led_act.patch @@ -0,0 +1,48 @@ +From 15e67ab757beaa1b7bf00b5554276a66623db466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Nov 2023 13:42:52 +0100 +Subject: ARM: dts: bcm2711-rpi-400: Fix delete-node of led_act + +From: Stefan Wahren + +[ Upstream commit dc761f11af2e39119d3a7942e3d10615f3d900e7 ] + +The LED ACT which is included from bcm2711-rpi-4-b doesn't exists +on the Raspberry Pi 400. So the bcm2711-rpi-400.dts tries to +use the delete-node directive in order to remove the complete +node. Unfortunately the usage get broken in commit 1156e3a78bcc +("ARM: dts: bcm283x: Move ACT LED into separate dtsi") +and now ACT and PWR LED using the same GPIO and this prevent +probing of led-gpios on Raspberry Pi 400: + + leds-gpio: probe of leds failed with error -16 + +So fix the delete-node directive. + +Fixes: 1156e3a78bcc ("ARM: dts: bcm283x: Move ACT LED into separate dtsi") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231118124252.14838-3-wahrenst@gmx.net +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts b/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts +index 1ab8184302db4..5a2869a18bd55 100644 +--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts ++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts +@@ -36,9 +36,7 @@ + gpios = <&gpio 42 GPIO_ACTIVE_HIGH>; + }; + +-&leds { +- /delete-node/ led_act; +-}; ++/delete-node/ &led_act; + + &pm { + /delete-property/ system-power-controller; +-- +2.42.0 + diff --git a/queue-6.6/arm-dts-imx28-xea-pass-the-model-property.patch b/queue-6.6/arm-dts-imx28-xea-pass-the-model-property.patch new file mode 100644 index 00000000000..9e5ff723e85 --- /dev/null +++ b/queue-6.6/arm-dts-imx28-xea-pass-the-model-property.patch @@ -0,0 +1,39 @@ +From 83989d03955f1f07857f1e9c28f99f6dce8e0d49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 10:27:35 -0300 +Subject: ARM: dts: imx28-xea: Pass the 'model' property + +From: Fabio Estevam + +[ Upstream commit 63ef8fc9bcee6b73ca445a19a7ac6bd544723c9f ] + +Per root-node.yaml, 'model' is a required property. + +Pass it to fix the following dt-schema warning: + +imx28-xea.dtb: /: 'model' is a required property + from schema $id: http://devicetree.org/schemas/root-node.yaml# + +Signed-off-by: Fabio Estevam +Fixes: 445ae16ac1c5 ("ARM: dts: imx28: Add DTS description of imx28 based XEA board") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/mxs/imx28-xea.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/nxp/mxs/imx28-xea.dts b/arch/arm/boot/dts/nxp/mxs/imx28-xea.dts +index a400c108f66a2..6c5e6856648af 100644 +--- a/arch/arm/boot/dts/nxp/mxs/imx28-xea.dts ++++ b/arch/arm/boot/dts/nxp/mxs/imx28-xea.dts +@@ -8,6 +8,7 @@ + #include "imx28-lwe.dtsi" + + / { ++ model = "Liebherr XEA board"; + compatible = "lwn,imx28-xea", "fsl,imx28"; + }; + +-- +2.42.0 + diff --git a/queue-6.6/arm-dts-imx6q-skov-fix-ethernet-clock-regression.patch b/queue-6.6/arm-dts-imx6q-skov-fix-ethernet-clock-regression.patch new file mode 100644 index 00000000000..ad2c8d86d16 --- /dev/null +++ b/queue-6.6/arm-dts-imx6q-skov-fix-ethernet-clock-regression.patch @@ -0,0 +1,44 @@ +From 9ca67d48432b1a65beb4324af0f2c2cb76d6ae5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 12:03:37 +0100 +Subject: ARM: dts: imx6q: skov: fix ethernet clock regression + +From: Stefan Kerkmann + +[ Upstream commit 6552218f4dc47ba3c6c5b58cc1e9eb208a2b438b ] + +A regression was introduced in the Skov specific i.MX6 flavor +reve-mi1010ait-1cp1 device tree causing the external ethernet controller +to not being selected as the clock source for the i.MX6 ethernet MAC, +resulting in a none functional ethernet interface. The root cause is +that the ethernet clock selection is now part of the clocks node, which +is overwritten in the specific device tree and wasn't updated to contain +these ethernet clocks. + +Fixes: c89614079e44 ("ARM: dts: imx6qdl-skov-cpu: configure ethernet reference clock parent") +Signed-off-by: Stefan Kerkmann +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts b/arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts +index a3f247c722b43..0342a79ccd5db 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts +@@ -37,9 +37,9 @@ + + &clks { + assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>, +- <&clks IMX6QDL_CLK_LDB_DI1_SEL>; ++ <&clks IMX6QDL_CLK_LDB_DI1_SEL>, <&clks IMX6QDL_CLK_ENET_REF_SEL>; + assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, +- <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>; ++ <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, <&clk50m_phy>; + }; + + &hdmi { +-- +2.42.0 + diff --git a/queue-6.6/arm-dts-imx6ul-pico-describe-the-ethernet-phy-clock.patch b/queue-6.6/arm-dts-imx6ul-pico-describe-the-ethernet-phy-clock.patch new file mode 100644 index 00000000000..f8004ecbe7b --- /dev/null +++ b/queue-6.6/arm-dts-imx6ul-pico-describe-the-ethernet-phy-clock.patch @@ -0,0 +1,43 @@ +From 10a8cf03299ff4700bf6ff8f1690063b805669e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Nov 2023 10:32:19 -0300 +Subject: ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock + +From: Fabio Estevam + +[ Upstream commit d951f8f5f23a9417b7952f22b33784c73caa1ebb ] + +Since commit c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK +specific PHY fixup")thet Ethernet PHY is no longer configured via code +in board file. + +This caused Ethernet to stop working. + +Fix this problem by describing the clocks and clock-names to the +Ethernet PHY node so that the KSZ8081 chip can be clocked correctly. + +Fixes: c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific PHY fixup") +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi +index 4ffe99ed55ca2..07dcecbe485dc 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi +@@ -121,6 +121,8 @@ + max-speed = <100>; + interrupt-parent = <&gpio5>; + interrupts = <6 IRQ_TYPE_LEVEL_LOW>; ++ clocks = <&clks IMX6UL_CLK_ENET_REF>; ++ clock-names = "rmii-ref"; + }; + }; + }; +-- +2.42.0 + diff --git a/queue-6.6/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch b/queue-6.6/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch new file mode 100644 index 00000000000..6a74662f7d4 --- /dev/null +++ b/queue-6.6/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch @@ -0,0 +1,65 @@ +From 1425a6c23d9ad69c435d4da1bd35bfdc09696668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 17:05:01 +0100 +Subject: ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt + +From: Philipp Zabel + +[ Upstream commit 397caf68e2d36532054cb14ae8995537f27f8b61 ] + +The timer nodes declare compatibility with "fsl,imx6sx-gpt", which +itself is compatible with "fsl,imx6dl-gpt". Switch the fallback +compatible from "fsl,imx6sx-gpt" to "fsl,imx6dl-gpt". + +Fixes: 949673450291 ("ARM: dts: add imx7d soc dtsi file") +Signed-off-by: Philipp Zabel +Signed-off-by: Roland Hieber +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx7s.dtsi b/arch/arm/boot/dts/nxp/imx/imx7s.dtsi +index e152d08f27d49..bc79163c49b51 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx7s.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx7s.dtsi +@@ -454,7 +454,7 @@ + }; + + gpt1: timer@302d0000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x302d0000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT1_ROOT_CLK>, +@@ -463,7 +463,7 @@ + }; + + gpt2: timer@302e0000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x302e0000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT2_ROOT_CLK>, +@@ -473,7 +473,7 @@ + }; + + gpt3: timer@302f0000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x302f0000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT3_ROOT_CLK>, +@@ -483,7 +483,7 @@ + }; + + gpt4: timer@30300000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x30300000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT4_ROOT_CLK>, +-- +2.42.0 + diff --git a/queue-6.6/arm-dts-rockchip-fix-sdmmc_pwren-s-pinmux-setting-fo.patch b/queue-6.6/arm-dts-rockchip-fix-sdmmc_pwren-s-pinmux-setting-fo.patch new file mode 100644 index 00000000000..f8e0fa3d15e --- /dev/null +++ b/queue-6.6/arm-dts-rockchip-fix-sdmmc_pwren-s-pinmux-setting-fo.patch @@ -0,0 +1,40 @@ +From 86cebff432e348d765f88e14322940d074963bc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 19:46:44 +0100 +Subject: ARM: dts: rockchip: Fix sdmmc_pwren's pinmux setting for RK3128 + +From: Alex Bee + +[ Upstream commit 0c349b5001f8bdcead844484c15a0c4dfb341157 ] + +RK3128's reference design uses sdmmc_pwren pincontrol as GPIO - see [0]. + +Let's change it in the SoC DT as well. + +[0] https://github.com/rockchip-linux/kernel/commit/8c62deaf6025 + +Fixes: a0201bff6259 ("ARM: dts: rockchip: add rk3128 soc dtsi") +Signed-off-by: Alex Bee +Link: https://lore.kernel.org/r/20231127184643.13314-2-knaerzche@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk3128.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk3128.dtsi b/arch/arm/boot/dts/rockchip/rk3128.dtsi +index 88a4b0d6d928d..80d81af5fe0ef 100644 +--- a/arch/arm/boot/dts/rockchip/rk3128.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3128.dtsi +@@ -795,7 +795,7 @@ + }; + + sdmmc_pwren: sdmmc-pwren { +- rockchip,pins = <1 RK_PB6 1 &pcfg_pull_default>; ++ rockchip,pins = <1 RK_PB6 RK_FUNC_GPIO &pcfg_pull_default>; + }; + + sdmmc_bus4: sdmmc-bus4 { +-- +2.42.0 + diff --git a/queue-6.6/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch b/queue-6.6/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch new file mode 100644 index 00000000000..98043178bd6 --- /dev/null +++ b/queue-6.6/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch @@ -0,0 +1,55 @@ +From 9bdffa89607d8d7aa6e75b225576532012270267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 14:46:36 +0800 +Subject: ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init + +From: Kunwu Chan + +[ Upstream commit 1c2b1049af3f86545fcc5fae0fc725fb64b3a09e ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Release the id allocated in 'mmdc_pmu_init' when 'devm_kasprintf' +return NULL + +Suggested-by: Ahmad Fatoum +Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +Signed-off-by: Kunwu Chan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/mmdc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index 2157493b78a9b..df69af9323754 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -501,6 +501,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + name = devm_kasprintf(&pdev->dev, + GFP_KERNEL, "mmdc%d", ret); ++ if (!name) { ++ ret = -ENOMEM; ++ goto pmu_release_id; ++ } + + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; +@@ -523,9 +527,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + pmu_register_err: + pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); +- ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + hrtimer_cancel(&pmu_mmdc->hrtimer); ++pmu_release_id: ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + pmu_free: + kfree(pmu_mmdc); + return ret; +-- +2.42.0 + diff --git a/queue-6.6/arm64-dt-imx93-tqma9352-mba93xxla-fix-lpuart2-pad-co.patch b/queue-6.6/arm64-dt-imx93-tqma9352-mba93xxla-fix-lpuart2-pad-co.patch new file mode 100644 index 00000000000..056fd8e0e29 --- /dev/null +++ b/queue-6.6/arm64-dt-imx93-tqma9352-mba93xxla-fix-lpuart2-pad-co.patch @@ -0,0 +1,36 @@ +From 4a3c1ac74da0210df8dedac4fb822474697e2170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 08:32:17 +0200 +Subject: arm64: dt: imx93: tqma9352-mba93xxla: Fix LPUART2 pad config + +From: Alexander Stein + +[ Upstream commit 2bfba37b3d90d6d2d499d5b0dfe99c05c38b1b54 ] + +LPUART2_RTS# has an external pull-down, so do not enable the internal +pull-up at the same time, use a pull-down instead. + +Fixes: c982ecfa7992a ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +index f06139bdff97e..3c5c67ebee5d3 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +@@ -577,7 +577,7 @@ + fsl,pins = < + MX93_PAD_UART2_TXD__LPUART2_TX 0x31e + MX93_PAD_UART2_RXD__LPUART2_RX 0x31e +- MX93_PAD_SAI1_TXD0__LPUART2_RTS_B 0x31e ++ MX93_PAD_SAI1_TXD0__LPUART2_RTS_B 0x51e + >; + }; + +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-freescale-imx8-ss-lsio-fix-pwm-cells.patch b/queue-6.6/arm64-dts-freescale-imx8-ss-lsio-fix-pwm-cells.patch new file mode 100644 index 00000000000..ffd28e88be5 --- /dev/null +++ b/queue-6.6/arm64-dts-freescale-imx8-ss-lsio-fix-pwm-cells.patch @@ -0,0 +1,67 @@ +From 723cef6ae8110ac7016b2f4abaa1ee789a8faf79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 16:13:25 +0100 +Subject: arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Stein + +[ Upstream commit d863a2f4f47560d71447650822857fc3d2aea715 ] + +i.MX8QM/QXP supports inverted PWM output, thus #pwm-cells needs to be set +to 3. + +Fixes: 23fa99b205ea ("arm64: dts: freescale: imx8-ss-lsio: add support for lsio_pwm0-3") +Signed-off-by: Alexander Stein +Reviewed-by: Uwe Kleine-König +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +index 7b8bbf5e6a867..133f2b1ce1d2e 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +@@ -36,7 +36,7 @@ lsio_subsys: bus@5d000000 { + <&pwm0_lpcg 1>; + assigned-clocks = <&clk IMX_SC_R_PWM_0 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; +- #pwm-cells = <2>; ++ #pwm-cells = <3>; + interrupts = ; + status = "disabled"; + }; +@@ -49,7 +49,7 @@ lsio_subsys: bus@5d000000 { + <&pwm1_lpcg 1>; + assigned-clocks = <&clk IMX_SC_R_PWM_1 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; +- #pwm-cells = <2>; ++ #pwm-cells = <3>; + interrupts = ; + status = "disabled"; + }; +@@ -62,7 +62,7 @@ lsio_subsys: bus@5d000000 { + <&pwm2_lpcg 1>; + assigned-clocks = <&clk IMX_SC_R_PWM_2 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; +- #pwm-cells = <2>; ++ #pwm-cells = <3>; + interrupts = ; + status = "disabled"; + }; +@@ -75,7 +75,7 @@ lsio_subsys: bus@5d000000 { + <&pwm3_lpcg 1>; + assigned-clocks = <&clk IMX_SC_R_PWM_3 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; +- #pwm-cells = <2>; ++ #pwm-cells = <3>; + interrupts = ; + status = "disabled"; + }; +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-imx8-apalis-set-wifi-regulator-to-always-o.patch b/queue-6.6/arm64-dts-imx8-apalis-set-wifi-regulator-to-always-o.patch new file mode 100644 index 00000000000..5cf75d573fc --- /dev/null +++ b/queue-6.6/arm64-dts-imx8-apalis-set-wifi-regulator-to-always-o.patch @@ -0,0 +1,43 @@ +From 93df7d6fd21fbcb6d7720c9e77cbe81cf9191d2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 11:48:12 +0100 +Subject: arm64: dts: imx8-apalis: set wifi regulator to always-on + +From: Stefan Eichenberger + +[ Upstream commit 04179605ab604dba32571a05cd06423afc9eca19 ] + +Make sure that the wifi regulator is always on. The wifi driver itself +puts the wifi module into suspend mode. If we cut the power the driver +will crash when resuming from suspend. + +Signed-off-by: Stefan Eichenberger +Signed-off-by: Francesco Dolcini +Fixes: ad0de4ceb706 ("arm64: dts: freescale: add initial apalis imx8 aka quadmax module support") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi b/arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi +index 9b1b522517f8e..0878a15acc1ba 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi +@@ -82,12 +82,9 @@ + pinctrl-0 = <&pinctrl_wifi_pdn>; + gpio = <&lsio_gpio1 28 GPIO_ACTIVE_HIGH>; + enable-active-high; ++ regulator-always-on; + regulator-name = "wifi_pwrdn_fake_regulator"; + regulator-settling-time-us = <100>; +- +- regulator-state-mem { +- regulator-off-in-suspend; +- }; + }; + + reg_pcie_switch: regulator-pcie-switch { +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-imx8-ss-lsio-add-pwm-interrupts.patch b/queue-6.6/arm64-dts-imx8-ss-lsio-add-pwm-interrupts.patch new file mode 100644 index 00000000000..e5fe299e996 --- /dev/null +++ b/queue-6.6/arm64-dts-imx8-ss-lsio-add-pwm-interrupts.patch @@ -0,0 +1,67 @@ +From f7d47f9110c7e410f0362569fd67e7372d664e63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Sep 2023 13:47:35 -0300 +Subject: arm64: dts: imx8-ss-lsio: Add PWM interrupts + +From: Fabio Estevam + +[ Upstream commit 6c32f75d67a8c1ea94295234db7c11a29c189e6f ] + +The PWM interrupt is mandatory per imx-pwm.yaml. + +Add them. + +This also fixes the followig schema warning: + +imx8qm-apalis-v1.1-ixora-v1.2.dtb: pwm@5d000000: 'oneOf' conditional failed, one must be fixed: + 'interrupts' is