From f57f4391d09b68da2873e963693ec970215a37e0 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 25 Nov 2022 13:03:04 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...clude-asm-ptrace.h-in-syscall_wrappe.patch | 51 ++ ...do-not-issue-non-internal-commands-o.patch | 87 ++ ...ta-scsi-simplify-__ata_scsi_queuecmd.patch | 98 +++ ...ned-behavior-in-bit-shift-for-audit_.patch | 52 ++ ...ll-pointer-dereference-in-bfq_bio_bf.patch | 151 ++++ ...-fix-memory-leaks-when-changing-vlan.patch | 120 +++ ...v-notify-about-vlan-protocol-changes.patch | 100 +++ ...ng-the-realm-twice-when-decoding-sna.patch | 48 ++ ...te-snapshot-context-when-there-is-no.patch | 129 +++ ...t-assume-dual-mode-adaptors-support-.patch | 150 ++++ ...ation-quirks-add-quirk-for-acer-swit.patch | 43 + ...5611-simplify-io-callback-parameters.patch | 188 +++++ ...-ms5611-fixed-value-compensation-bug.patch | 173 ++++ ...s-pic32-treat-port-as-signed-integer.patch | 105 +++ ...-subsystem-nqn-quirk-for-micron-mtfd.patch | 37 + ...vme_quirk_bogus_nid-for-micron-nitro.patch | 35 + ...-do-coding-style-for-mux-route-struc.patch | 762 ++++++++++++++++++ ...-list-all-pins-in-a-possible-mux-rou.patch | 99 +++ ...chscreen_dmi-add-info-for-the-rca-ca.patch | 66 ++ ...c-report-real_dev-features-when-hw-o.patch | 114 +++ ...ot-add-missing-symbols-to-version-se.patch | 69 ++ ...ve-unleashed-add-pwm-controlled-leds.patch | 83 ++ ...d-path-failures-during-live-migratio.patch | 65 ++ ...make-the-read-capacity-response-comp.patch | 59 ++ ...ort_sas-fix-error-handling-in-sas_ph.patch | 77 ++ ...d-verifier-test-for-release_referenc.patch | 86 ++ queue-5.10/series | 33 + ...-generate-speakupmap.h-automatically.patch | 563 +++++++++++++ ...lace-utils-u_char-with-unsigned-char.patch | 46 ++ ...m32_spi_prepare_mbr-that-halves-spi-.patch | 51 ++ ...iro-do-not-assign-1-to-unsigned-char.patch | 75 ++ ...x-ack-frame-idr-leak-when-mesh-has-n.patch | 42 + ...x-memory-free-error-when-registering.patch | 53 ++ ...sim-fix-debugfs-attribute-ps-with-rc.patch | 57 ++ 34 files changed, 3967 insertions(+) create mode 100644 queue-5.10/arm64-syscall-include-asm-ptrace.h-in-syscall_wrappe.patch create mode 100644 queue-5.10/ata-libata-core-do-not-issue-non-internal-commands-o.patch create mode 100644 queue-5.10/ata-libata-scsi-simplify-__ata_scsi_queuecmd.patch create mode 100644 queue-5.10/audit-fix-undefined-behavior-in-bit-shift-for-audit_.patch create mode 100644 queue-5.10/block-bfq-fix-null-pointer-dereference-in-bfq_bio_bf.patch create mode 100644 queue-5.10/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch create mode 100644 queue-5.10/bridge-switchdev-notify-about-vlan-protocol-changes.patch create mode 100644 queue-5.10/ceph-avoid-putting-the-realm-twice-when-decoding-sna.patch create mode 100644 queue-5.10/ceph-do-not-update-snapshot-context-when-there-is-no.patch create mode 100644 queue-5.10/drm-display-don-t-assume-dual-mode-adaptors-support-.patch create mode 100644 queue-5.10/drm-panel-orientation-quirks-add-quirk-for-acer-swit.patch create mode 100644 queue-5.10/iio-ms5611-simplify-io-callback-parameters.patch create mode 100644 queue-5.10/iio-pressure-ms5611-fixed-value-compensation-bug.patch create mode 100644 queue-5.10/mips-pic32-treat-port-as-signed-integer.patch create mode 100644 queue-5.10/nvme-add-a-bogus-subsystem-nqn-quirk-for-micron-mtfd.patch create mode 100644 queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-micron-nitro.patch create mode 100644 queue-5.10/pinctrl-rockchip-do-coding-style-for-mux-route-struc.patch create mode 100644 queue-5.10/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch create mode 100644 queue-5.10/platform-x86-touchscreen_dmi-add-info-for-the-rca-ca.patch create mode 100644 queue-5.10/revert-net-macsec-report-real_dev-features-when-hw-o.patch create mode 100644 queue-5.10/risc-v-vdso-do-not-add-missing-symbols-to-version-se.patch create mode 100644 queue-5.10/riscv-dts-sifive-unleashed-add-pwm-controlled-leds.patch create mode 100644 queue-5.10/scsi-ibmvfc-avoid-path-failures-during-live-migratio.patch create mode 100644 queue-5.10/scsi-scsi_debug-make-the-read-capacity-response-comp.patch create mode 100644 queue-5.10/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch create mode 100644 queue-5.10/selftests-bpf-add-verifier-test-for-release_referenc.patch create mode 100644 queue-5.10/speakup-generate-speakupmap.h-automatically.patch create mode 100644 queue-5.10/speakup-replace-utils-u_char-with-unsigned-char.patch create mode 100644 queue-5.10/spi-stm32-fix-stm32_spi_prepare_mbr-that-halves-spi-.patch create mode 100644 queue-5.10/wifi-airo-do-not-assign-1-to-unsigned-char.patch create mode 100644 queue-5.10/wifi-mac80211-fix-ack-frame-idr-leak-when-mesh-has-n.patch create mode 100644 queue-5.10/wifi-mac80211-fix-memory-free-error-when-registering.patch create mode 100644 queue-5.10/wifi-mac80211_hwsim-fix-debugfs-attribute-ps-with-rc.patch diff --git a/queue-5.10/arm64-syscall-include-asm-ptrace.h-in-syscall_wrappe.patch b/queue-5.10/arm64-syscall-include-asm-ptrace.h-in-syscall_wrappe.patch new file mode 100644 index 00000000000..17a6ed45ebb --- /dev/null +++ b/queue-5.10/arm64-syscall-include-asm-ptrace.h-in-syscall_wrappe.patch @@ -0,0 +1,51 @@ +From 8e3087df5dbd69fc51d31f0f6ecd5433f669d00d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Oct 2022 14:57:28 -0700 +Subject: arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. + +From: Kuniyuki Iwashima + +[ Upstream commit acfc35cfcee5df419391671ef1a631f43feee4e3 ] + +Add the same change for ARM64 as done in the commit 9440c4294160 +("x86/syscall: Include asm/ptrace.h in syscall_wrapper header") to +make sure all syscalls see 'struct pt_regs' definition and resulted +BTF for '__arm64_sys_*(struct pt_regs *regs)' functions point to +actual struct. + +Without this patch, the BPF verifier refuses to load a tracing prog +which accesses pt_regs. + + bpf(BPF_PROG_LOAD, {prog_type=0x1a, ...}, 128) = -1 EACCES + +With this patch, we can see the correct error, which saves us time +in debugging the prog. + + bpf(BPF_PROG_LOAD, {prog_type=0x1a, ...}, 128) = 4 + bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name=NULL, prog_fd=4}}, 128) = -1 ENOTSUPP + +Signed-off-by: Kuniyuki Iwashima +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20221031215728.50389-1-kuniyu@amazon.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/syscall_wrapper.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/include/asm/syscall_wrapper.h b/arch/arm64/include/asm/syscall_wrapper.h +index b383b4802a7b..d30217c21eff 100644 +--- a/arch/arm64/include/asm/syscall_wrapper.h ++++ b/arch/arm64/include/asm/syscall_wrapper.h +@@ -8,7 +8,7 @@ + #ifndef __ASM_SYSCALL_WRAPPER_H + #define __ASM_SYSCALL_WRAPPER_H + +-struct pt_regs; ++#include + + #define SC_ARM64_REGS_TO_ARGS(x, ...) \ + __MAP(x,__SC_ARGS \ +-- +2.35.1 + diff --git a/queue-5.10/ata-libata-core-do-not-issue-non-internal-commands-o.patch b/queue-5.10/ata-libata-core-do-not-issue-non-internal-commands-o.patch new file mode 100644 index 00000000000..4545c515f58 --- /dev/null +++ b/queue-5.10/ata-libata-core-do-not-issue-non-internal-commands-o.patch @@ -0,0 +1,87 @@ +From a9e9dfabe1388872722b705812204d2132353962 