a required property + 'interrupts-extended' is a required property + from schema $id: http://devicetree.org/schemas/pwm/imx-pwm.yaml# + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Stable-dep-of: d863a2f4f475 ("arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +index ea8c93757521b..7b8bbf5e6a867 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +@@ -37,6 +37,7 @@ lsio_subsys: bus@5d000000 { + assigned-clocks = <&clk IMX_SC_R_PWM_0 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; + #pwm-cells = <2>; ++ interrupts = ; + status = "disabled"; + }; + +@@ -49,6 +50,7 @@ lsio_subsys: bus@5d000000 { + assigned-clocks = <&clk IMX_SC_R_PWM_1 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; + #pwm-cells = <2>; ++ interrupts = ; + status = "disabled"; + }; + +@@ -61,6 +63,7 @@ lsio_subsys: bus@5d000000 { + assigned-clocks = <&clk IMX_SC_R_PWM_2 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; + #pwm-cells = <2>; ++ interrupts = ; + status = "disabled"; + }; + +@@ -73,6 +76,7 @@ lsio_subsys: bus@5d000000 { + assigned-clocks = <&clk IMX_SC_R_PWM_3 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <24000000>; + #pwm-cells = <2>; ++ interrupts = ; + status = "disabled"; + }; + +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-imx8mp-imx8mq-add-parkmode-disable-ss-quir.patch b/queue-6.6/arm64-dts-imx8mp-imx8mq-add-parkmode-disable-ss-quir.patch new file mode 100644 index 00000000000..30ebc86ff5f --- /dev/null +++ b/queue-6.6/arm64-dts-imx8mp-imx8mq-add-parkmode-disable-ss-quir.patch @@ -0,0 +1,115 @@ +From ee7caa464853354a86a72d325eed9d9cddae0398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 02:14:36 +0000 +Subject: arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3 + +From: Nathan Rossi + +[ Upstream commit 209043cf092d7b0d4739921b3f11d6d0b451eabf ] + +The i.MX8MP and i.MX8MQ devices both use the same DWC3 controller and +are both affected by a known issue with the controller due to specific +behaviour when park mode is enabled in SuperSpeed host mode operation. + +Under heavy USB traffic from multiple endpoints the controller will +sometimes incorrectly process transactions such that some transactions +are lost, or the controller may hang when processing transactions. When +the controller hangs it does not recover. + +This issue is documented partially within the linux-imx vendor kernel +which references a Synopsys STAR number 9001415732 in commits [1] and +additional details in [2]. Those commits provide some additional +controller internal implementation specifics around the incorrect +behaviour of the SuperSpeed host controller operation when park mode is +enabled. + +The summary of this issue is that the host controller can incorrectly +enter/exit park mode such that part of the controller is in a state +which behaves as if in park mode even though it is not. In this state +the controller incorrectly calculates the number of TRBs available which +results in incorrect access of the internal caches causing the overwrite +of pending requests in the cache which should have been processed but +are ignored. This can cause the controller to drop the requests or hang +waiting for the pending state of the dropped requests. + +The workaround for this issue is to disable park mode for SuperSpeed +operation of the controller through the GUCTL1[17] bit. This is already +available as a quirk for the DWC3 controller and can be enabled via the +'snps,parkmode-disable-ss-quirk' device tree property. + +It is possible to replicate this failure on an i.MX8MP EVK with a USB +Hub connecting 4 SuperSpeed USB flash drives. Performing continuous +small read operations (dd if=/dev/sd... of=/dev/null bs=16) on the block +devices will result in device errors initially and will eventually +result in the controller hanging. + + [13240.896936] xhci-hcd xhci-hcd.0.auto: WARN Event TRB for slot 4 ep 2 with no TDs queued? + [13240.990708] usb 2-1.3: reset SuperSpeed USB device number 5 using xhci-hcd + [13241.015582] sd 2:0:0:0: [sdc] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s + [13241.025198] sd 2:0:0:0: [sdc] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 + [13241.032949] I/O error, dev sdc, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 25 prio class 2 + [13272.150710] usb 2-1.2: reset SuperSpeed USB device number 4 using xhci-hcd + [13272.175469] sd 1:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x03 driverbyte=DRIVER_OK cmd_age=31s + [13272.185365] sd 1:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 + [13272.193385] I/O error, dev sdb, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 18 prio class 2 + [13434.846556] xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command + [13434.854592] xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead + [13434.862553] xhci-hcd xhci-hcd.0.auto: HC died; cleaning up + +[1] https://github.com/nxp-imx/linux-imx/commit/97a5349d936b08cf301730b59e4e8855283f815c +[2] https://github.com/nxp-imx/linux-imx/commit/b4b5cbc5a12d7c3b920d1d7cba0ada3379e4e42b + +Fixes: fb8587a2c165 ("arm64: dtsi: imx8mp: add usb nodes") +Fixes: ad37549cb5dc ("arm64: dts: imx8mq: add USB nodes") +Signed-off-by: Nathan Rossi +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 ++ + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 83d907294fbc7..4b50920ac2049 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -2030,6 +2030,7 @@ + phys = <&usb3_phy0>, <&usb3_phy0>; + phy-names = "usb2-phy", "usb3-phy"; + snps,gfladj-refclk-lpm-sel-quirk; ++ snps,parkmode-disable-ss-quirk; + }; + + }; +@@ -2072,6 +2073,7 @@ + phys = <&usb3_phy1>, <&usb3_phy1>; + phy-names = "usb2-phy", "usb3-phy"; + snps,gfladj-refclk-lpm-sel-quirk; ++ snps,parkmode-disable-ss-quirk; + }; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index 35f07dfb4ca8d..052ba9baa400f 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -1649,6 +1649,7 @@ + phys = <&usb3_phy0>, <&usb3_phy0>; + phy-names = "usb2-phy", "usb3-phy"; + power-domains = <&pgc_otg1>; ++ snps,parkmode-disable-ss-quirk; + status = "disabled"; + }; + +@@ -1680,6 +1681,7 @@ + phys = <&usb3_phy1>, <&usb3_phy1>; + phy-names = "usb2-phy", "usb3-phy"; + power-domains = <&pgc_otg2>; ++ snps,parkmode-disable-ss-quirk; + status = "disabled"; + }; + +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-imx93-correct-mediamix-power.patch b/queue-6.6/arm64-dts-imx93-correct-mediamix-power.patch new file mode 100644 index 00000000000..228ac487770 --- /dev/null +++ b/queue-6.6/arm64-dts-imx93-correct-mediamix-power.patch @@ -0,0 +1,42 @@ +From 2661736ce4f86e9f63d4ac7cf240dd69ff595bef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 18:02:29 +0800 +Subject: arm64: dts: imx93: correct mediamix power + +From: Peng Fan + +[ Upstream commit d4cb68a5d3a1ed30ecaf1591eb901523faa13496 ] + +"nic_media" clock should be enabled when power on/off mediamix, otherwise +power on/off will fail. Because "media_axi_root" clock is the parent of +"nic_media" clock, so replace "media_axi_clock" clock with "nic_media" +clock in mediamix node. + +Link: https://github.com/nxp-imx/linux-imx/commit/ce18e6d0071ae9df5486af8613708ebe920484be +Fixes: f2d03ba997cb ("arm64: dts: imx93: reorder device nodes") +Fixes: e85d3458a804 ("arm64: dts: imx93: add src node") +Reviewed-by: Jacky Bai +Signed-off-by: Peng Fan +Signed-off-by: Liu Ying +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index dcf6e4846ac9d..943b7e6655634 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -373,7 +373,7 @@ + compatible = "fsl,imx93-src-slice"; + reg = <0x44462400 0x400>, <0x44465800 0x400>; + #power-domain-cells = <0>; +- clocks = <&clk IMX93_CLK_MEDIA_AXI>, ++ clocks = <&clk IMX93_CLK_NIC_MEDIA_GATE>, + <&clk IMX93_CLK_MEDIA_APB>; + }; + }; +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch b/queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch new file mode 100644 index 00000000000..f2d557de638 --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch @@ -0,0 +1,37 @@ +From 5995120b15d8e2abe94ca930a379681f943a5395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Nov 2023 23:36:15 +0000 +Subject: arm64: dts: rockchip: Expand reg size of vdec node for RK3328 + +From: Jonas Karlman + +[ Upstream commit 0b6240d697a96eaa45a2a5503a274ebb4f162fa3 ] + +Expand the reg size for the vdec node to include cache/performance +registers the rkvdec driver writes to. + +Fixes: 17408c9b119d ("arm64: dts: rockchip: Add vdec support for RK3328") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20231105233630.3927502-9-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index e729e7a22b23a..cc8209795c3e5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -668,7 +668,7 @@ + + vdec: video-codec@ff360000 { + compatible = "rockchip,rk3328-vdec", "rockchip,rk3399-vdec"; +- reg = <0x0 0xff360000 0x0 0x400>; ++ reg = <0x0 0xff360000 0x0 0x480>; + interrupts = ; + clocks = <&cru ACLK_RKVDEC>, <&cru HCLK_RKVDEC>, + <&cru SCLK_VDEC_CABAC>, <&cru SCLK_VDEC_CORE>; +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch-17227 b/queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch-17227 new file mode 100644 index 00000000000..e9bdbbbdeba --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch-17227 @@ -0,0 +1,50 @@ +From 2045550be8fc1f5d6ac7155da8568474fab21337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Nov 2023 23:36:16 +0000 +Subject: arm64: dts: rockchip: Expand reg size of vdec node for RK3399 + +From: Alex Bee + +[ Upstream commit 35938c18291b5da7422b2fac6dac0af11aa8d0d7 ] + +Expand the reg size for the vdec node to include cache/performance +registers the rkvdec driver writes to. Also add missing clocks to the +related power-domain. + +Fixes: cbd7214402ec ("arm64: dts: rockchip: Define the rockchip Video Decoder node on rk3399") +Signed-off-by: Alex Bee +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20231105233630.3927502-10-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 5bc2d4faeea6d..4a3d0af5ecfe2 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1109,7 +1109,9 @@ + power-domain@RK3399_PD_VDU { + reg = ; + clocks = <&cru ACLK_VDU>, +- <&cru HCLK_VDU>; ++ <&cru HCLK_VDU>, ++ <&cru SCLK_VDU_CA>, ++ <&cru SCLK_VDU_CORE>; + pm_qos = <&qos_video_m1_r>, + <&qos_video_m1_w>; + #power-domain-cells = <0>; +@@ -1385,7 +1387,7 @@ + + vdec: video-codec@ff660000 { + compatible = "rockchip,rk3399-vdec"; +- reg = <0x0 0xff660000 0x0 0x400>; ++ reg = <0x0 0xff660000 0x0 0x480>; + interrupts = ; + clocks = <&cru ACLK_VDU>, <&cru HCLK_VDU>, + <&cru SCLK_VDU_CA>, <&cru SCLK_VDU_CORE>; +-- +2.42.0 + diff --git a/queue-6.6/arm64-dts-rockchip-fix-emmc-data-strobe-pd-on-rk3588.patch b/queue-6.6/arm64-dts-rockchip-fix-emmc-data-strobe-pd-on-rk3588.patch new file mode 100644 index 00000000000..0499f81f20d --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-fix-emmc-data-strobe-pd-on-rk3588.patch @@ -0,0 +1,63 @@ +From a4416b591dc8292fe0bfd73d9cfe3df340a8b1f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 12:29:00 -0800 +Subject: arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588 + +From: Sam Edwards + +[ Upstream commit 37f3d6108730713c411827ab4af764909f4dfc78 ] + +JEDEC standard JESD84-B51 defines the eMMC Data Strobe line, which is +currently used only in HS400 mode, as a device->host clock signal that +"is used only in read operation. The Data Strobe is always High-Z (not +driven by the device and pulled down by RDS) or Driven Low in write +operation, except during CRC status response." RDS is a pull-down +resistor specified in the 10K-100K ohm range. Thus per the standard, the +Data Strobe is always pulled to ground (by the eMMC and/or RDS) during +write operations. + +Evidently, the eMMC host controller in the RK3588 considers an active +voltage on the eMMC-DS line during a write to be an error. + +The default (i.e. hardware reset, and Rockchip BSP) behavior for the +RK3588 is to activate the eMMC-DS pin's builtin pull-down. As a result, +many RK3588 board designers do not bother adding a dedicated RDS +resistor, instead relying on the RK3588's internal bias. The current +devicetree, however, disables this bias (`pcfg_pull_none`), breaking +HS400-mode writes for boards without a dedicated RDS, but with an eMMC +chip that chooses to High-Z (instead of drive-low) the eMMC-DS line. +(The Turing RK1 is one such board.) + +Fix this by changing the bias in the (common) emmc_data_strobe case to +reflect the expected hardware/BSP behavior. This is unlikely to cause +regressions elsewhere: the pull-down is only relevant for High-Z eMMCs, +and if this is redundant with a (dedicated) RDS resistor, the effective +result is only a lower resistance to ground -- where the range of +tolerance is quite high. If it does, it's better fixed in the specific +devicetrees. + +Fixes: d85f8a5c798d5 ("arm64: dts: rockchip: Add rk3588 pinctrl data") +Signed-off-by: Sam Edwards +Link: https://lore.kernel.org/r/20231205202900.4617-2-CFSworks@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi b/arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi +index 48181671eacb0..0933652bafc30 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi +@@ -369,7 +369,7 @@ + emmc_data_strobe: emmc-data-strobe { + rockchip,pins = + /* emmc_data_strobe */ +- <2 RK_PA2 1 &pcfg_pull_none>; ++ <2 RK_PA2 1 &pcfg_pull_down>; + }; + }; + +-- +2.42.0 + diff --git a/queue-6.6/asoc-codecs-lpass-tx-macro-set-active_decimator-corr.patch b/queue-6.6/asoc-codecs-lpass-tx-macro-set-active_decimator-corr.patch new file mode 100644 index 00000000000..1af63a8e7d3 --- /dev/null +++ b/queue-6.6/asoc-codecs-lpass-tx-macro-set-active_decimator-corr.patch @@ -0,0 +1,45 @@ +From 70d12c94b311aa7c500ee9d3934a7308a3b45ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 17:44:21 +0100 +Subject: ASoC: codecs: lpass-tx-macro: set active_decimator correct default + value + +From: Neil Armstrong + +[ Upstream commit a2f35ed1d237c459100adb0c39bb811d7f170977 ] + +The -1 value for active_decimator[dai_id] is considered as "not set", +but at probe the table is initialized a 0, this prevents enabling the +DEC0 Mixer since it will be considered as already set. + +Initialize the table entries as -1 to fix tx_macro_tx_mixer_put(). + +Fixes: 1c6a7f5250ce ("ASoC: codecs: tx-macro: fix active_decimator array") +Fixes: c1057a08af43 ("ASoC: codecs: tx-macro: fix kcontrol put") +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20231116-topic-sm8x50-upstream-tx-macro-fix-active-decimator-set-v1-1-6edf402f4b6f@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-tx-macro.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 3e33418898e82..ebddfa74ce0a0 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -2021,6 +2021,11 @@ static int tx_macro_probe(struct platform_device *pdev) + + tx->dev = dev; + ++ /* Set active_decimator default value */ ++ tx->active_decimator[TX_MACRO_AIF1_CAP] = -1; ++ tx->active_decimator[TX_MACRO_AIF2_CAP] = -1; ++ tx->active_decimator[TX_MACRO_AIF3_CAP] = -1; ++ + /* set MCLK and NPL rates */ + clk_set_rate(tx->mclk, MCLK_FREQ); + clk_set_rate(tx->npl, MCLK_FREQ); +-- +2.42.0 + diff --git a/queue-6.6/asoc-fsl_sai-fix-no-frame-sync-clock-issue-on-i.mx8m.patch b/queue-6.6/asoc-fsl_sai-fix-no-frame-sync-clock-issue-on-i.mx8m.patch new file mode 100644 index 00000000000..5b2bdf8cfb1 --- /dev/null +++ b/queue-6.6/asoc-fsl_sai-fix-no-frame-sync-clock-issue-on-i.mx8m.patch @@ -0,0 +1,68 @@ +From 86f1ee9d4d04c08538c9e8a6756b9ee0923589b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 18:05:35 +0800 +Subject: ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP + +From: Shengjiu Wang + +[ Upstream commit 14e8442e0789598514f3c9de014950de9feda7a4 ] + +On i.MX8MP, when the TERE and FSD_MSTR enabled before configuring +the word width, there will be no frame sync clock issue, because +old word width impact the generation of frame sync. + +TERE enabled earlier only for i.MX8MP case for the hardware limitation, +So need to disable FSD_MSTR before configuring word width, then enable +FSD_MSTR bit for this specific case. + +Fixes: 3e4a82612998 ("ASoC: fsl_sai: MCLK bind with TX/RX enable bit") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1700474735-3863-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_sai.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 8a9a30dd31e20..3252eefc4bc0e 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -674,6 +674,20 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, + FSL_SAI_CR3_TRCE_MASK, + FSL_SAI_CR3_TRCE((dl_cfg[dl_cfg_idx].mask[tx] & trce_mask))); + ++ /* ++ * When the TERE and FSD_MSTR enabled before configuring the word width ++ * There will be no frame sync clock issue, because word width impact ++ * the generation of frame sync clock. ++ * ++ * TERE enabled earlier only for i.MX8MP case for the hardware limitation, ++ * We need to disable FSD_MSTR before configuring word width, then enable ++ * FSD_MSTR bit for this specific case. ++ */ ++ if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && ++ !sai->is_consumer_mode) ++ regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), ++ FSL_SAI_CR4_FSD_MSTR, 0); ++ + regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), + FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | + FSL_SAI_CR4_CHMOD_MASK, +@@ -681,6 +695,13 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, + regmap_update_bits(sai->regmap, FSL_SAI_xCR5(tx, ofs), + FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK | + FSL_SAI_CR5_FBT_MASK, val_cr5); ++ ++ /* Enable FSD_MSTR after configuring word width */ ++ if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && ++ !sai->is_consumer_mode) ++ regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), ++ FSL_SAI_CR4_FSD_MSTR, FSL_SAI_CR4_FSD_MSTR); ++ + regmap_write(sai->regmap, FSL_SAI_xMR(tx), + ~0UL - ((1 << min(channels, slots)) - 1)); + +-- +2.42.0 + diff --git a/queue-6.6/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch b/queue-6.6/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch new file mode 100644 index 00000000000..e708ceae059 --- /dev/null +++ b/queue-6.6/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch @@ -0,0 +1,57 @@ +From 69478893a9679043b71d7ecfe8e7f6b8c513df17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 15:41:56 +0800 +Subject: ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate + +From: Dinghao Liu + +[ Upstream commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b ] + +When wm_adsp_buffer_read() fails, we should free buf->regions. +Otherwise, the callers of wm_adsp_buffer_populate() will +directly free buf on failure, which makes buf->regions a leaked +memory. + +Fixes: a792af69b08f ("ASoC: wm_adsp: Refactor compress stream initialisation") +Signed-off-by: Dinghao Liu +Reviewed-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20231204074158.12026-1-dinghao.liu@zju.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index d1b9238d391e8..cb654f1b09f10 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1451,12 +1451,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) + ret = wm_adsp_buffer_read(buf, caps->region_defs[i].base_offset, + ®ion->base_addr); + if (ret < 0) +- return ret; ++ goto err; + + ret = wm_adsp_buffer_read(buf, caps->region_defs[i].size_offset, + &offset); + if (ret < 0) +- return ret; ++ goto err; + + region->cumulative_size = offset; + +@@ -1467,6 +1467,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) + } + + return 0; ++ ++err: ++ kfree(buf->regions); ++ return ret; + } + + static void wm_adsp_buffer_clear(struct wm_adsp_compr_buf *buf) +-- +2.42.0 + diff --git a/queue-6.6/drm-bridge-tc358768-select-config_videomode_helpers.patch b/queue-6.6/drm-bridge-tc358768-select-config_videomode_helpers.patch new file mode 100644 index 00000000000..dd48117f96d --- /dev/null +++ b/queue-6.6/drm-bridge-tc358768-select-config_videomode_helpers.patch @@ -0,0 +1,42 @@ +From e135fd6acc7c6e6fcecf4a1e6771a41fac3f49f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 08:27:36 +0100 +Subject: drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS + +From: Arnd Bergmann + +[ Upstream commit 26513300978f7285c3e776c144f27ef71be61f57 ] + +A dependency on this feature was recently introduced: + +x86_64-linux-ld: vmlinux.o: in function `tc358768_bridge_pre_enable': +tc358768.c:(.text+0xbe3dae): undefined reference to `drm_display_mode_to_videomode' + +Make sure this is always enabled. + +Fixes: e5fb21678136 ("drm/bridge: tc358768: Use struct videomode") +Signed-off-by: Arnd Bergmann +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20231204072814.968816-1-arnd@kernel.org +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231204072814.968816-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index ba82a1142adf7..3e6a4e2044c0e 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -313,6 +313,7 @@ config DRM_TOSHIBA_TC358768 + select REGMAP_I2C + select DRM_PANEL + select DRM_MIPI_DSI ++ select VIDEOMODE_HELPERS + help + Toshiba TC358768AXBG/TC358778XBG DSI bridge chip driver. + +-- +2.42.0 + diff --git a/queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-in.patch b/queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-in.patch new file mode 100644 index 00000000000..c785ed49800 --- /dev/null +++ b/queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-in.patch @@ -0,0 +1,175 @@ +From 854b320d57cd9ce270b8411f0b0fb1c5c83a7de4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Aug 2023 13:26:22 +0200 +Subject: firmware: arm_scmi: Extend perf protocol ops to get information of a + domain + +From: Ulf Hansson + +[ Upstream commit 3d99ed60721bf2e108c8fc660775766057689a92 ] + +Similar to other protocol ops, it's useful for an scmi module driver to get +some generic information of a performance domain. Therefore, let's add a +new callback to provide this information. The information is currently +limited to the name of the performance domain and whether the set-level +operation is supported, although this can easily be extended if we find the +need for it. + +Signed-off-by: Ulf Hansson +Link: https://lore.kernel.org/r/20230825112633.236607-3-ulf.hansson@linaro.org +Signed-off-by: Sudeep Holla +Stable-dep-of: 8e3c98d9187e ("firmware: arm_scmi: Fix frequency truncation by promoting multiplier type") +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/perf.c | 47 ++++++++++++++++++++------------ + include/linux/scmi_protocol.h | 8 ++++++ + 2 files changed, 38 insertions(+), 17 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c +index da901c65388a6..6677caefb36bc 100644 +--- a/drivers/firmware/arm_scmi/perf.c ++++ b/drivers/firmware/arm_scmi/perf.c +@@ -145,7 +145,6 @@ struct scmi_msg_resp_perf_describe_levels_v4 { + struct perf_dom_info { + u32 id; + bool set_limits; +- bool set_perf; + bool perf_limit_notify; + bool perf_level_notify; + bool perf_fastchannels; +@@ -154,7 +153,7 @@ struct perf_dom_info { + u32 sustained_freq_khz; + u32 sustained_perf_level; + u32 mult_factor; +- char name[SCMI_MAX_STR_SIZE]; ++ struct scmi_perf_domain_info info; + struct scmi_opp opp[MAX_OPPS]; + struct scmi_fc_info *fc_info; + struct xarray opps_by_idx; +@@ -257,7 +256,7 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, + flags = le32_to_cpu(attr->flags); + + dom_info->set_limits = SUPPORTS_SET_LIMITS(flags); +- dom_info->set_perf = SUPPORTS_SET_PERF_LVL(flags); ++ dom_info->info.set_perf = SUPPORTS_SET_PERF_LVL(flags); + dom_info->perf_limit_notify = SUPPORTS_PERF_LIMIT_NOTIFY(flags); + dom_info->perf_level_notify = SUPPORTS_PERF_LEVEL_NOTIFY(flags); + dom_info->perf_fastchannels = SUPPORTS_PERF_FASTCHANNELS(flags); +@@ -276,7 +275,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, + dom_info->mult_factor = + (dom_info->sustained_freq_khz * 1000) / + dom_info->sustained_perf_level; +- strscpy(dom_info->name, attr->name, SCMI_SHORT_NAME_MAX_SIZE); ++ strscpy(dom_info->info.name, attr->name, ++ SCMI_SHORT_NAME_MAX_SIZE); + } + + ph->xops->xfer_put(ph, t); +@@ -288,7 +288,7 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, + if (!ret && PROTOCOL_REV_MAJOR(version) >= 0x3 && + SUPPORTS_EXTENDED_NAMES(flags)) + ph->hops->extended_name_get(ph, PERF_DOMAIN_NAME_GET, +- dom_info->id, dom_info->name, ++ dom_info->id, dom_info->info.name, + SCMI_MAX_STR_SIZE); + + if (dom_info->level_indexing_mode) { +@@ -430,6 +430,29 @@ static int scmi_perf_num_domains_get(const struct scmi_protocol_handle *ph) + return pi->num_domains; + } + ++static inline struct perf_dom_info * ++scmi_perf_domain_lookup(const struct scmi_protocol_handle *ph, u32 domain) ++{ ++ struct scmi_perf_info *pi = ph->get_priv(ph); ++ ++ if (domain >= pi->num_domains) ++ return ERR_PTR(-EINVAL); ++ ++ return pi->dom_info + domain; ++} ++ ++static const struct scmi_perf_domain_info * ++scmi_perf_info_get(const struct scmi_protocol_handle *ph, u32 domain) ++{ ++ struct perf_dom_info *dom; ++ ++ dom = scmi_perf_domain_lookup(ph, domain); ++ if (IS_ERR(dom)) ++ return ERR_PTR(-EINVAL); ++ ++ return &dom->info; ++} ++ + static int scmi_perf_msg_limits_set(const struct scmi_protocol_handle *ph, + u32 domain, u32 max_perf, u32 min_perf) + { +@@ -453,17 +476,6 @@ static int scmi_perf_msg_limits_set(const struct scmi_protocol_handle *ph, + return ret; + } + +-static inline struct perf_dom_info * +-scmi_perf_domain_lookup(const struct scmi_protocol_handle *ph, u32 domain) +-{ +- struct scmi_perf_info *pi = ph->get_priv(ph); +- +- if (domain >= pi->num_domains) +- return ERR_PTR(-EINVAL); +- +- return pi->dom_info + domain; +-} +- + static int __scmi_perf_limits_set(const struct scmi_protocol_handle *ph, + struct perf_dom_info *dom, u32 max_perf, + u32 min_perf) +@@ -819,7 +831,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, + } + + dev_dbg(dev, "[%d][%s]:: Registered OPP[%d] %lu\n", +- domain, dom->name, idx, freq); ++ domain, dom->info.name, idx, freq); + } + return 0; + } +@@ -956,6 +968,7 @@ scmi_power_scale_get(const struct scmi_protocol_handle *ph) + + static const struct scmi_perf_proto_ops perf_proto_ops = { + .num_domains_get = scmi_perf_num_domains_get, ++ .info_get = scmi_perf_info_get, + .limits_set = scmi_perf_limits_set, + .limits_get = scmi_perf_limits_get, + .level_set = scmi_perf_level_set, +diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h +index 71b39cbbdace0..71923ae63b014 100644 +--- a/include/linux/scmi_protocol.h ++++ b/include/linux/scmi_protocol.h +@@ -97,11 +97,17 @@ struct scmi_clk_proto_ops { + u32 clk_id); + }; + ++struct scmi_perf_domain_info { ++ char name[SCMI_MAX_STR_SIZE]; ++ bool set_perf; ++}; ++ + /** + * struct scmi_perf_proto_ops - represents the various operations provided + * by SCMI Performance Protocol + * + * @num_domains_get: gets the number of supported performance domains ++ * @info_get: get the information of a performance domain + * @limits_set: sets limits on the performance level of a domain + * @limits_get: gets limits on the performance level of a domain + * @level_set: sets the performance level of a domain +@@ -122,6 +128,8 @@ struct scmi_clk_proto_ops { + */ + struct scmi_perf_proto_ops { + int (*num_domains_get)(const struct scmi_protocol_handle *ph); ++ const struct scmi_perf_domain_info __must_check *(*info_get) ++ (const struct scmi_protocol_handle *ph, u32 domain); + int (*limits_set)(const struct scmi_protocol_handle *ph, u32 domain, + u32 max_perf, u32 min_perf); + int (*limits_get)(const struct scmi_protocol_handle *ph, u32 domain, +-- +2.42.0 + diff --git a/queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-nu.patch b/queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-nu.patch new file mode 100644 index 00000000000..2c247cb28d1 --- /dev/null +++ b/queue-6.6/firmware-arm_scmi-extend-perf-protocol-ops-to-get-nu.patch @@ -0,0 +1,73 @@ +From 87fa119df74477ff07a3c3c9a572a5b50bc8372c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Aug 2023 13:26:21 +0200 +Subject: firmware: arm_scmi: Extend perf protocol ops to get number of domains + +From: Ulf Hansson + +[ Upstream commit e9090e70e618cd62ab7bf2914511e5eea31a2535 ] + +Similar to other protocol ops, it's useful for an scmi module driver to get +the number of supported performance domains, hence let's make this +available by adding a new perf protocol callback. Note that, a user is +being added from subsequent changes. + +Signed-off-by: Ulf Hansson +Link: https://lore.kernel.org/r/20230825112633.236607-2-ulf.hansson@linaro.org +Signed-off-by: Sudeep Holla +Stable-dep-of: 8e3c98d9187e ("firmware: arm_scmi: Fix frequency truncation by promoting multiplier type") +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/perf.c | 8 ++++++++ + include/linux/scmi_protocol.h | 2 ++ + 2 files changed, 10 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c +index 30dedd6ebfde6..da901c65388a6 100644 +--- a/drivers/firmware/arm_scmi/perf.c ++++ b/drivers/firmware/arm_scmi/perf.c +@@ -423,6 +423,13 @@ scmi_perf_describe_levels_get(const struct scmi_protocol_handle *ph, + return ret; + } + ++static int scmi_perf_num_domains_get(const struct scmi_protocol_handle *ph) ++{ ++ struct scmi_perf_info *pi = ph->get_priv(ph); ++ ++ return pi->num_domains; ++} ++ + static int scmi_perf_msg_limits_set(const struct scmi_protocol_handle *ph, + u32 domain, u32 max_perf, u32 min_perf) + { +@@ -948,6 +955,7 @@ scmi_power_scale_get(const struct scmi_protocol_handle *ph) + } + + static const struct scmi_perf_proto_ops perf_proto_ops = { ++ .num_domains_get = scmi_perf_num_domains_get, + .limits_set = scmi_perf_limits_set, + .limits_get = scmi_perf_limits_get, + .level_set = scmi_perf_level_set, +diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h +index e6fe4f73ffe62..71b39cbbdace0 100644 +--- a/include/linux/scmi_protocol.h ++++ b/include/linux/scmi_protocol.h +@@ -101,6 +101,7 @@ struct scmi_clk_proto_ops { + * struct scmi_perf_proto_ops - represents the various operations provided + * by SCMI Performance Protocol + * ++ * @num_domains_get: gets the number of supported performance domains + * @limits_set: sets limits on the performance level of a domain + * @limits_get: gets limits on the performance level of a domain + * @level_set: sets the performance level of a domain +@@ -120,6 +121,7 @@ struct scmi_clk_proto_ops { + * or in some other (abstract) scale + */ + struct scmi_perf_proto_ops { ++ int (*num_domains_get)(const struct scmi_protocol_handle *ph); + int (*limits_set)(const struct scmi_protocol_handle *ph, u32 domain, + u32 max_perf, u32 min_perf); + int (*limits_get)(const struct scmi_protocol_handle *ph, u32 domain, +-- +2.42.0 + diff --git a/queue-6.6/firmware-arm_scmi-fix-frequency-truncation-by-promot.patch b/queue-6.6/firmware-arm_scmi-fix-frequency-truncation-by-promot.patch new file mode 100644 index 00000000000..a30f8bcb3cd --- /dev/null +++ b/queue-6.6/firmware-arm_scmi-fix-frequency-truncation-by-promot.patch @@ -0,0 +1,54 @@ +From f6d3f2146d1cd30d8b0a858a384cce1282c097b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 20:43:42 +0000 +Subject: firmware: arm_scmi: Fix frequency truncation by promoting multiplier + type + +From: Sudeep Holla + +[ Upstream commit 8e3c98d9187e09274fc000a7d1a77b070a42d259 ] + +Fix the possible frequency truncation for all values equal to or greater +4GHz on 64bit machines by updating the multiplier 'mult_factor' to +'unsigned long' type. It is also possible that the multiplier itself can +be greater than or equal to 2^32. So we need to also fix the equation +computing the value of the multiplier. + +Fixes: a9e3fbfaa0ff ("firmware: arm_scmi: add initial support for performance protocol") +Reported-by: Sibi Sankar +Closes: https://lore.kernel.org/all/20231129065748.19871-3-quic_sibis@quicinc.com/ +Cc: Cristian Marussi +Link: https://lore.kernel.org/r/20231130204343.503076-1-sudeep.holla@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/perf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c +index 6677caefb36bc..7aa9b4ff48d61 100644 +--- a/drivers/firmware/arm_scmi/perf.c ++++ b/drivers/firmware/arm_scmi/perf.c +@@ -152,7 +152,7 @@ struct perf_dom_info { + u32 opp_count; + u32 sustained_freq_khz; + u32 sustained_perf_level; +- u32 mult_factor; ++ unsigned long mult_factor; + struct scmi_perf_domain_info info; + struct scmi_opp opp[MAX_OPPS]; + struct scmi_fc_info *fc_info; +@@ -273,8 +273,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, + dom_info->mult_factor = 1000; + else + dom_info->mult_factor = +- (dom_info->sustained_freq_khz * 1000) / +- dom_info->sustained_perf_level; ++ (dom_info->sustained_freq_khz * 1000UL) ++ / dom_info->sustained_perf_level; + strscpy(dom_info->info.name, attr->name, + SCMI_SHORT_NAME_MAX_SIZE); + } +-- +2.42.0 + diff --git a/queue-6.6/firmware-arm_scmi-fix-possible-frequency-truncation-.patch b/queue-6.6/firmware-arm_scmi-fix-possible-frequency-truncation-.patch new file mode 100644 index 00000000000..264380dfcf3 --- /dev/null +++ b/queue-6.6/firmware-arm_scmi-fix-possible-frequency-truncation-.patch @@ -0,0 +1,87 @@ +From a6b7e024eaf5605dcdfa2801a8c2901fc81fc64a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 20:43:43 +0000 +Subject: firmware: arm_scmi: Fix possible frequency truncation when using + level indexing mode + +From: Sudeep Holla + +[ Upstream commit 77f5032e94f244ba08db51e17ca8f37bd7ff9acb ] + +The multiplier is already promoted to unsigned long, however the +frequency calculations done when using level indexing mode doesn't +use the multiplier computed. It instead hardcodes the multiplier +value of 1000 at all the usage sites. + +Clean that up by assigning the multiplier value of 1000 when using +the perf level indexing mode and update the frequency calculations to +use the multiplier instead. It should fix the possible frequency +truncation for all the values greater than or equal to 4GHz on 64-bit +machines. + +Fixes: 31c7c1397a33 ("firmware: arm_scmi: Add v3.2 perf level indexing mode support") +Reported-by: Sibi Sankar +Closes: https://lore.kernel.org/all/20231129065748.19871-3-quic_sibis@quicinc.com/ +Cc: Cristian Marussi +Link: https://lore.kernel.org/r/20231130204343.503076-2-sudeep.holla@arm.com +Reviewed-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/perf.