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 00:15:34 +0100 +Subject: ata: libata-core: do not issue non-internal commands once EH is + pending + +From: Niklas Cassel + +[ Upstream commit e20e81a24a4d58744a29715aac2f795cd1651955 ] + +While the ATA specification states that a device should return command +aborted for all commands queued after the device has entered error state, +since ATA only keeps the sense data for the latest command (in non-NCQ +case), we really don't want to send block layer commands to the device +after it has entered error state. (Only ATA EH commands should be sent, +to read the sense data etc.) + +Currently, scsi_queue_rq() will check if scsi_host_in_recovery() +(state is SHOST_RECOVERY), and if so, it will _not_ issue a command via: +scsi_dispatch_cmd() -> host->hostt->queuecommand() (ata_scsi_queuecmd()) +-> __ata_scsi_queuecmd() -> ata_scsi_translate() -> ata_qc_issue() + +Before commit e494f6a72839 ("[SCSI] improved eh timeout handler"), +when receiving a TFES error IRQ, the call chain looked like this: +ahci_error_intr() -> ata_port_abort() -> ata_do_link_abort() -> +ata_qc_complete() -> ata_qc_schedule_eh() -> blk_abort_request() -> +blk_rq_timed_out() -> q->rq_timed_out_fn() (scsi_times_out()) -> +scsi_eh_scmd_add() -> scsi_host_set_state(shost, SHOST_RECOVERY) + +Which meant that as soon as an error IRQ was serviced, SHOST_RECOVERY +would be set. + +However, after commit e494f6a72839 ("[SCSI] improved eh timeout handler"), +scsi_times_out() will instead call scsi_abort_command() which will queue +delayed work, and the worker function scmd_eh_abort_handler() will call +scsi_eh_scmd_add(), which calls scsi_host_set_state(shost, SHOST_RECOVERY). + +So now, after the TFES error IRQ has been serviced, we need to wait for +the SCSI workqueue to run its work before SHOST_RECOVERY gets set. + +It is worth noting that, even before commit e494f6a72839 ("[SCSI] improved +eh timeout handler"), we could receive an error IRQ from the time when +scsi_queue_rq() checks scsi_host_in_recovery(), to the time when +ata_scsi_queuecmd() is actually called. + +In order to handle both the delayed setting of SHOST_RECOVERY and the +window where we can receive an error IRQ, add a check against +ATA_PFLAG_EH_PENDING (which gets set when servicing the error IRQ), +inside ata_scsi_queuecmd() itself, while holding the ap->lock. +(Since the ap->lock is held while servicing IRQs.) + +Fixes: e494f6a72839 ("[SCSI] improved eh timeout handler") +Signed-off-by: Niklas Cassel +Tested-by: John Garry +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-scsi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 70744439359d..f1755efd30a2 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -4032,9 +4032,19 @@ void ata_scsi_dump_cdb(struct ata_port *ap, struct scsi_cmnd *cmd) + + int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev) + { ++ struct ata_port *ap = dev->link->ap; + u8 scsi_op = scmd->cmnd[0]; + ata_xlat_func_t xlat_func; + ++ /* ++ * scsi_queue_rq() will defer commands if scsi_host_in_recovery(). ++ * However, this check is done without holding the ap->lock (a libata ++ * specific lock), so we can have received an error irq since then, ++ * therefore we must check if EH is pending, while holding ap->lock. ++ */ ++ if (ap->pflags & (ATA_PFLAG_EH_PENDING | ATA_PFLAG_EH_IN_PROGRESS)) ++ return SCSI_MLQUEUE_DEVICE_BUSY; ++ + if (unlikely(!scmd->cmd_len)) + goto bad_cdb_len; + +-- +2.35.1 + diff --git a/queue-5.10/ata-libata-scsi-simplify-__ata_scsi_queuecmd.patch b/queue-5.10/ata-libata-scsi-simplify-__ata_scsi_queuecmd.patch