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c +index 596316e6e1ba3..e887fd1690434 100644 +--- a/drivers/firmware/arm_scmi/perf.c ++++ b/drivers/firmware/arm_scmi/perf.c +@@ -268,7 +268,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, + dom_info->sustained_perf_level = + le32_to_cpu(attr->sustained_perf_level); + if (!dom_info->sustained_freq_khz || +- !dom_info->sustained_perf_level) ++ !dom_info->sustained_perf_level || ++ dom_info->level_indexing_mode) + /* CPUFreq converts to kHz, hence default 1000 */ + dom_info->mult_factor = 1000; + else +@@ -813,7 +814,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, + if (!dom->level_indexing_mode) + freq = dom->opp[idx].perf * dom->mult_factor; + else +- freq = dom->opp[idx].indicative_freq * 1000; ++ freq = dom->opp[idx].indicative_freq * dom->mult_factor; + + ret = dev_pm_opp_add(dev, freq, 0); + if (ret) { +@@ -862,7 +863,8 @@ static int scmi_dvfs_freq_set(const struct scmi_protocol_handle *ph, u32 domain, + } else { + struct scmi_opp *opp; + +- opp = LOOKUP_BY_FREQ(dom->opps_by_freq, freq / 1000); ++ opp = LOOKUP_BY_FREQ(dom->opps_by_freq, ++ freq / dom->mult_factor); + if (!opp) + return -EIO; + +@@ -896,7 +898,7 @@ static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain, + if (!opp) + return -EIO; + +- *freq = opp->indicative_freq * 1000; ++ *freq = opp->indicative_freq * dom->mult_factor; + } + + return ret; +@@ -919,7 +921,7 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph, + if (!dom->level_indexing_mode) + opp_freq = opp->perf * dom->mult_factor; + else +- opp_freq = opp->indicative_freq * 1000; ++ opp_freq = opp->indicative_freq * dom->mult_factor; + + if (opp_freq < *freq) + continue; +-- +2.42.0 + diff --git a/queue-6.6/firmware-arm_scmi-simplify-error-path-in-scmi_dvfs_d.patch b/queue-6.6/firmware-arm_scmi-simplify-error-path-in-scmi_dvfs_d.patch new file mode 100644 index 00000000000..f9e8064aca2 --- /dev/null +++ b/queue-6.6/firmware-arm_scmi-simplify-error-path-in-scmi_dvfs_d.patch @@ -0,0 +1,65 @@ +From 26248d3bc3253f5a70e3f3147c3d413c15a9eebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 15:17:13 +0200 +Subject: firmware: arm_scmi: Simplify error path in + scmi_dvfs_device_opps_add() + +From: Ulf Hansson + +[ Upstream commit 033ca4de129646e9969a6838b44cca0fac38e219 ] + +Let's simplify the code in scmi_dvfs_device_opps_add() by using +dev_pm_opp_remove_all_dynamic() in the error path. + +Signed-off-by: Ulf Hansson +Link: https://lore.kernel.org/r/20230925131715.138411-8-ulf.hansson@linaro.org +Signed-off-by: Sudeep Holla +Stable-dep-of: 77f5032e94f2 ("firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode") +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/perf.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c +index 7aa9b4ff48d61..596316e6e1ba3 100644 +--- a/drivers/firmware/arm_scmi/perf.c ++++ b/drivers/firmware/arm_scmi/perf.c +@@ -799,7 +799,6 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, + { + int idx, ret, domain; + unsigned long freq; +- struct scmi_opp *opp; + struct perf_dom_info *dom; + + domain = scmi_dev_domain_id(dev); +@@ -810,23 +809,16 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, + if (IS_ERR(dom)) + return PTR_ERR(dom); + +- for (opp = dom->opp, idx = 0; idx < dom->opp_count; idx++, opp++) { ++ for (idx = 0; idx < dom->opp_count; idx++) { + if (!dom->level_indexing_mode) +- freq = opp->perf * dom->mult_factor; ++ freq = dom->opp[idx].perf * dom->mult_factor; + else +- freq = opp->indicative_freq * 1000; ++ freq = dom->opp[idx].indicative_freq * 1000; + + ret = dev_pm_opp_add(dev, freq, 0); + if (ret) { + dev_warn(dev, "failed to add opp %luHz\n", freq); +- +- while (idx-- > 0) { +- if (!dom->level_indexing_mode) +- freq = (--opp)->perf * dom->mult_factor; +- else +- freq = (--opp)->indicative_freq * 1000; +- dev_pm_opp_remove(dev, freq); +- } ++ dev_pm_opp_remove_all_dynamic(dev); + return ret; + } + +-- +2.42.0 + diff --git a/queue-6.6/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch b/queue-6.6/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch new file mode 100644 index 00000000000..1c14180942f --- /dev/null +++ b/queue-6.6/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch @@ -0,0 +1,55 @@ +From b040f62614e372766ae9147b1ee7d984396f7756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 19:27:47 +0100 +Subject: hwmon: (acpi_power_meter) Fix 4.29 MW bug + +From: Armin Wolf + +[ Upstream commit 1fefca6c57fb928d2131ff365270cbf863d89c88 ] + +The ACPI specification says: + +"If an error occurs while obtaining the meter reading or if the value +is not available then an Integer with all bits set is returned" + +Since the "integer" is 32 bits in case of the ACPI power meter, +userspace will get a power reading of 2^32 * 1000 miliwatts (~4.29 MW) +in case of such an error. This was discovered due to a lm_sensors +bugreport (https://github.com/lm-sensors/lm-sensors/issues/460). +Fix this by returning -ENODATA instead. + +Tested-by: +Fixes: de584afa5e18 ("hwmon driver for ACPI 4.0 power meters") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20231124182747.13956-1-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/acpi_power_meter.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c +index fa28d447f0dfb..b772c076a5aed 100644 +--- a/drivers/hwmon/acpi_power_meter.c ++++ b/drivers/hwmon/acpi_power_meter.c +@@ -31,6 +31,7 @@ + #define POWER_METER_CAN_NOTIFY (1 << 3) + #define POWER_METER_IS_BATTERY (1 << 8) + #define UNKNOWN_HYSTERESIS 0xFFFFFFFF ++#define UNKNOWN_POWER 0xFFFFFFFF + + #define METER_NOTIFY_CONFIG 0x80 + #define METER_NOTIFY_TRIP 0x81 +@@ -348,6 +349,9 @@ static ssize_t show_power(struct device *dev, + update_meter(resource); + mutex_unlock(&resource->lock); + ++ if (resource->power == UNKNOWN_POWER) ++ return -ENODATA; ++ + return sprintf(buf, "%llu\n", resource->power * 1000); + } + +-- +2.42.0 + diff --git a/queue-6.6/hwmon-nzxt-kraken2-fix-error-handling-path-in-kraken.patch b/queue-6.6/hwmon-nzxt-kraken2-fix-error-handling-path-in-kraken.patch new file mode 100644 index 00000000000..cb51f6d1ecb --- /dev/null +++ b/queue-6.6/hwmon-nzxt-kraken2-fix-error-handling-path-in-kraken.patch @@ -0,0 +1,49 @@ +From a120731bb41238e79d65f39592e318af8318b583 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Dec 2023 16:24:05 +0100 +Subject: hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe() + +From: Christophe JAILLET + +[ Upstream commit 35fe2ad259a3bfca15ab78c8ffb5278cb6149c89 ] + +There is no point in calling hid_hw_stop() if hid_hw_start() has failed. +There is no point in calling hid_hw_close() if hid_hw_open() has failed. + +Update the error handling path accordingly. + +Fixes: 82e3430dfa8c ("hwmon: add driver for NZXT Kraken X42/X52/X62/X72") +Reported-by: Aleksa Savic +Closes: https://lore.kernel.org/all/121470f0-6c1f-418a-844c-7ec2e8a54b8e@gmail.com/ +Signed-off-by: Christophe JAILLET +Reviewed-by: Jonas Malaco +Link: https://lore.kernel.org/r/a768e69851a07a1f4e29f270f4e2559063f07343.1701617030.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nzxt-kraken2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/nzxt-kraken2.c b/drivers/hwmon/nzxt-kraken2.c +index 428c77b5fce5a..7caf387eb1449 100644 +--- a/drivers/hwmon/nzxt-kraken2.c ++++ b/drivers/hwmon/nzxt-kraken2.c +@@ -161,13 +161,13 @@ static int kraken2_probe(struct hid_device *hdev, + ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW); + if (ret) { + hid_err(hdev, "hid hw start failed with %d\n", ret); +- goto fail_and_stop; ++ return ret; + } + + ret = hid_hw_open(hdev); + if (ret) { + hid_err(hdev, "hid hw open failed with %d\n", ret); +- goto fail_and_close; ++ goto fail_and_stop; + } + + priv->hwmon_dev = hwmon_device_register_with_info(&hdev->dev, "kraken2", +-- +2.42.0 + diff --git a/queue-6.6/io_uring-kbuf-check-for-buffer-list-readiness-after-.patch b/queue-6.6/io_uring-kbuf-check-for-buffer-list-readiness-after-.patch new file mode 100644 index 00000000000..80ea3fc89a0 --- /dev/null +++ b/queue-6.6/io_uring-kbuf-check-for-buffer-list-readiness-after-.patch @@ -0,0 +1,45 @@ +From 2c028a4239019217df25663fde980a0ab690c5c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 07:02:13 -0700 +Subject: io_uring/kbuf: check for buffer list readiness after NULL check + +From: Jens Axboe + +[ Upstream commit 9865346b7e8374b57f1c3ccacdc77846c6352ff4 ] + +Move the buffer list 'is_ready' check below the validity check for +the buffer list for a given group. + +Fixes: 5cf4f52e6d8a ("io_uring: free io_buffer_list entries via RCU") +Reported-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/kbuf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c +index 12eec4778c5b1..e8516f3bbbaaa 100644 +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -743,6 +743,8 @@ void *io_pbuf_get_address(struct io_ring_ctx *ctx, unsigned long bgid) + + bl = __io_buffer_get_list(ctx, smp_load_acquire(&ctx->io_bl), bgid); + ++ if (!bl || !bl->is_mmap) ++ return NULL; + /* + * Ensure the list is fully setup. Only strictly needed for RCU lookup + * via mmap, and in that case only for the array indexed groups. For +@@ -750,8 +752,6 @@ void *io_pbuf_get_address(struct io_ring_ctx *ctx, unsigned long bgid) + */ + if (!smp_load_acquire(&bl->is_ready)) + return NULL; +- if (!bl || !bl->is_mmap) +- return NULL; + + return bl->buf_ring; + } +-- +2.42.0 + diff --git a/queue-6.6/io_uring-kbuf-fix-an-null-vs-is_err-bug-in-io_alloc_.patch b/queue-6.6/io_uring-kbuf-fix-an-null-vs-is_err-bug-in-io_alloc_.patch new file mode 100644 index 00000000000..a8498d7faec --- /dev/null +++ b/queue-6.6/io_uring-kbuf-fix-an-null-vs-is_err-bug-in-io_alloc_.patch @@ -0,0 +1,39 @@ +From 2d39d07ccd2bc8d76207a57b0e4faaa479aa77c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 15:37:17 +0300 +Subject: io_uring/kbuf: Fix an NULL vs IS_ERR() bug in io_alloc_pbuf_ring() + +From: Dan Carpenter + +[ Upstream commit e53f7b54b1fdecae897f25002ff0cff04faab228 ] + +The io_mem_alloc() function returns error pointers, not NULL. Update +the check accordingly. + +Fixes: b10b73c102a2 ("io_uring/kbuf: recycle freed mapped buffer ring entries") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/5ed268d3-a997-4f64-bd71-47faa92101ab@moroto.mountain +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/kbuf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c +index 012f622036049..12eec4778c5b1 100644 +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -623,8 +623,8 @@ static int io_alloc_pbuf_ring(struct io_ring_ctx *ctx, + ibf = io_lookup_buf_free_entry(ctx, ring_size); + if (!ibf) { + ptr = io_mem_alloc(ring_size); +- if (!ptr) +- return -ENOMEM; ++ if (IS_ERR(ptr)) ++ return PTR_ERR(ptr); + + /* Allocate and store deferred free entry */ + ibf = kmalloc(sizeof(*ibf), GFP_KERNEL_ACCOUNT); +-- +2.42.0 + diff --git a/queue-6.6/kernel-kconfig.kexec-drop-select-of-kexec-for-crash_.patch b/queue-6.6/kernel-kconfig.kexec-drop-select-of-kexec-for-crash_.patch new file mode 100644 index 00000000000..395d80a779a --- /dev/null +++ b/queue-6.6/kernel-kconfig.kexec-drop-select-of-kexec-for-crash_.patch @@ -0,0 +1,98 @@ +From 5d947546302f86dcfda61f92d6e09deddddfdb97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 13:44:57 +0800 +Subject: kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP + +From: Baoquan He + +[ Upstream commit dccf78d39f1069a5ddf4328bf0c97aa5f2f4296e ] + +Ignat Korchagin complained that a potential config regression was +introduced by commit 89cde455915f ("kexec: consolidate kexec and crash +options into kernel/Kconfig.kexec"). Before the commit, CONFIG_CRASH_DUMP +has no dependency on CONFIG_KEXEC. After the commit, CRASH_DUMP selects +KEXEC. That enforces system to have CONFIG_KEXEC=y as long as +CONFIG_CRASH_DUMP=Y which people may not want. + +In Ignat's case, he sets CONFIG_CRASH_DUMP=y, CONFIG_KEXEC_FILE=y and +CONFIG_KEXEC=n because kexec_load interface could have security issue if +kernel/initrd has no chance to be signed and verified. + +CRASH_DUMP has select of KEXEC because Eric, author of above commit, met a +LKP report of build failure when posting patch of earlier version. Please +see below link to get detail of the LKP report: + + https://lore.kernel.org/all/3e8eecd1-a277-2cfb-690e-5de2eb7b988e@oracle.com/T/#u + +In fact, that LKP report is triggered because arm's is +wrapped in CONFIG_KEXEC ifdeffery scope. That is wrong. CONFIG_KEXEC +controls the enabling/disabling of kexec_load interface, but not kexec +feature. Removing the wrongly added CONFIG_KEXEC ifdeffery scope in + of arm allows us to drop the select KEXEC for CRASH_DUMP. +Meanwhile, change arch/arm/kernel/Makefile to let machine_kexec.o +relocate_kernel.o depend on KEXEC_CORE. + +Link: https://lkml.kernel.org/r/20231128054457.659452-1-bhe@redhat.com +Fixes: 89cde455915f ("kexec: consolidate kexec and crash options into kernel/Kconfig.kexec") +Signed-off-by: Baoquan He +Reported-by: Ignat Korchagin +Tested-by: Ignat Korchagin [compile-time only] +Tested-by: Alexander Gordeev +Reviewed-by: Eric DeVolder +Tested-by: Eric DeVolder +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/kexec.h | 4 ---- + arch/arm/kernel/Makefile | 2 +- + kernel/Kconfig.kexec | 1 - + 3 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/arch/arm/include/asm/kexec.h b/arch/arm/include/asm/kexec.h +index e62832dcba760..a8287e7ab9d41 100644 +--- a/arch/arm/include/asm/kexec.h ++++ b/arch/arm/include/asm/kexec.h +@@ -2,8 +2,6 @@ + #ifndef _ARM_KEXEC_H + #define _ARM_KEXEC_H + +-#ifdef CONFIG_KEXEC +- + /* Maximum physical address we can use pages from */ + #define KEXEC_SOURCE_MEMORY_LIMIT (-1UL) + /* Maximum address we can reach in physical address mode */ +@@ -82,6 +80,4 @@ static inline struct page *boot_pfn_to_page(unsigned long boot_pfn) + + #endif /* __ASSEMBLY__ */ + +-#endif /* CONFIG_KEXEC */ +- + #endif /* _ARM_KEXEC_H */ +diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile +index d53f56d6f8408..771264d4726a7 100644 +--- a/arch/arm/kernel/Makefile ++++ b/arch/arm/kernel/Makefile +@@ -59,7 +59,7 @@ obj-$(CONFIG_FUNCTION_TRACER) += entry-ftrace.o + obj-$(CONFIG_DYNAMIC_FTRACE) += ftrace.o insn.o patch.o + obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o insn.o patch.o + obj-$(CONFIG_JUMP_LABEL) += jump_label.o insn.o patch.o +-obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o ++obj-$(CONFIG_KEXEC_CORE) += machine_kexec.o relocate_kernel.o + # Main staffs in KPROBES are in arch/arm/probes/ . + obj-$(CONFIG_KPROBES) += patch.o insn.o + obj-$(CONFIG_OABI_COMPAT) += sys_oabi-compat.o +diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec +index 9bfe68fe96762..143f4d8eab7c0 100644 +--- a/kernel/Kconfig.kexec ++++ b/kernel/Kconfig.kexec +@@ -97,7 +97,6 @@ config CRASH_DUMP + depends on ARCH_SUPPORTS_KEXEC + select CRASH_CORE + select KEXEC_CORE +- select KEXEC + help + Generate crash dump after being started by kexec. + This should be normally only set in special crash dump kernels +-- +2.42.0 + diff --git a/queue-6.6/md-don-t-leave-md_recovery_frozen-in-error-path-of-m.patch b/queue-6.6/md-don-t-leave-md_recovery_frozen-in-error-path-of-m.patch new file mode 100644 index 00000000000..43e6f2e3c92 --- /dev/null +++ b/queue-6.6/md-don-t-leave-md_recovery_frozen-in-error-path-of-m.patch @@ -0,0 +1,91 @@ +From f8f61b067037893bcd0984ab762f4191a8615a1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 17:42:14 +0800 +Subject: md: don't leave 'MD_RECOVERY_FROZEN' in error path of + md_set_readonly() + +From: Yu Kuai + +[ Upstream commit c9f7cb5b2bc968adcdc686c197ed108f47fd8eb0 ] + +If md_set_readonly() failed, the array could still be read-write, however +'MD_RECOVERY_FROZEN' could still be set, which leave the array in an +abnormal state that sync or recovery can't continue anymore. +Hence make sure the flag is cleared after md_set_readonly() returns. + +Fixes: 88724bfa68be ("md: wait for pending superblock updates before switching to read-only") +Signed-off-by: Yu Kuai +Acked-by: Xiao Ni +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20231205094215.1824240-3-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 2748b0b424cfe..b2ef6af8376a5 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6316,6 +6316,9 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) + int err = 0; + int did_freeze = 0; + ++ if (mddev->external && test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) ++ return -EBUSY; ++ + if (!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)) { + did_freeze = 1; + set_bit(MD_RECOVERY_FROZEN, &mddev->recovery); +@@ -6330,8 +6333,6 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) + */ + md_wakeup_thread_directly(mddev->sync_thread); + +- if (mddev->external && test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) +- return -EBUSY; + mddev_unlock(mddev); + wait_event(resync_wait, !test_bit(MD_RECOVERY_RUNNING, + &mddev->recovery)); +@@ -6344,29 +6345,30 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) + mddev->sync_thread || + test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) { + pr_warn("md: %s still in use.\n",mdname(mddev)); +- if (did_freeze) { +- clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); +- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); +- md_wakeup_thread(mddev->thread); +- } + err = -EBUSY; + goto out; + } ++ + if (mddev->pers) { + __md_stop_writes(mddev); + +- err = -ENXIO; +- if (mddev->ro == MD_RDONLY) ++ if (mddev->ro == MD_RDONLY) { ++ err = -ENXIO; + goto out; ++ } ++ + mddev->ro = MD_RDONLY; + set_disk_ro(mddev->gendisk, 1); ++ } ++ ++out: ++ if ((mddev->pers && !err) || did_freeze) { + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); + md_wakeup_thread(mddev->thread); + sysfs_notify_dirent_safe(mddev->sysfs_state); +- err = 0; + } +-out: ++ + mutex_unlock(&mddev->open_mutex); + return err; + } +-- +2.42.0 + diff --git a/queue-6.6/rdma-bnxt_re-correct-module-description-string.patch b/queue-6.6/rdma-bnxt_re-correct-module-description-string.patch new file mode 100644 index 00000000000..4ede0c071d6 --- /dev/null +++ b/queue-6.6/rdma-bnxt_re-correct-module-description-string.patch @@ -0,0 +1,38 @@ +From 5b6ccff247284a655432635b6c234c03f7fd9b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 00:29:47 -0800 +Subject: RDMA/bnxt_re: Correct module description string + +From: Kalesh AP + +[ Upstream commit 422b19f7f006e813ee0865aadce6a62b3c263c42 ] + +The word "Driver" is repeated twice in the "modinfo bnxt_re" +output description. Fix it. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1700555387-6277-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index c9066aade4125..039801d93ed8a 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -71,7 +71,7 @@ static char version[] = + BNXT_RE_DESC "\n"; + + MODULE_AUTHOR("Eddie Wai "); +-MODULE_DESCRIPTION(BNXT_RE_DESC " Driver"); ++MODULE_DESCRIPTION(BNXT_RE_DESC); + MODULE_LICENSE("Dual BSD/GPL"); + + /* globals */ +-- +2.42.0 + diff --git a/queue-6.6/rdma-core-fix-umem-iterator-when-page_size-is-greate.patch b/queue-6.6/rdma-core-fix-umem-iterator-when-page_size-is-greate.patch new file mode 100644 index 00000000000..cddd218e670 --- /dev/null +++ b/queue-6.6/rdma-core-fix-umem-iterator-when-page_size-is-greate.patch @@ -0,0 +1,145 @@ +From 967c9a886b43df2ab415e71b0aea79909c811945 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 14:21:41 -0600 +Subject: RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz + +From: Mike Marciniszyn + +[ Upstream commit 4fbc3a52cd4d14de3793f4b2c721d7306ea84cf9 ] + +64k pages introduce the situation in this diagram when the HCA 4k page +size is being used: + + +-------------------------------------------+ <--- 64k aligned VA + | | + | HCA 4k page | + | | + +-------------------------------------------+ + | o | + | | + | o | + | | + | o | + +-------------------------------------------+ + | | + | HCA 4k page | + | | + +-------------------------------------------+ <--- Live HCA page + |OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO| <--- offset + | | <--- VA + | MR data | + +-------------------------------------------+ + | | + | HCA 4k page | + | | + +-------------------------------------------+ + | o | + | | + | o | + | | + | o | + +-------------------------------------------+ + | | + | HCA 4k page | + | | + +-------------------------------------------+ + +The VA addresses are coming from rdma-core in this diagram can be +arbitrary, but for 64k pages, the VA may be offset by some number of HCA +4k pages and followed by some number of HCA 4k pages. + +The current iterator doesn't account for either the preceding 4k pages or +the following 4k pages. + +Fix the issue by extending the ib_block_iter to contain the number of DMA +pages like comment [1] says and by using __sg_advance to start the +iterator at the first live HCA page. + +The changes are contained in a parallel set of iterator start and next +functions that are umem aware and specific to umem since there is one user +of the rdma_for_each_block() without umem. + +These two fixes prevents the extra pages before and after the user MR +data. + +Fix the preceding pages by using the __sq_advance field to start at the +first 4k page containing MR data. + +Fix the following pages by saving the number of pgsz blocks in the +iterator state and downcounting on each next. + +This fix allows for the elimination of the small page crutch noted in the +Fixes. + +Fixes: 10c75ccb54e4 ("RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz()") +Link: https://lore.kernel.org/r/20231129202143.1434-2-shiraz.saleem@intel.com +Signed-off-by: Mike Marciniszyn +Signed-off-by: Shiraz Saleem +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/umem.c | 6 ------ + include/rdma/ib_umem.h | 9 ++++++++- + include/rdma/ib_verbs.h | 1 + + 3 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index f9ab671c8eda5..07c571c7b6999 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -96,12 +96,6 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, + return page_size; + } + +- /* rdma_for_each_block() has a bug if the page size is smaller than the +- * page size used to build the umem. For now prevent smaller page sizes +- * from being returned. +- */ +- pgsz_bitmap &= GENMASK(BITS_PER_LONG - 1, PAGE_SHIFT); +- + /* The best result is the smallest page size that results in the minimum + * number of required pages. Compute the largest page size that could + * work based on VA address bits that don't change. +diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h +index 95896472a82bf..565a850445414 100644 +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -77,6 +77,13 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, + { + __rdma_block_iter_start(biter, umem->sgt_append.sgt.sgl, + umem->sgt_append.sgt.nents, pgsz); ++ biter->__sg_advance = ib_umem_offset(umem) & ~(pgsz - 1); ++ biter->__sg_numblocks = ib_umem_num_dma_blocks(umem, pgsz); ++} ++ ++static inline bool __rdma_umem_block_iter_next(struct ib_block_iter *biter) ++{ ++ return __rdma_block_iter_next(biter) && biter->__sg_numblocks--; + } + + /** +@@ -92,7 +99,7 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, + */ + #define rdma_umem_for_each_dma_block(umem, biter, pgsz) \ + for (__rdma_umem_block_iter_start(biter, umem, pgsz); \ +- __rdma_block_iter_next(biter);) ++ __rdma_umem_block_iter_next(biter);) + + #ifdef CONFIG_INFINIBAND_USER_MEM + +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 533ab92684d81..62f9d126a71ad 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -2846,6 +2846,7 @@ struct ib_block_iter { + /* internal states */ + struct scatterlist *__sg; /* sg holding the current aligned block */ + dma_addr_t __dma_addr; /* unaligned DMA address of this block */ ++ size_t __sg_numblocks; /* ib_umem_num_dma_blocks() */ + unsigned int __sg_nents; /* number of SG entries */ + unsigned int __sg_advance; /* number of bytes to advance in sg in next step */ + unsigned int __pg_bit; /* alignment of current block */ +-- +2.42.0 + diff --git a/queue-6.6/rdma-core-fix-uninit-value-access-in-ib_get_eth_spee.patch b/queue-6.6/rdma-core-fix-uninit-value-access-in-ib_get_eth_spee.patch new file mode 100644 index 00000000000..f30434ca43c --- /dev/null +++ b/queue-6.6/rdma-core-fix-uninit-value-access-in-ib_get_eth_spee.patch @@ -0,0 +1,82 @@ +From 77749ef64735f4bd8bf76cf155eb7e534bcb8e45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Nov 2023 23:31:13 +0900 +Subject: RDMA/core: Fix uninit-value access in ib_get_eth_speed() + +From: Shigeru Yoshida + +[ Upstream commit 0550d4604e2ca4e653dc13f0c009fc42106b6bfc ] + +KMSAN reported the following uninit-value access issue: + +lo speed is unknown, defaulting to 1000 +===================================================== +BUG: KMSAN: uninit-value in ib_get_width_and_speed drivers/infiniband/core/verbs.c:1889 [inline] +BUG: KMSAN: uninit-value in ib_get_eth_speed+0x546/0xaf0 drivers/infiniband/core/verbs.c:1998 + ib_get_width_and_speed drivers/infiniband/core/verbs.c:1889 [inline] + ib_get_eth_speed+0x546/0xaf0 drivers/infiniband/core/verbs.c:1998 + siw_query_port drivers/infiniband/sw/siw/siw_verbs.c:173 [inline] + siw_get_port_immutable+0x6f/0x120 drivers/infiniband/sw/siw/siw_verbs.c:203 + setup_port_data drivers/infiniband/core/device.c:848 [inline] + setup_device drivers/infiniband/core/device.c:1244 [inline] + ib_register_device+0x1589/0x1df0 drivers/infiniband/core/device.c:1383 + siw_device_register drivers/infiniband/sw/siw/siw_main.c:72 [inline] + siw_newlink+0x129e/0x13d0 drivers/infiniband/sw/siw/siw_main.c:490 + nldev_newlink+0x8fd/0xa60 drivers/infiniband/core/nldev.c:1763 + rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] + rdma_nl_rcv+0xe8a/0x1120 drivers/infiniband/core/netlink.c:259 + netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] + netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368 + netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + ____sys_sendmsg+0x997/0xd60 net/socket.c:2588 + ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642 + __sys_sendmsg net/socket.c:2671 [inline] + __do_sys_sendmsg net/socket.c:2680 [inline] + __se_sys_sendmsg net/socket.c:2678 [inline] + __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Local variable lksettings created at: + ib_get_eth_speed+0x4b/0xaf0 drivers/infiniband/core/verbs.c:1974 + siw_query_port drivers/infiniband/sw/siw/siw_verbs.c:173 [inline] + siw_get_port_immutable+0x6f/0x120 drivers/infiniband/sw/siw/siw_verbs.c:203 + +CPU: 0 PID: 11257 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 +===================================================== + +If __ethtool_get_link_ksettings() fails, `netdev_speed` is set to the +default value, SPEED_1000. In this case, if `lanes` field of struct +ethtool_link_ksettings is not initialized, an uninitialized value is passed +to ib_get_width_and_speed(). This causes the above issue. This patch +resolves the issue by initializing `lanes` to 0. + +Fixes: cb06b6b3f6cb ("RDMA/core: Get IB width and speed from netdev") +Signed-off-by: Shigeru Yoshida +Link: https://lore.kernel.org/r/20231108143113.1360567-1-syoshida@redhat.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 41ff5595c8606..186ed3c22ec9e 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1968,7 +1968,7 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width) + int rc; + u32 netdev_speed; + struct net_device *netdev; +- struct ethtool_link_ksettings lksettings; ++ struct ethtool_link_ksettings lksettings = {}; + + if (rdma_port_get_link_layer(dev, port_num) != IB_LINK_LAYER_ETHERNET) + return -EINVAL; +-- +2.42.0 + diff --git a/queue-6.6/rdma-hns-fix-unnecessary-err-return-when-using-inval.patch b/queue-6.6/rdma-hns-fix-unnecessary-err-return-when-using-inval.patch new file mode 100644 index 00000000000..b9ed0e10e03 --- /dev/null +++ b/queue-6.6/rdma-hns-fix-unnecessary-err-return-when-using-inval.patch @@ -0,0 +1,49 @@ +From 98f516171075294132829b6e1e5adc4082c503f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Oct 2023 17:32:42 +0800 +Subject: RDMA/hns: Fix unnecessary err return when using invalid congest + control algorithm + +From: Junxian Huang + +[ Upstream commit efb9cbf66440482ceaa90493d648226ab7ec2ebf ] + +Add a default congest control algorithm so that driver won't return +an error when the configured algorithm is invalid. + +Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20231028093242.670325-1-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 58d14f1562b9a..486d635b6e3ab 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4755,10 +4755,15 @@ static int check_cong_type(struct ib_qp *ibqp, + cong_alg->wnd_mode_sel = WND_LIMIT; + break; + default: +- ibdev_err(&hr_dev->ib_dev, +- "error type(%u) for congestion selection.\n", +- hr_dev->caps.cong_type); +- return -EINVAL; ++ ibdev_warn(&hr_dev->ib_dev, ++ "invalid type(%u) for congestion selection.\n", ++ hr_dev->caps.cong_type); ++ hr_dev->caps.cong_type = CONG_TYPE_DCQCN; ++ cong_alg->alg_sel = CONG_DCQCN; ++ cong_alg->alg_sub_sel = UNSUPPORT_CONG_LEVEL; ++ cong_alg->dip_vld = DIP_INVALID; ++ cong_alg->wnd_mode_sel = WND_LIMIT; ++ break; + } + + return 0; +-- +2.42.0 + diff --git a/queue-6.6/rdma-irdma-add-wait-for-suspend-on-sqd.patch b/queue-6.6/rdma-irdma-add-wait-for-suspend-on-sqd.patch new file mode 100644 index 00000000000..63824c42162 --- /dev/null +++ b/queue-6.6/rdma-irdma-add-wait-for-suspend-on-sqd.patch @@ -0,0 +1,132 @@ +From f54cb1089548a3056ad679103d2917b19c3d3aba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 11:02:46 -0600 +Subject: RDMA/irdma: Add wait for suspend on SQD + +From: Mustafa Ismail + +[ Upstream commit bd6da690c27d75cae432c09162d054b34fa2156f ] + +Currently, there is no wait for the QP suspend to complete on a modify +to SQD state. Add a wait, after the modify to SQD state, for the Suspend +Complete AE. While we are at it, update the suspend timeout value in +irdma_prep_tc_change to use IRDMA_EVENT_TIMEOUT_MS too. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20231114170246.238-3-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 6 +++++- + drivers/infiniband/hw/irdma/main.c | 2 +- + drivers/infiniband/hw/irdma/main.h | 2 +- + drivers/infiniband/hw/irdma/verbs.c | 21 +++++++++++++++++++++ + drivers/infiniband/hw/irdma/verbs.h | 1 + + 5 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 7cbdd5433dba5..1fc4966cf115e 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -321,7 +321,11 @@ static void irdma_process_aeq(struct irdma_pci_f *rf) + break; + case IRDMA_AE_QP_SUSPEND_COMPLETE: + if (iwqp->iwdev->vsi.tc_change_pending) { +- atomic_dec(&iwqp->sc_qp.vsi->qp_suspend_reqs); ++ if (!atomic_dec_return(&qp->vsi->qp_suspend_reqs)) ++ wake_up(&iwqp->iwdev->suspend_wq); ++ } ++ if (iwqp->suspend_pending) { ++ iwqp->suspend_pending = false; + wake_up(&iwqp->iwdev->suspend_wq); + } + break; +diff --git a/drivers/infiniband/hw/irdma/main.c b/drivers/infiniband/hw/irdma/main.c +index 514453777e07d..be1030d1adfaf 100644 +--- a/drivers/infiniband/hw/irdma/main.c ++++ b/drivers/infiniband/hw/irdma/main.c +@@ -48,7 +48,7 @@ static void irdma_prep_tc_change(struct irdma_device *iwdev) + /* Wait for all qp's to suspend */ + wait_event_timeout(iwdev->suspend_wq, + !atomic_read(&iwdev->vsi.qp_suspend_reqs), +- IRDMA_EVENT_TIMEOUT); ++ msecs_to_jiffies(IRDMA_EVENT_TIMEOUT_MS)); + irdma_ws_reset(&iwdev->vsi); + } + +diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h +index 82fc5f5b002c0..cbf0db72e1088 100644 +--- a/drivers/infiniband/hw/irdma/main.h ++++ b/drivers/infiniband/hw/irdma/main.h +@@ -78,7 +78,7 @@ extern struct auxiliary_driver i40iw_auxiliary_drv; + + #define MAX_DPC_ITERATIONS 128 + +-#define IRDMA_EVENT_TIMEOUT 50000 ++#define IRDMA_EVENT_TIMEOUT_MS 5000 + #define IRDMA_VCHNL_EVENT_TIMEOUT 100000 + #define IRDMA_RST_TIMEOUT_HZ 4 + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 895799cbc4fdc..4fef576e9994a 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -1157,6 +1157,21 @@ static u8 irdma_roce_get_vlan_prio(const struct ib_gid_attr *attr, u8 prio) + return prio; + } + ++static int irdma_wait_for_suspend(struct irdma_qp *iwqp) ++{ ++ if (!wait_event_timeout(iwqp->iwdev->suspend_wq, ++ !iwqp->suspend_pending, ++ msecs_to_jiffies(IRDMA_EVENT_TIMEOUT_MS))) { ++ iwqp->suspend_pending = false; ++ ibdev_warn(&iwqp->iwdev->ibdev, ++ "modify_qp timed out waiting for suspend. qp_id = %d, last_ae = 0x%x\n", ++ iwqp->ibqp.qp_num, iwqp->last_aeq); ++ return -EBUSY; ++ } ++ ++ return 0; ++} ++ + /** + * irdma_modify_qp_roce - modify qp request + * @ibqp: qp's pointer for modify +@@ -1420,6 +1435,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + + info.next_iwarp_state = IRDMA_QP_STATE_SQD; + issue_modify_qp = 1; ++ iwqp->suspend_pending = true; + break; + case IB_QPS_SQE: + case IB_QPS_ERR: +@@ -1460,6 +1476,11 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + ctx_info->rem_endpoint_idx = udp_info->arp_idx; + if (irdma_hw_modify_qp(iwdev, iwqp, &info, true)) + return -EINVAL; ++ if (info.next_iwarp_state == IRDMA_QP_STATE_SQD) { ++ ret = irdma_wait_for_suspend(iwqp); ++ if (ret) ++ return ret; ++ } + spin_lock_irqsave(&iwqp->lock, flags); + if (iwqp->iwarp_state == info.curr_iwarp_state) { + iwqp->iwarp_state = info.next_iwarp_state; +diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h +index 5d7b983f47a24..20297a14c9a61 100644 +--- a/drivers/infiniband/hw/irdma/verbs.h ++++ b/drivers/infiniband/hw/irdma/verbs.h +@@ -196,6 +196,7 @@ struct irdma_qp { + u8 flush_issued : 1; + u8 sig_all : 1; + u8 pau_mode : 1; ++ u8 suspend_pending : 1; + u8 rsvd : 1; + u8 iwarp_state; + u16 term_sq_flush_code; +-- +2.42.0 + diff --git a/queue-6.6/rdma-irdma-avoid-free-the-non-cqp_request-scratch.patch b/queue-6.6/rdma-irdma-avoid-free-the-non-cqp_request-scratch.patch new file mode 100644 index 00000000000..aef2083d559 --- /dev/null +++ b/queue-6.6/rdma-irdma-avoid-free-the-non-cqp_request-scratch.patch @@ -0,0 +1,89 @@ +From 5a97982e804674cf2fcacf06b10e4553ef16ed2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 00:14:15 -0800 +Subject: RDMA/irdma: Avoid free the non-cqp_request scratch + +From: Shifeng Li + +[ Upstream commit e3e82fcb79eeb3f1a88a89f676831773caff514a ] + +When creating ceq_0 during probing irdma, cqp.sc_cqp will be sent as a +cqp_request to cqp->sc_cqp.sq_ring. If the request is pending when +removing the irdma driver or unplugging its aux device, cqp.sc_cqp will be +dereferenced as wrong struct in irdma_free_pending_cqp_request(). + + PID: 3669 TASK: ffff88aef892c000 CPU: 28 COMMAND: "kworker/28:0" + #0 [fffffe0000549e38] crash_nmi_callback at ffffffff810e3a34 + #1 [fffffe0000549e40] nmi_handle at ffffffff810788b2 + #2 [fffffe0000549ea0] default_do_nmi at ffffffff8107938f + #3 [fffffe0000549eb8] do_nmi at ffffffff81079582 + #4 [fffffe0000549ef0] end_repeat_nmi at ffffffff82e016b4 + [exception RIP: native_queued_spin_lock_slowpath+1291] + RIP: ffffffff8127e72b RSP: ffff88aa841ef778 RFLAGS: 00000046 + RAX: 0000000000000000 RBX: ffff88b01f849700 RCX: ffffffff8127e47e + RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff83857ec0 + RBP: ffff88afe3e4efc8 R8: ffffed15fc7c9dfa R9: ffffed15fc7c9dfa + R10: 0000000000000001 R11: ffffed15fc7c9df9 R12: 0000000000740000 + R13: ffff88b01f849708 R14: 0000000000000003 R15: ffffed1603f092e1 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 + -- -- + #5 [ffff88aa841ef778] native_queued_spin_lock_slowpath at ffffffff8127e72b + #6 [ffff88aa841ef7b0] _raw_spin_lock_irqsave at ffffffff82c22aa4 + #7 [ffff88aa841ef7c8] __wake_up_common_lock at ffffffff81257363 + #8 [ffff88aa841ef888] irdma_free_pending_cqp_request at ffffffffa0ba12cc [irdma] + #9 [ffff88aa841ef958] irdma_cleanup_pending_cqp_op at ffffffffa0ba1469 [irdma] + #10 [ffff88aa841ef9c0] irdma_ctrl_deinit_hw at ffffffffa0b2989f [irdma] + #11 [ffff88aa841efa28] irdma_remove at ffffffffa0b252df [irdma] + #12 [ffff88aa841efae8] auxiliary_bus_remove at ffffffff8219afdb + #13 [ffff88aa841efb00] device_release_driver_internal at ffffffff821882e6 + #14 [ffff88aa841efb38] bus_remove_device at ffffffff82184278 + #15 [ffff88aa841efb88] device_del at ffffffff82179d23 + #16 [ffff88aa841efc48] ice_unplug_aux_dev at ffffffffa0eb1c14 [ice] + #17 [ffff88aa841efc68] ice_service_task at ffffffffa0d88201 [ice] + #18 [ffff88aa841efde8] process_one_work at ffffffff811c589a + #19 [ffff88aa841efe60] worker_thread at ffffffff811c71ff + #20 [ffff88aa841eff10] kthread at ffffffff811d87a0 + #21 [ffff88aa841eff50] ret_from_fork at ffffffff82e0022f + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Link: https://lore.kernel.org/r/20231130081415.891006-1-lishifeng@sangfor.com.cn +Suggested-by: "Ismail, Mustafa" +Signed-off-by: Shifeng Li +Reviewed-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index db3829ff922b5..564c9188e1f84 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -1184,7 +1184,6 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq, + int status; + struct irdma_ceq_init_info info = {}; + struct irdma_sc_dev *dev = &rf->sc_dev; +- u64 scratch; + u32 ceq_size; + + info.ceq_id = ceq_id; +@@ -1205,14 +1204,13 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq, + iwceq->sc_ceq.ceq_id = ceq_id; + info.dev = dev; + info.vsi = vsi; +- scratch = (uintptr_t)&rf->cqp.sc_cqp; + status = irdma_sc_ceq_init(&iwceq->sc_ceq, &info); + if (!status) { + if (dev->ceq_valid) + status = irdma_cqp_ceq_cmd(&rf->sc_dev, &iwceq->sc_ceq, + IRDMA_OP_CEQ_CREATE); + else +- status = irdma_sc_cceq_create(&iwceq->sc_ceq, scratch); ++ status = irdma_sc_cceq_create(&iwceq->sc_ceq, 0); + } + + if (status) { +-- +2.42.0 + diff --git a/queue-6.6/rdma-irdma-do-not-modify-to-sqd-on-error.patch b/queue-6.6/rdma-irdma-do-not-modify-to-sqd-on-error.patch new file mode 100644 index 00000000000..e1fc8770a8f --- /dev/null +++ b/queue-6.6/rdma-irdma-do-not-modify-to-sqd-on-error.patch @@ -0,0 +1,42 @@ +From c44b9729e87faab6888b503284058dc5c5f1ab88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 11:02:45 -0600 +Subject: RDMA/irdma: Do not modify to SQD on error + +From: Mustafa Ismail + +[ Upstream commit ba12ab66aa83a2340a51ad6e74b284269745138c ] + +Remove the modify to SQD before going to ERROR state. It is not needed. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20231114170246.238-2-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 3eb7a7a3a975d..895799cbc4fdc 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -1424,13 +1424,6 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, + case IB_QPS_SQE: + case IB_QPS_ERR: + case IB_QPS_RESET: +- if (iwqp->iwarp_state == IRDMA_QP_STATE_RTS) { +- spin_unlock_irqrestore(&iwqp->lock, flags); +- info.next_iwarp_state = IRDMA_QP_STATE_SQD; +- irdma_hw_modify_qp(iwdev, iwqp, &info, true); +- spin_lock_irqsave(&iwqp->lock, flags); +- } +- + if (iwqp->iwarp_state == IRDMA_QP_STATE_ERROR) { + spin_unlock_irqrestore(&iwqp->lock, flags); + if (udata && udata->inlen) { +-- +2.42.0 + diff --git a/queue-6.6/rdma-irdma-ensure-iwarp-qp-queue-memory-is-os-paged-.patch b/queue-6.6/rdma-irdma-ensure-iwarp-qp-queue-memory-is-os-paged-.patch new file mode 100644 index 00000000000..fdf67c61611 --- /dev/null +++ b/queue-6.6/rdma-irdma-ensure-iwarp-qp-queue-memory-is-os-paged-.patch @@ -0,0 +1,45 @@ +From 293437501616d9c5ebd563c24e4aed02e22411c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 14:21:42 -0600 +Subject: RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned + +From: Mike Marciniszyn + +[ Upstream commit 0a5ec366de7e94192669ba08de6ed336607fd282 ] + +The SQ is shared for between kernel and used by storing the kernel page +pointer and passing that to a kmap_atomic(). + +This then requires that the alignment is PAGE_SIZE aligned. + +Fix by adding an iWarp specific alignment check. + +Fixes: e965ef0e7b2c ("RDMA/irdma: Split QP handler into irdma_reg_user_mr_type_qp") +Link: https://lore.kernel.org/r/20231129202143.1434-3-shiraz.saleem@intel.com +Signed-off-by: Mike Marciniszyn +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 4fef576e9994a..c7cb328b90f9d 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -2935,6 +2935,11 @@ static int irdma_reg_user_mr_type_qp(struct irdma_mem_reg_req req, + int err; + u8 lvl; + ++ /* iWarp: Catch page not starting on OS page boundary */ ++ if (!rdma_protocol_roce(&iwdev->ibdev, 1) && ++ ib_umem_offset(iwmr->region)) ++ return -EINVAL; ++ + total = req.sq_pages + req.rq_pages + 1; + if (total > iwmr->page_cnt) + return -EINVAL; +-- +2.42.0 + diff --git a/queue-6.6/rdma-irdma-fix-support-for-64k-pages.patch b/queue-6.6/rdma-irdma-fix-support-for-64k-pages.patch new file mode 100644 index 00000000000..f2ae2701959 --- /dev/null +++ b/queue-6.6/rdma-irdma-fix-support-for-64k-pages.patch @@ -0,0 +1,41 @@ +From be50fba1a6a2b4bf8d9aa6f7427e37e375842f1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 14:21:43 -0600 +Subject: RDMA/irdma: Fix support for 64k pages + +From: Mike Marciniszyn + +[ Upstream commit 03769f72d66edab82484449ed594cb6b00ae0223 ] + +Virtual QP and CQ require a 4K HW page size but the driver passes +PAGE_SIZE to ib_umem_find_best_pgsz() instead. + +Fix this by using the appropriate 4k value in the bitmap passed to +ib_umem_find_best_pgsz(). + +Fixes: 693a5386eff0 ("RDMA/irdma: Split mr alloc and free into new functions") +Link: https://lore.kernel.org/r/20231129202143.1434-4-shiraz.saleem@intel.com +Signed-off-by: Mike Marciniszyn +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index c7cb328b90f9d..2f1bedd3a5201 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -2903,7 +2903,7 @@ static struct irdma_mr *irdma_alloc_iwmr(struct ib_umem *region, + iwmr->type = reg_type; + + pgsz_bitmap = (reg_type == IRDMA_MEMREG_TYPE_MEM) ? +- iwdev->rf->sc_dev.hw_attrs.page_size_cap : PAGE_SIZE; ++ iwdev->rf->sc_dev.hw_attrs.page_size_cap : SZ_4K; + + iwmr->page_size = ib_umem_find_best_pgsz(region, pgsz_bitmap, virt); + if (unlikely(!iwmr->page_size)) { +-- +2.42.0 + diff --git a/queue-6.6/rdma-irdma-fix-uaf-in-irdma_sc_ccq_get_cqe_info.patch b/queue-6.6/rdma-irdma-fix-uaf-in-irdma_sc_ccq_get_cqe_info.patch new file mode 100644 index 00000000000..cf1b5b97dc7 --- /dev/null +++ b/queue-6.6/rdma-irdma-fix-uaf-in-irdma_sc_ccq_get_cqe_info.patch @@ -0,0 +1,76 @@ +From eea18d1ba668735fa7401065f59b65fbaec8ffe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 02:12:36 -0800 +Subject: RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info() + +From: Shifeng Li + +[ Upstream commit 2b78832f50c4d711e161b166d7d8790968051546 ] + +When removing the irdma driver or unplugging its aux device, the ccq +queue is released before destorying the cqp_cmpl_wq queue. +But in the window, there may still be completion events for wqes. That +will cause a UAF in irdma_sc_ccq_get_cqe_info(). + +[34693.333191] BUG: KASAN: use-after-free in irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] +[34693.333194] Read of size 8 at addr ffff889097f80818 by task kworker/u67:1/26327 +[34693.333194] +[34693.333199] CPU: 9 PID: 26327 Comm: kworker/u67:1 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 +[34693.333200] Hardware name: SANGFOR Inspur/NULL, BIOS 4.1.13 08/01/2016 +[34693.333211] Workqueue: cqp_cmpl_wq cqp_compl_worker [irdma] +[34693.333213] Call Trace: +[34693.333220] dump_stack+0x71/0xab +[34693.333226] print_address_description+0x6b/0x290 +[34693.333238] ? irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] +[34693.333240] kasan_report+0x14a/0x2b0 +[34693.333251] irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] +[34693.333264] ? irdma_free_cqp_request+0x151/0x1e0 [irdma] +[34693.333274] irdma_cqp_ce_handler+0x1fb/0x3b0 [irdma] +[34693.333285] ? irdma_ctrl_init_hw+0x2c20/0x2c20 [irdma] +[34693.333290] ? __schedule+0x836/0x1570 +[34693.333293] ? strscpy+0x83/0x180 +[34693.333296] process_one_work+0x56a/0x11f0 +[34693.333298] worker_thread+0x8f/0xf40 +[34693.333301] ? __kthread_parkme+0x78/0xf0 +[34693.333303] ? rescuer_thread+0xc50/0xc50 +[34693.333305] kthread+0x2a0/0x390 +[34693.333308] ? kthread_destroy_worker+0x90/0x90 +[34693.333310] ret_from_fork+0x1f/0x40 + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Shifeng Li +Link: https://lore.kernel.org/r/20231121101236.581694-1-lishifeng1992@126.com +Acked-by: Shiraz Saleem +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 1fc4966cf115e..db3829ff922b5 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -585,9 +585,6 @@ static void irdma_destroy_cqp(struct irdma_pci_f *rf) + struct irdma_cqp *cqp = &rf->cqp; + int status = 0; + +- if (rf->cqp_cmpl_wq) +- destroy_workqueue(rf->cqp_cmpl_wq); +- + status = irdma_sc_cqp_destroy(dev->cqp); + if (status) + ibdev_dbg(to_ibdev(dev), "ERR: Destroy CQP failed %d\n", status); +@@ -752,6 +749,9 @@ static void irdma_destroy_ccq(struct irdma_pci_f *rf) + struct irdma_ccq *ccq = &rf->ccq; + int status = 0; + ++ if (rf->cqp_cmpl_wq) ++ destroy_workqueue(rf->cqp_cmpl_wq); ++ + if (!rf->reset) + status = irdma_sc_ccq_destroy(dev->ccq, 0, true); + if (status) +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-clt-fix-the-max_send_wr-setting.patch b/queue-6.6/rdma-rtrs-clt-fix-the-max_send_wr-setting.patch new file mode 100644 index 00000000000..5e63f1e2ae9 --- /dev/null +++ b/queue-6.6/rdma-rtrs-clt-fix-the-max_send_wr-setting.patch @@ -0,0 +1,39 @@ +From 1d07b5cf79dbea3c7dd8bf7bf830d54854e52aff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:43 +0100 +Subject: RDMA/rtrs-clt: Fix the max_send_wr setting + +From: Jack Wang + +[ Upstream commit 6d09f6f7d7584e099633282ea915988914f86529 ] + +For each write request, we need Request, Response Memory Registration, +Local Invalidate. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Signed-off-by: Jack Wang +Reviewed-by: Md Haris Iqbal +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-7-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index dc482d1872fb8..b020b97dbe679 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1694,7 +1694,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con) + clt_path->s.dev_ref++; + max_send_wr = min_t(int, wr_limit, + /* QD * (REQ + RSP + FR REGS or INVS) + drain */ +- clt_path->queue_depth * 3 + 1); ++ clt_path->queue_depth * 4 + 1); + max_recv_wr = min_t(int, wr_limit, + clt_path->queue_depth * 3 + 1); + max_send_sge = 2; +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch b/queue-6.6/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch new file mode 100644 index 00000000000..224dc890aa8 --- /dev/null +++ b/queue-6.6/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch @@ -0,0 +1,42 @@ +From afe56994960874254aff57f31f7cbd18c2aa4167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:44 +0100 +Subject: RDMA/rtrs-clt: Remove the warnings for req in_use check + +From: Jack Wang + +[ Upstream commit 0c8bb6eb70ca41031f663b4481aac9ac78b53bc6 ] + +As we chain the WR during write request: memory registration, +rdma write, local invalidate, if only the last WR fail to send due +to send queue overrun, the server can send back the reply, while +client mark the req->in_use to false in case of error in rtrs_clt_req +when error out from rtrs_post_rdma_write_sg. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Signed-off-by: Jack Wang +Reviewed-by: Md Haris Iqbal +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-8-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index b020b97dbe679..1aee62aa1515d 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -384,7 +384,7 @@ static void complete_rdma_req(struct rtrs_clt_io_req *req, int errno, + struct rtrs_clt_path *clt_path; + int err; + +- if (WARN_ON(!req->in_use)) ++ if (!req->in_use) + return; + if (WARN_ON(!req->con)) + return; +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-clt-start-hb-after-path_up.patch b/queue-6.6/rdma-rtrs-clt-start-hb-after-path_up.patch new file mode 100644 index 00000000000..bef957ba7a2 --- /dev/null +++ b/queue-6.6/rdma-rtrs-clt-start-hb-after-path_up.patch @@ -0,0 +1,47 @@ +From 2d618aee73decd3ad1c71fca267033eb37253773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:39 +0100 +Subject: RDMA/rtrs-clt: Start hb after path_up + +From: Jack Wang + +[ Upstream commit 3e44a61b5db873612e20e7b7922468d7d1ac2d22 ] + +If we start hb too early, it will confuse server side to close +the session. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Signed-off-by: Jack Wang +Reviewed-by: Md Haris Iqbal +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-3-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index b6ee801fd0ffb..dc482d1872fb8 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -2345,8 +2345,6 @@ static int init_conns(struct rtrs_clt_path *clt_path) + if (err) + goto destroy; + +- rtrs_start_hb(&clt_path->s); +- + return 0; + + destroy: +@@ -2620,6 +2618,7 @@ static int init_path(struct rtrs_clt_path *clt_path) + goto out; + } + rtrs_clt_path_up(clt_path); ++ rtrs_start_hb(&clt_path->s); + out: + mutex_unlock(&clt_path->init_mutex); + +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-srv-check-return-values-while-processing-i.patch b/queue-6.6/rdma-rtrs-srv-check-return-values-while-processing-i.patch new file mode 100644 index 00000000000..02eed7a6a1e --- /dev/null +++ b/queue-6.6/rdma-rtrs-srv-check-return-values-while-processing-i.patch @@ -0,0 +1,92 @@ +From 07b4c5ef423d9dba11734528270f5acada5255f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:40 +0100 +Subject: RDMA/rtrs-srv: Check return values while processing info request + +From: Md Haris Iqbal + +[ Upstream commit ed1e52aefa16f15dc2f04054a3baf11726a7460e ] + +While processing info request, it could so happen that the srv_path goes +to CLOSING state, cause of any of the error events from RDMA. That state +change should be picked up while trying to change the state in +process_info_req, by checking the return value. In case the state change +call in process_info_req fails, we fail the processing. + +We should also check the return value for rtrs_srv_path_up, since it +sends a link event to the client above, and the client can fail for any +reason. + +Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-4-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index ab4200041fd36..4be0e5b132d4a 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -710,20 +710,23 @@ static void rtrs_srv_info_rsp_done(struct ib_cq *cq, struct ib_wc *wc) + WARN_ON(wc->opcode != IB_WC_SEND); + } + +-static void rtrs_srv_path_up(struct rtrs_srv_path *srv_path) ++static int rtrs_srv_path_up(struct rtrs_srv_path *srv_path) + { + struct rtrs_srv_sess *srv = srv_path->srv; + struct rtrs_srv_ctx *ctx = srv->ctx; +- int up; ++ int up, ret = 0; + + mutex_lock(&srv->paths_ev_mutex); + up = ++srv->paths_up; + if (up == 1) +- ctx->ops.link_ev(srv, RTRS_SRV_LINK_EV_CONNECTED, NULL); ++ ret = ctx->ops.link_ev(srv, RTRS_SRV_LINK_EV_CONNECTED, NULL); + mutex_unlock(&srv->paths_ev_mutex); + + /* Mark session as established */ +- srv_path->established = true; ++ if (!ret) ++ srv_path->established = true; ++ ++ return ret; + } + + static void rtrs_srv_path_down(struct rtrs_srv_path *srv_path) +@@ -852,7 +855,12 @@ static int process_info_req(struct rtrs_srv_con *con, + goto iu_free; + kobject_get(&srv_path->kobj); + get_device(&srv_path->srv->dev); +- rtrs_srv_change_state(srv_path, RTRS_SRV_CONNECTED); ++ err = rtrs_srv_change_state(srv_path, RTRS_SRV_CONNECTED); ++ if (!err) { ++ rtrs_err(s, "rtrs_srv_change_state(), err: %d\n", err); ++ goto iu_free; ++ } ++ + rtrs_srv_start_hb(srv_path); + + /* +@@ -861,7 +869,11 @@ static int process_info_req(struct rtrs_srv_con *con, + * all connections are successfully established. Thus, simply notify + * listener with a proper event if we are the first path. + */ +- rtrs_srv_path_up(srv_path); ++ err = rtrs_srv_path_up(srv_path); ++ if (err) { ++ rtrs_err(s, "rtrs_srv_path_up(), err: %d\n", err); ++ goto iu_free; ++ } + + ib_dma_sync_single_for_device(srv_path->s.dev->ib_dev, + tx_iu->dma_addr, +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-srv-destroy-path-files-after-making-sure-n.patch b/queue-6.6/rdma-rtrs-srv-destroy-path-files-after-making-sure-n.patch new file mode 100644 index 00000000000..aa8405b832e --- /dev/null +++ b/queue-6.6/rdma-rtrs-srv-destroy-path-files-after-making-sure-n.patch @@ -0,0 +1,57 @@ +From a17fe2742862207c33f068496d07d4ccfecc3efd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:42 +0100 +Subject: RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight + +From: Md Haris Iqbal + +[ Upstream commit c4d32e77fc1006f99eeb78417efc3d81a384072a ] + +Destroying path files may lead to the freeing of rdma_stats. This creates +the following race. + +An IO is in-flight, or has just passed the session state check in +process_read/process_write. The close_work gets triggered and the function +rtrs_srv_close_work() starts and does destroy path which frees the +rdma_stats. After this the function process_read/process_write resumes and +tries to update the stats through the function rtrs_srv_update_rdma_stats + +This commit solves the problem by moving the destroy path function to a +later point. This point makes sure any inflights are completed. This is +done by qp drain, and waiting for all in-flights through ops_id. + +Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") +Signed-off-by: Md Haris Iqbal +Signed-off-by: Santosh Kumar Pradhan +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-6-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 925b71481c628..1d33efb8fb03b 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -1532,7 +1532,6 @@ static void rtrs_srv_close_work(struct work_struct *work) + + srv_path = container_of(work, typeof(*srv_path), close_work); + +- rtrs_srv_destroy_path_files(srv_path); + rtrs_srv_stop_hb(srv_path); + + for (i = 0; i < srv_path->s.con_num; i++) { +@@ -1552,6 +1551,8 @@ static void rtrs_srv_close_work(struct work_struct *work) + /* Wait for all completion */ + wait_for_completion(&srv_path->complete_done); + ++ rtrs_srv_destroy_path_files(srv_path); ++ + /* Notify upper layer if we are the last path */ + rtrs_srv_path_down(srv_path); + +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-srv-do-not-unconditionally-enable-irq.patch b/queue-6.6/rdma-rtrs-srv-do-not-unconditionally-enable-irq.patch new file mode 100644 index 00000000000..52ba77f7be6 --- /dev/null +++ b/queue-6.6/rdma-rtrs-srv-do-not-unconditionally-enable-irq.patch @@ -0,0 +1,54 @@ +From b5376a2cfec57a0c9a53732bca7e9b10c261ef8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:38 +0100 +Subject: RDMA/rtrs-srv: Do not unconditionally enable irq + +From: Jack Wang + +[ Upstream commit 3ee7ecd712048ade6482bea4b2f3dcaf039c0348 ] + +When IO is completed, rtrs can be called in softirq context, +unconditionally enabling irq could cause panic. + +To be on safe side, use spin_lock_irqsave and spin_unlock_irqrestore +instread. + +Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") +Signed-off-by: Jack Wang +Signed-off-by: Florian-Ewald Mueller +Signed-off-by: Md Haris Iqbal +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-2-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 75e56604e4628..ab4200041fd36 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -65,8 +65,9 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, + { + enum rtrs_srv_state old_state; + bool changed = false; ++ unsigned long flags; + +- spin_lock_irq(&srv_path->state_lock); ++ spin_lock_irqsave(&srv_path->state_lock, flags); + old_state = srv_path->state; + switch (new_state) { + case RTRS_SRV_CONNECTED: +@@ -87,7 +88,7 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, + } + if (changed) + srv_path->state = new_state; +- spin_unlock_irq(&srv_path->state_lock); ++ spin_unlock_irqrestore(&srv_path->state_lock, flags); + + return changed; + } +-- +2.42.0 + diff --git a/queue-6.6/rdma-rtrs-srv-free-srv_mr-iu-only-when-always_invali.patch b/queue-6.6/rdma-rtrs-srv-free-srv_mr-iu-only-when-always_invali.patch new file mode 100644 index 00000000000..e82e47ce8a5 --- /dev/null +++ b/queue-6.6/rdma-rtrs-srv-free-srv_mr-iu-only-when-always_invali.patch @@ -0,0 +1,42 @@ +From a1018cc7af84b00746991ccc8e851fc838ef4b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:41 +0100 +Subject: RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true + +From: Md Haris Iqbal + +[ Upstream commit 3a71cd6ca0ce33d1af019ecf1d7167406fa54400 ] + +Since srv_mr->iu is allocated and used only when always_invalidate is +true, free it only when always_invalidate is true. + +Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-5-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 4be0e5b132d4a..925b71481c628 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -551,7 +551,10 @@ static void unmap_cont_bufs(struct rtrs_srv_path *srv_path) + struct rtrs_srv_mr *srv_mr; + + srv_mr = &srv_path->mrs[i]; +- rtrs_iu_free(srv_mr->iu, srv_path->s.dev->ib_dev, 1); ++ ++ if (always_invalidate) ++ rtrs_iu_free(srv_mr->iu, srv_path->s.dev->ib_dev, 1); ++ + ib_dereg_mr(srv_mr->mr); + ib_dma_unmap_sg(srv_path->s.dev->ib_dev, srv_mr->sgt.sgl, + srv_mr->sgt.nents, DMA_BIDIRECTIONAL); +-- +2.42.0 + diff --git a/queue-6.6/riscv-errata-andes-probe-for-iocp-only-once-in-boot-.patch b/queue-6.6/riscv-errata-andes-probe-for-iocp-only-once-in-boot-.patch new file mode 100644 index 00000000000..c07fa5dea26 --- /dev/null +++ b/queue-6.6/riscv-errata-andes-probe-for-iocp-only-once-in-boot-.patch @@ -0,0 +1,119 @@ +From d85e3a3b38e3b8118180de47af04da5fad2907ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 21:26:47 +0000 +Subject: riscv: errata: andes: Probe for IOCP only once in boot stage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lad Prabhakar + +[ Upstream commit ed5b7cfd7839f9280a63365c1133482b42d0981f ] + +We need to probe for IOCP only once during boot stage, as we were probing +for IOCP for all the stages this caused the below issue during module-init +stage, + +[9.019104] Unable to handle kernel paging request at virtual address ffffffff8100d3a0 +[9.027153] Oops [#1] +[9.029421] Modules linked in: rcar_canfd renesas_usbhs i2c_riic can_dev spi_rspi i2c_core +[9.037686] CPU: 0 PID: 90 Comm: udevd Not tainted 6.7.0-rc1+ #57 +[9.043756] Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT) +[9.050339] epc : riscv_noncoherent_supported+0x10/0x3e +[9.055558]  ra : andes_errata_patch_func+0x4a/0x52 +[9.060418] epc : ffffffff8000d8c2 ra : ffffffff8000d95c sp : ffffffc8003abb00 +[9.067607]  gp : ffffffff814e25a0 tp : ffffffd80361e540 t0 : 0000000000000000 +[9.074795]  t1 : 000000000900031e t2 : 0000000000000001 s0 : ffffffc8003abb20 +[9.081984]  s1 : ffffffff015b57c7 a0 : 0000000000000000 a1 : 0000000000000001 +[9.089172]  a2 : 0000000000000000 a3 : 0000000000000000 a4 : ffffffff8100d8be +[9.096360]  a5 : 0000000000000001 a6 : 0000000000000001 a7 : 000000000900031e +[9.103548]  s2 : ffffffff015b57d7 s3 : 0000000000000001 s4 : 000000000000031e +[9.110736]  s5 : 8000000000008a45 s6 : 0000000000000500 s7 : 000000000000003f +[9.117924]  s8 : ffffffc8003abd48 s9 : ffffffff015b1140 s10: ffffffff8151a1b0 +[9.125113]  s11: ffffffff015b1000 t3 : 0000000000000001 t4 : fefefefefefefeff +[9.132301]  t5 : ffffffff015b57c7 t6 : ffffffd8b63a6000 +[9.137587] status: 0000000200000120 badaddr: ffffffff8100d3a0 cause: 000000000000000f +[9.145468] [] riscv_noncoherent_supported+0x10/0x3e +[9.151972] [] _apply_alternatives+0x84/0x86 +[9.157784] [] apply_module_alternatives+0x10/0x1a +[9.164113] [] module_finalize+0x5e/0x7a +[9.169583] [] load_module+0xfd8/0x179c +[9.174965] [] init_module_from_file+0x76/0xaa +[9.180948] [] __riscv_sys_finit_module+0x176/0x2a8 +[9.187365] [] do_trap_ecall_u+0xbe/0x130 +[9.192922] [] ret_from_exception+0x0/0x64 +[9.198573] Code: 0009 b7e9 6797 014d a783 85a7 c799 4785 0717 0100 (0123) aef7 +[9.205994] ---[ end trace 0000000000000000 ]--- + +This is because we called riscv_noncoherent_supported() for all the stages +during IOCP probe. riscv_noncoherent_supported() function sets +noncoherent_supported variable to true which has an annotation set to +"__ro_after_init" due to which we were seeing the above splat. Fix this by +probing for IOCP only once in boot stage by having a boolean variable +"done" which will be set to true upon IOCP probe in errata_probe_iocp() +and we bail out early if "done" is set to true. + +While at it make return type of errata_probe_iocp() to void as we were +not checking the return value in andes_errata_patch_func(). + +Fixes: e021ae7f5145 ("riscv: errata: Add Andes alternative ports") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Yu Chien Peter Lin +Link: https://lore.kernel.org/r/20231130212647.108746-1-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/errata/andes/errata.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/arch/riscv/errata/andes/errata.c b/arch/riscv/errata/andes/errata.c +index 197db68cc8daf..17a9048697246 100644 +--- a/arch/riscv/errata/andes/errata.c ++++ b/arch/riscv/errata/andes/errata.c +@@ -38,29 +38,35 @@ static long ax45mp_iocp_sw_workaround(void) + return ret.error ? 0 : ret.value; + } + +-static bool errata_probe_iocp(unsigned int stage, unsigned long arch_id, unsigned long impid) ++static void errata_probe_iocp(unsigned int stage, unsigned long arch_id, unsigned long impid) + { ++ static bool done; ++ + if (!IS_ENABLED(CONFIG_ERRATA_ANDES_CMO)) +- return false; ++ return; ++ ++ if (done) ++ return; ++ ++ done = true; + + if (arch_id != ANDESTECH_AX45MP_MARCHID || impid != ANDESTECH_AX45MP_MIMPID) +- return false; ++ return; + + if (!ax45mp_iocp_sw_workaround()) +- return false; ++ return; + + /* Set this just to make core cbo code happy */ + riscv_cbom_block_size = 1; + riscv_noncoherent_supported(); +- +- return true; + } + + void __init_or_module andes_errata_patch_func(struct alt_entry *begin, struct alt_entry *end, + unsigned long archid, unsigned long impid, + unsigned int stage) + { +- errata_probe_iocp(stage, archid, impid); ++ if (stage == RISCV_ALTERNATIVES_BOOT) ++ errata_probe_iocp(stage, archid, impid); + + /* we have nothing to patch here ATM so just return back */ + } +-- +2.42.0 + diff --git a/queue-6.6/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch b/queue-6.6/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch new file mode 100644 index 00000000000..f59cf49ff3d --- /dev/null +++ b/queue-6.6/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch @@ -0,0 +1,56 @@ +From fcf28448766ae51e3f2d35fc5131408f43747cc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 10:02:23 +0100 +Subject: riscv: fix misaligned access handling of C.SWSP and C.SDSP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 22e0eb04837a63af111fae35a92f7577676b9bc8 ] + +This is a backport of a fix that was done in OpenSBI: ec0559eb315b +("lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP"). + +Unlike C.LWSP/C.LDSP, these encodings can be used with the zero +register, so checking that the rs2 field is non-zero is unnecessary. + +Additionally, the previous check was incorrect since it was checking +the immediate field of the instruction instead of the rs2 field. + +Fixes: 956d705dd279 ("riscv: Unaligned load/store handling for M_MODE") +Signed-off-by: Clément Léger +Link: https://lore.kernel.org/r/20231103090223.702340-1-cleger@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps_misaligned.