new file mode 100644 index 00000000000..32e20570ba9 --- /dev/null +++ b/queue-5.10/ata-libata-scsi-simplify-__ata_scsi_queuecmd.patch @@ -0,0 +1,98 @@ +From a6e1405100228a59d284646a52610ead563ae926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 19:13:54 -0500 +Subject: ata: libata-scsi: simplify __ata_scsi_queuecmd() + +From: Wenchao Hao + +[ Upstream commit 84eac327af543f03172085d5ef9f98ea25a51191 ] + +This patch cleans up the code of __ata_scsi_queuecmd(). Since each +branch of the "if" condition check that scmd->cmd_len is not zero, move +this check out of the "if" to simplify the conditions being checked in +the "else" branch. + +While at it, avoid the if-else-if-else structure using if-else if +structure and remove the redundant rc local variable. + +This patch does not change the function logic. + +Signed-off-by: Wenchao Hao +Signed-off-by: Damien Le Moal +Stable-dep-of: e20e81a24a4d ("ata: libata-core: do not issue non-internal commands once EH is pending") +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-scsi.c | 45 ++++++++++++++++++--------------------- + 1 file changed, 21 insertions(+), 24 deletions(-) + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 459ece666c62..70744439359d 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -4034,42 +4034,39 @@ int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev) + { + u8 scsi_op = scmd->cmnd[0]; + ata_xlat_func_t xlat_func; +- int rc = 0; ++ ++ if (unlikely(!scmd->cmd_len)) ++ goto bad_cdb_len; + + if (dev->class == ATA_DEV_ATA || dev->class == ATA_DEV_ZAC) { +- if (unlikely(!scmd->cmd_len || scmd->cmd_len > dev->cdb_len)) ++ if (unlikely(scmd->cmd_len > dev->cdb_len)) + goto bad_cdb_len; + + xlat_func = ata_get_xlat_func(dev, scsi_op); +- } else { +- if (unlikely(!scmd->cmd_len)) +- goto bad_cdb_len; ++ } else if (likely((scsi_op != ATA_16) || !atapi_passthru16)) { ++ /* relay SCSI command to ATAPI device */ ++ int len = COMMAND_SIZE(scsi_op); + +- xlat_func = NULL; +- if (likely((scsi_op != ATA_16) || !atapi_passthru16)) { +- /* relay SCSI command to ATAPI device */ +- int len = COMMAND_SIZE(scsi_op); +- if (unlikely(len > scmd->cmd_len || +- len > dev->cdb_len || +- scmd->cmd_len > ATAPI_CDB_LEN)) +- goto bad_cdb_len; ++ if (unlikely(len > scmd->cmd_len || ++ len > dev->cdb_len || ++ scmd->cmd_len > ATAPI_CDB_LEN)) ++ goto bad_cdb_len; + +- xlat_func = atapi_xlat; +- } else { +- /* ATA_16 passthru, treat as an ATA command */ +- if (unlikely(scmd->cmd_len > 16)) +- goto bad_cdb_len; ++ xlat_func = atapi_xlat; ++ } else { ++ /* ATA_16 passthru, treat as an ATA command */ ++ if (unlikely(scmd->cmd_len > 16)) ++ goto bad_cdb_len; + +- xlat_func = ata_get_xlat_func(dev, scsi_op); +- } ++ xlat_func = ata_get_xlat_func(dev, scsi_op); + } + + if (xlat_func) +- rc = ata_scsi_translate(dev, scmd, xlat_func); +- else +- ata_scsi_simulate(dev, scmd); ++ return ata_scsi_translate(dev, scmd, xlat_func); + +- return rc; ++ ata_scsi_simulate(dev, scmd); ++ ++ return 0; + + bad_cdb_len: + DPRINTK("bad CDB len=%u, scsi_op=0x%02x, max=%u\n", +-- +2.35.1 + diff --git a/queue-5.10/audit-fix-undefined-behavior-in-bit-shift-for-audit_.patch b/queue-5.10/audit-fix-undefined-behavior-in-bit-shift-for-audit_.patch new file mode 100644 index 00000000000..f8c9ee1ece9 --- /dev/null +++ b/queue-5.10/audit-fix-undefined-behavior-in-bit-shift-for-audit_.patch @@ -0,0 +1,52 @@ +From da48ab9b9454525992586166403b626140a6db7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Oct 2022 10:10:21 +0800 +Subject: audit: fix undefined behavior in bit shift for AUDIT_BIT + +From: Gaosheng Cui + +[ Upstream commit 986d93f55bdeab1cac858d1e47b41fac10b2d7f6 ] + +Shifting signed 32-bit value by 31 bits is undefined, so changing +significant bit to unsigned. The UBSAN warning calltrace like below: + +UBSAN: shift-out-of-bounds in kernel/auditfilter.c:179:23 +left shift of 1 by 31 places cannot be represented in type 'int' +Call Trace: + + dump_stack_lvl+0x7d/0xa5 + dump_stack+0x15/0x1b + ubsan_epilogue+0xe/0x4e + __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c + audit_register_class+0x9d/0x137 + audit_classes_init+0x4d/0xb8 + do_one_initcall+0x76/0x430 + kernel_init_freeable+0x3b3/0x422 + kernel_init+0x24/0x1e0 + ret_from_fork+0x1f/0x30 + + +Signed-off-by: Gaosheng Cui +[PM: remove bad 'Fixes' tag as issue predates git, added in v2.6.6-rc1] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + include/uapi/linux/audit.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h +index cd2d8279a5e4..cb4e8e6e86a9 100644 +--- a/include/uapi/linux/audit.h ++++ b/include/uapi/linux/audit.h +@@ -182,7 +182,7 @@ + #define AUDIT_MAX_KEY_LEN 256 + #define AUDIT_BITMASK_SIZE 64 + #define AUDIT_WORD(nr) ((__u32)((nr)/32)) +-#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32)) ++#define AUDIT_BIT(nr) (1U << ((nr) - AUDIT_WORD(nr)*32)) + + #define AUDIT_SYSCALL_CLASSES 16 + #define AUDIT_CLASS_DIR_WRITE 0 +-- +2.35.1 + diff --git a/queue-5.10/block-bfq-fix-null-pointer-dereference-in-bfq_bio_bf.patch b/queue-5.10/block-bfq-fix-null-pointer-dereference-in-bfq_bio_bf.patch new file mode 100644 index 00000000000..ec3df1e7cad --- /dev/null +++ b/queue-5.10/block-bfq-fix-null-pointer-dereference-in-bfq_bio_bf.patch @@ -0,0 +1,151 @@ +From 86eba5138ccd2cc0ef78c2af6f3a4a298db12b43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 18:34:34 +0800 +Subject: block, bfq: fix null pointer dereference in bfq_bio_bfqg() + +From: Yu Kuai + +[ Upstream commit f02be9002c480cd3ec0fcf184ad27cf531bd6ece ] + +Out test found a following problem in kernel 5.10, and the same problem +should exist in mainline: + +BUG: kernel NULL pointer dereference, address: 0000000000000094 +PGD 0 P4D 0 +Oops: 0000 [#1] SMP +CPU: 7 PID: 155 Comm: kworker/7:1 Not tainted 5.10.0-01932-g19e0ace2ca1d-dirty 4 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-b4 +Workqueue: kthrotld blk_throtl_dispatch_work_fn +RIP: 0010:bfq_bio_bfqg+0x52/0xc0 +Code: 94 00 00 00 00 75 2e 48 8b 40 30 48 83 05 35 06 c8 0b 01 48 85 c0 74 3d 4b +RSP: 0018:ffffc90001a1fba0 EFLAGS: 00010002 +RAX: ffff888100d60400 RBX: ffff8881132e7000 RCX: 0000000000000000 +RDX: 0000000000000017 RSI: ffff888103580a18 RDI: ffff888103580a18 +RBP: ffff8881132e7000 R08: 0000000000000000 R09: ffffc90001a1fe10 +R10: 0000000000000a20 R11: 0000000000034320 R12: 0000000000000000 +R13: ffff888103580a18 R14: ffff888114447000 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff88881fdc0000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000094 CR3: 0000000100cdb000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + bfq_bic_update_cgroup+0x3c/0x350 + ? ioc_create_icq+0x42/0x270 + bfq_init_rq+0xfd/0x1060 + bfq_insert_requests+0x20f/0x1cc0 + ? ioc_create_icq+0x122/0x270 + blk_mq_sched_insert_requests+0x86/0x1d0 + blk_mq_flush_plug_list+0x193/0x2a0 + blk_flush_plug_list+0x127/0x170 + blk_finish_plug+0x31/0x50 + blk_throtl_dispatch_work_fn+0x151/0x190 + process_one_work+0x27c/0x5f0 + worker_thread+0x28b/0x6b0 + ? rescuer_thread+0x590/0x590 + kthread+0x153/0x1b0 + ? kthread_flush_work+0x170/0x170 + ret_from_fork+0x1f/0x30 +Modules linked in: +CR2: 0000000000000094 +---[ end trace e2e59ac014314547 ]--- +RIP: 0010:bfq_bio_bfqg+0x52/0xc0 +Code: 94 00 00 00 