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c +index 378f5b1514435..5348d842c7453 100644 +--- a/arch/riscv/kernel/traps_misaligned.c ++++ b/arch/riscv/kernel/traps_misaligned.c +@@ -342,16 +342,14 @@ int handle_misaligned_store(struct pt_regs *regs) + } else if ((insn & INSN_MASK_C_SD) == INSN_MATCH_C_SD) { + len = 8; + val.data_ulong = GET_RS2S(insn, regs); +- } else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP && +- ((insn >> SH_RD) & 0x1f)) { ++ } else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP) { + len = 8; + val.data_ulong = GET_RS2C(insn, regs); + #endif + } else if ((insn & INSN_MASK_C_SW) == INSN_MATCH_C_SW) { + len = 4; + val.data_ulong = GET_RS2S(insn, regs); +- } else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP && +- ((insn >> SH_RD) & 0x1f)) { ++ } else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP) { + len = 4; + val.data_ulong = GET_RS2C(insn, regs); + } else { +-- +2.42.0 + diff --git a/queue-6.6/scripts-gdb-fix-lx-device-list-bus-and-lx-device-lis.patch b/queue-6.6/scripts-gdb-fix-lx-device-list-bus-and-lx-device-lis.patch new file mode 100644 index 00000000000..a8130d24b6f --- /dev/null +++ b/queue-6.6/scripts-gdb-fix-lx-device-list-bus-and-lx-device-lis.patch @@ -0,0 +1,99 @@ +From 7922af61b1d3952e097556204a0ba8dc62d898f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 20:33:16 -0800 +Subject: scripts/gdb: fix lx-device-list-bus and lx-device-list-class + +From: Florian Fainelli + +[ Upstream commit 801a2b1b49f4dcf06703130922806e9c639c2ca8 ] + +After the conversion to bus_to_subsys() and class_to_subsys(), the gdb +scripts listing the system buses and classes respectively was broken, fix +those by returning the subsys_priv pointer and have the various caller +de-reference either the 'bus' or 'class' structure members accordingly. + +Link: https://lkml.kernel.org/r/20231130043317.174188-1-florian.fainelli@broadcom.com +Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys") +Signed-off-by: Florian Fainelli +Tested-by: Kuan-Ying Lee +Cc: Greg Kroah-Hartman +Cc: Jan Kiszka +Cc: Kieran Bingham +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/device.py | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/scripts/gdb/linux/device.py b/scripts/gdb/linux/device.py +index 16376c5cfec64..0eabc5f4f8ca2 100644 +--- a/scripts/gdb/linux/device.py ++++ b/scripts/gdb/linux/device.py +@@ -36,26 +36,26 @@ def for_each_bus(): + for kobj in kset_for_each_object(gdb.parse_and_eval('bus_kset')): + subsys = container_of(kobj, kset_type.get_type().pointer(), 'kobj') + subsys_priv = container_of(subsys, subsys_private_type.get_type().pointer(), 'subsys') +- yield subsys_priv['bus'] ++ yield subsys_priv + + + def for_each_class(): + for kobj in kset_for_each_object(gdb.parse_and_eval('class_kset')): + subsys = container_of(kobj, kset_type.get_type().pointer(), 'kobj') + subsys_priv = container_of(subsys, subsys_private_type.get_type().pointer(), 'subsys') +- yield subsys_priv['class'] ++ yield subsys_priv + + + def get_bus_by_name(name): + for item in for_each_bus(): +- if item['name'].string() == name: ++ if item['bus']['name'].string() == name: + return item + raise gdb.GdbError("Can't find bus type {!r}".format(name)) + + + def get_class_by_name(name): + for item in for_each_class(): +- if item['name'].string() == name: ++ if item['class']['name'].string() == name: + return item + raise gdb.GdbError("Can't find device class {!r}".format(name)) + +@@ -70,13 +70,13 @@ def klist_for_each(klist): + + + def bus_for_each_device(bus): +- for kn in klist_for_each(bus['p']['klist_devices']): ++ for kn in klist_for_each(bus['klist_devices']): + dp = container_of(kn, device_private_type.get_type().pointer(), 'knode_bus') + yield dp['device'] + + + def class_for_each_device(cls): +- for kn in klist_for_each(cls['p']['klist_devices']): ++ for kn in klist_for_each(cls['klist_devices']): + dp = container_of(kn, device_private_type.get_type().pointer(), 'knode_class') + yield dp['device'] + +@@ -103,7 +103,7 @@ class LxDeviceListBus(gdb.Command): + def invoke(self, arg, from_tty): + if not arg: + for bus in for_each_bus(): +- gdb.write('bus {}:\t{}\n'.format(bus['name'].string(), bus)) ++ gdb.write('bus {}:\t{}\n'.format(bus['bus']['name'].string(), bus)) + for dev in bus_for_each_device(bus): + _show_device(dev, level=1) + else: +@@ -123,7 +123,7 @@ class LxDeviceListClass(gdb.Command): + def invoke(self, arg, from_tty): + if not arg: + for cls in for_each_class(): +- gdb.write("class {}:\t{}\n".format(cls['name'].string(), cls)) ++ gdb.write("class {}:\t{}\n".format(cls['class']['name'].string(), cls)) + for dev in class_for_each_device(cls): + _show_device(dev, level=1) + else: +-- +2.42.0 + diff --git a/queue-6.6/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch b/queue-6.6/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch new file mode 100644 index 00000000000..6da01cd12ee --- /dev/null +++ b/queue-6.6/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch @@ -0,0 +1,38 @@ +From fa85e6db1d1ee6b4c47bbb554f7d50776e562f25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 16:19:41 +0800 +Subject: scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() + +From: Dinghao Liu + +[ Upstream commit 235f2b548d7f4ac5931d834f05d3f7f5166a2e72 ] + +When an error occurs in the for loop of beiscsi_init_wrb_handle(), we +should free phwi_ctxt->be_wrbq before returning an error code to prevent +potential memleak. + +Fixes: a7909b396ba7 ("[SCSI] be2iscsi: Fix dynamic CID allocation Mechanism in driver") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20231123081941.24854-1-dinghao.liu@zju.edu.cn +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index e48f14ad6dfd8..06acb5ff609ee 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -2710,6 +2710,7 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba) + kfree(pwrb_context->pwrb_handle_base); + kfree(pwrb_context->pwrb_handle_basestd); + } ++ kfree(phwi_ctxt->be_wrbq); + return -ENOMEM; + } + +-- +2.42.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 4680fc44fb2..c143494708c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -76,3 +76,57 @@ net-smc-fix-missing-byte-order-conversion-in-clc-han.patch drm-amd-amdgpu-amdgpu_doorbell_mgr-correct-misdocume.patch drm-amdkfd-get-doorbell-s-absolute-offset-based-on-t.patch mm-damon-sysfs-eliminate-potential-uninitialized-var.patch +tee-optee-fix-supplicant-based-device-enumeration.patch +rdma-core-fix-uninit-value-access-in-ib_get_eth_spee.patch +rdma-hns-fix-unnecessary-err-return-when-using-inval.patch +rdma-irdma-do-not-modify-to-sqd-on-error.patch +rdma-irdma-add-wait-for-suspend-on-sqd.patch +arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch +arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch-17227 +asoc-fsl_sai-fix-no-frame-sync-clock-issue-on-i.mx8m.patch +rdma-rtrs-srv-do-not-unconditionally-enable-irq.patch +rdma-rtrs-clt-start-hb-after-path_up.patch +rdma-rtrs-srv-check-return-values-while-processing-i.patch +rdma-rtrs-srv-free-srv_mr-iu-only-when-always_invali.patch +rdma-rtrs-srv-destroy-path-files-after-making-sure-n.patch +rdma-rtrs-clt-fix-the-max_send_wr-setting.patch +rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch +rdma-bnxt_re-correct-module-description-string.patch +rdma-irdma-fix-uaf-in-irdma_sc_ccq_get_cqe_info.patch +arm64-dt-imx93-tqma9352-mba93xxla-fix-lpuart2-pad-co.patch +arm-dts-imx6q-skov-fix-ethernet-clock-regression.patch +arm-dts-rockchip-fix-sdmmc_pwren-s-pinmux-setting-fo.patch +arm-dts-bcm2711-rpi-400-fix-delete-node-of-led_act.patch +hwmon-acpi_power_meter-fix-4.29-mw-bug.patch +asoc-codecs-lpass-tx-macro-set-active_decimator-corr.patch +hwmon-nzxt-kraken2-fix-error-handling-path-in-kraken.patch +firmware-arm_scmi-extend-perf-protocol-ops-to-get-nu.patch +firmware-arm_scmi-extend-perf-protocol-ops-to-get-in.patch +firmware-arm_scmi-fix-frequency-truncation-by-promot.patch +firmware-arm_scmi-simplify-error-path-in-scmi_dvfs_d.patch +firmware-arm_scmi-fix-possible-frequency-truncation-.patch +asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch +rdma-core-fix-umem-iterator-when-page_size-is-greate.patch +rdma-irdma-ensure-iwarp-qp-queue-memory-is-os-paged-.patch +rdma-irdma-fix-support-for-64k-pages.patch +rdma-irdma-avoid-free-the-non-cqp_request-scratch.patch +drm-bridge-tc358768-select-config_videomode_helpers.patch +arm64-dts-imx8mp-imx8mq-add-parkmode-disable-ss-quir.patch +arm-dts-imx6ul-pico-describe-the-ethernet-phy-clock.patch +io_uring-kbuf-fix-an-null-vs-is_err-bug-in-io_alloc_.patch +io_uring-kbuf-check-for-buffer-list-readiness-after-.patch +tracing-fix-a-warning-when-allocating-buffered-event.patch +scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch +arm64-dts-imx8-ss-lsio-add-pwm-interrupts.patch +arm64-dts-freescale-imx8-ss-lsio-fix-pwm-cells.patch +arm64-dts-imx93-correct-mediamix-power.patch +arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch +arm64-dts-imx8-apalis-set-wifi-regulator-to-always-o.patch +arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch +arm-dts-imx28-xea-pass-the-model-property.patch +arm64-dts-rockchip-fix-emmc-data-strobe-pd-on-rk3588.patch +riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch +riscv-errata-andes-probe-for-iocp-only-once-in-boot-.patch +md-don-t-leave-md_recovery_frozen-in-error-path-of-m.patch +kernel-kconfig.kexec-drop-select-of-kexec-for-crash_.patch +scripts-gdb-fix-lx-device-list-bus-and-lx-device-lis.patch diff --git a/queue-6.6/tee-optee-fix-supplicant-based-device-enumeration.patch b/queue-6.6/tee-optee-fix-supplicant-based-device-enumeration.patch new file mode 100644 index 00000000000..14ee191c840 --- /dev/null +++ b/queue-6.6/tee-optee-fix-supplicant-based-device-enumeration.patch @@ -0,0 +1,100 @@ +From ba060423ff7ba12aaaa6a0ce353a85d0d2266489 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 13:00:55 +0530 +Subject: tee: optee: Fix supplicant based device enumeration + +From: Sumit Garg + +[ Upstream commit 7269cba53d906cf257c139d3b3a53ad272176bca ] + +Currently supplicant dependent optee device enumeration only registers +devices whenever tee-supplicant is invoked for the first time. But it +forgets to remove devices when tee-supplicant daemon stops running and +closes its context gracefully. This leads to following error for fTPM +driver during reboot/shutdown: + +[ 73.466791] tpm tpm0: ftpm_tee_tpm_op_send: SUBMIT_COMMAND invoke error: 0xffff3024 + +Fix this by adding an attribute for supplicant dependent devices so that +the user-space service can detect and detach supplicant devices before +closing the supplicant: + +$ for dev in /sys/bus/tee/devices/*; do if [[ -f "$dev/need_supplicant" && -f "$dev/driver/unbind" ]]; \ + then echo $(basename "$dev") > $dev/driver/unbind; fi done + +Reported-by: Jan Kiszka +Closes: https://github.com/OP-TEE/optee_os/issues/6094 +Fixes: 5f178bb71e3a ("optee: enable support for multi-stage bus enumeration") +Signed-off-by: Sumit Garg +Reviewed-by: Ilias Apalodimas +Acked-by: Jerome Forissier +[jw: fixed up Date documentation] +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + .../ABI/testing/sysfs-bus-optee-devices | 9 +++++++++ + drivers/tee/optee/device.c | 17 +++++++++++++++-- + 2 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-optee-devices b/Documentation/ABI/testing/sysfs-bus-optee-devices +index 0f58701367b66..af31e5a22d89f 100644 +--- a/Documentation/ABI/testing/sysfs-bus-optee-devices ++++ b/Documentation/ABI/testing/sysfs-bus-optee-devices +@@ -6,3 +6,12 @@ Description: + OP-TEE bus provides reference to registered drivers under this directory. The + matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers + are free to create needed API under optee-ta- directory. ++ ++What: /sys/bus/tee/devices/optee-ta-/need_supplicant ++Date: November 2023 ++KernelVersion: 6.7 ++Contact: op-tee@lists.trustedfirmware.org ++Description: ++ Allows to distinguish whether an OP-TEE based TA/device requires user-space ++ tee-supplicant to function properly or not. This attribute will be present for ++ devices which depend on tee-supplicant to be running. +diff --git a/drivers/tee/optee/device.c b/drivers/tee/optee/device.c +index 64f0e047c23d2..4b10921276942 100644 +--- a/drivers/tee/optee/device.c ++++ b/drivers/tee/optee/device.c +@@ -60,7 +60,16 @@ static void optee_release_device(struct device *dev) + kfree(optee_device); + } + +-static int optee_register_device(const uuid_t *device_uuid) ++static ssize_t need_supplicant_show(struct device *dev, ++ struct device_attribute *attr, ++ char *buf) ++{ ++ return 0; ++} ++ ++static DEVICE_ATTR_RO(need_supplicant); ++ ++static int optee_register_device(const uuid_t *device_uuid, u32 func) + { + struct tee_client_device *optee_device = NULL; + int rc; +@@ -83,6 +92,10 @@ static int optee_register_device(const uuid_t *device_uuid) + put_device(&optee_device->dev); + } + ++ if (func == PTA_CMD_GET_DEVICES_SUPP) ++ device_create_file(&optee_device->dev, ++ &dev_attr_need_supplicant); ++ + return rc; + } + +@@ -142,7 +155,7 @@ static int __optee_enumerate_devices(u32 func) + num_devices = shm_size / sizeof(uuid_t); + + for (idx = 0; idx < num_devices; idx++) { +- rc = optee_register_device(&device_uuid[idx]); ++ rc = optee_register_device(&device_uuid[idx], func); + if (rc) + goto out_shm; + } +-- +2.42.0 + diff --git a/queue-6.6/tracing-fix-a-warning-when-allocating-buffered-event.patch b/queue-6.6/tracing-fix-a-warning-when-allocating-buffered-event.patch new file mode 100644 index 00000000000..db1c3cb2000 --- /dev/null +++ b/queue-6.6/tracing-fix-a-warning-when-allocating-buffered-event.patch @@ -0,0 +1,83 @@ +From babf3836136486e40f2fa3302d5dca692caa64e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 17:17:35 +0100 +Subject: tracing: Fix a warning when allocating buffered events fails + +From: Petr Pavlu + +[ Upstream commit 34209fe83ef8404353f91ab4ea4035dbc9922d04 ] + +Function trace_buffered_event_disable() produces an unexpected warning +when the previous call to trace_buffered_event_enable() fails to +allocate pages for buffered events. + +The situation can occur as follows: + +* The counter trace_buffered_event_ref is at 0. + +* The soft mode gets enabled for some event and + trace_buffered_event_enable() is called. The function increments + trace_buffered_event_ref to 1 and starts allocating event pages. + +* The allocation fails for some page and trace_buffered_event_disable() + is called for cleanup. + +* Function trace_buffered_event_disable() decrements + trace_buffered_event_ref back to 0, recognizes that it was the last + use of buffered events and frees all allocated pages. + +* The control goes back to trace_buffered_event_enable() which returns. + The caller of trace_buffered_event_enable() has no information that + the function actually failed. + +* Some time later, the soft mode is disabled for the same event. + Function trace_buffered_event_disable() is called. It warns on + "WARN_ON_ONCE(!trace_buffered_event_ref)" and returns. + +Buffered events are just an optimization and can handle failures. Make +trace_buffered_event_enable() exit on the first failure and left any +cleanup later to when trace_buffered_event_disable() is called. + +Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/ +Link: https://lkml.kernel.org/r/20231205161736.19663-3-petr.pavlu@suse.com + +Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") +Signed-off-by: Petr Pavlu +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index a40d6baf101f0..689d063dd2062 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2769,8 +2769,11 @@ void trace_buffered_event_enable(void) + for_each_tracing_cpu(cpu) { + page = alloc_pages_node(cpu_to_node(cpu), + GFP_KERNEL | __GFP_NORETRY, 0); +- if (!page) +- goto failed; ++ /* This is just an optimization and can handle failures */ ++ if (!page) { ++ pr_err("Failed to allocate event buffer\n"); ++ break; ++ } + + event = page_address(page); + memset(event, 0, sizeof(*event)); +@@ -2784,10 +2787,6 @@ void trace_buffered_event_enable(void) + WARN_ON_ONCE(1); + preempt_enable(); + } +- +- return; +- failed: +- trace_buffered_event_disable(); + } + + static void enable_trace_buffered_event(void *data) +-- +2.42.0 + -- 2.47.3