00 75 2e 48 8b 40 30 48 83 05 35 06 c8 0b 01 48 85 c0 74 3d 4b +RSP: 0018:ffffc90001a1fba0 EFLAGS: 00010002 +RAX: ffff888100d60400 RBX: ffff8881132e7000 RCX: 0000000000000000 +RDX: 0000000000000017 RSI: ffff888103580a18 RDI: ffff888103580a18 +RBP: ffff8881132e7000 R08: 0000000000000000 R09: ffffc90001a1fe10 +R10: 0000000000000a20 R11: 0000000000034320 R12: 0000000000000000 +R13: ffff888103580a18 R14: ffff888114447000 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff88881fdc0000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000094 CR3: 0000000100cdb000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + +Root cause is quite complex: + +1) use bfq elevator for the test device. +2) create a cgroup CG +3) config blk throtl in CG + + blkg_conf_prep + blkg_create + +4) create a thread T1 and issue async io in CG: + + bio_init + bio_associate_blkg + ... + submit_bio + submit_bio_noacct + blk_throtl_bio -> io is throttled + // io submit is done + +5) switch elevator: + + bfq_exit_queue + blkcg_deactivate_policy + list_for_each_entry(blkg, &q->blkg_list, q_node) + blkg->pd[] = NULL + // bfq policy is removed + +5) thread t1 exist, then remove the cgroup CG: + + blkcg_unpin_online + blkcg_destroy_blkgs + blkg_destroy + list_del_init(&blkg->q_node) + // blkg is removed from queue list + +6) switch elevator back to bfq + + bfq_init_queue + bfq_create_group_hierarchy + blkcg_activate_policy + list_for_each_entry_reverse(blkg, &q->blkg_list) + // blkg is removed from list, hence bfq policy is still NULL + +7) throttled io is dispatched to bfq: + + bfq_insert_requests + bfq_init_rq + bfq_bic_update_cgroup + bfq_bio_bfqg + bfqg = blkg_to_bfqg(blkg) + // bfqg is NULL because bfq policy is NULL + +The problem is only possible in bfq because only bfq can be deactivated and +activated while queue is online, while others can only be deactivated while +the device is removed. + +Fix the problem in bfq by checking if blkg is online before calling +blkg_to_bfqg(). + +Signed-off-by: Yu Kuai +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20221108103434.2853269-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index be6733558b83..badb90352bf3 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -611,6 +611,10 @@ struct bfq_group *bfq_bio_bfqg(struct bfq_data *bfqd, struct bio *bio) + struct bfq_group *bfqg; + + while (blkg) { ++ if (!blkg->online) { ++ blkg = blkg->parent; ++ continue; ++ } + bfqg = blkg_to_bfqg(blkg); + if (bfqg->online) { + bio_associate_blkg_from_css(bio, &blkg->blkcg->css); +-- +2.35.1 + diff --git a/queue-5.10/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch b/queue-5.10/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch new file mode 100644 index 00000000000..28f337e8e07 --- /dev/null +++ b/queue-5.10/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch @@ -0,0 +1,120 @@ +From 498f7cdac6e9005e0ce230c18566084dd4cd0f85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 10:45:09 +0200 +Subject: bridge: switchdev: Fix memory leaks when changing VLAN protocol + +From: Ido Schimmel + +[ Upstream commit 9d45921ee4cb364910097e7d1b7558559c2f9fd2 ] + +The bridge driver can offload VLANs to the underlying hardware either +via switchdev or the 8021q driver. When the former is used, the VLAN is +marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV' +private flag. + +To avoid the memory leaks mentioned in the cited commit, the bridge +driver will try to delete a VLAN via the 8021q driver if the VLAN is not +marked with the previously mentioned flag. + +When the VLAN protocol of the bridge changes, switchdev drivers are +notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but +the 8021q driver is also called to add the existing VLANs with the new +protocol and delete them with the old protocol. + +In case the VLANs were offloaded via switchdev, the above behavior is +both redundant and buggy. Redundant because the VLANs are already +programmed in hardware and drivers that support VLAN protocol change +(currently only mlx5) change the protocol upon the switchdev attribute +notification. Buggy because the 8021q driver is called despite these +VLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to +memory leaks [1] when the VLANs are deleted. + +Fix by not calling the 8021q driver for VLANs that were already +programmed via switchdev. + +[1] +unreferenced object 0xffff8881f6771200 (size 256): + comm "ip", pid 446855, jiffies 4298238841 (age 55.240s) + hex dump (first 32 bytes): + 00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000012819ac>] vlan_vid_add+0x437/0x750 + [<00000000f2281fad>] __br_vlan_set_proto+0x289/0x920 + [<000000000632b56f>] br_changelink+0x3d6/0x13f0 + [<0000000089d25f04>] __rtnl_newlink+0x8ae/0x14c0 + [<00000000f6276baf>] rtnl_newlink+0x5f/0x90 + [<00000000746dc902>] rtnetlink_rcv_msg+0x336/0xa00 + [<000000001c2241c0>] netlink_rcv_skb+0x11d/0x340 + [<0000000010588814>] netlink_unicast+0x438/0x710 + [<00000000e1a4cd5c>] netlink_sendmsg+0x788/0xc40 + [<00000000e8992d4e>] sock_sendmsg+0xb0/0xe0 + [<00000000621b8f91>] ____sys_sendmsg+0x4ff/0x6d0 + [<000000000ea26996>] ___sys_sendmsg+0x12e/0x1b0 + [<00000000684f7e25>] __sys_sendmsg+0xab/0x130 + [<000000004538b104>] do_syscall_64+0x3d/0x90 + [<0000000091ed9678>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 279737939a81 ("net: bridge: Fix VLANs memory leak") +Reported-by: Vlad Buslov +Tested-by: Vlad Buslov +Signed-off-by: Ido Schimmel +Acked-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20221114084509.860831-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 7e5968e7aad5..1dc5db07650c 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -878,6 +878,8 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto) + list_for_each_entry(p, &br->port_list, list) { + vg = nbp_vlan_group(p); + list_for_each_entry(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + err = vlan_vid_add(p->dev, proto, vlan->vid); + if (err) + goto err_filt; +@@ -892,8 +894,11 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto) + /* Delete VLANs for the old proto from the device filter. */ + list_for_each_entry(p, &br->port_list, list) { + vg = nbp_vlan_group(p); +- list_for_each_entry(vlan, &vg->vlan_list, vlist) ++ list_for_each_entry(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + vlan_vid_del(p->dev, oldproto, vlan->vid); ++ } + } + + return 0; +@@ -902,13 +907,19 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto) + attr.u.vlan_protocol = ntohs(oldproto); + switchdev_port_attr_set(br->dev, &attr); + +- list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) ++ list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + vlan_vid_del(p->dev, proto, vlan->vid); ++ } + + list_for_each_entry_continue_reverse(p, &br->port_list, list) { + vg = nbp_vlan_group(p); +- list_for_each_entry(vlan, &vg->vlan_list, vlist) ++ list_for_each_entry(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + vlan_vid_del(p->dev, proto, vlan->vid); ++ } + } + + return err; +-- +2.35.1 + diff --git a/queue-5.10/bridge-switchdev-notify-about-vlan-protocol-changes.patch b/queue-5.10/bridge-switchdev-notify-about-vlan-protocol-changes.patch new file mode 100644 index 00000000000..c2b3c165557 --- /dev/null +++ b/queue-5.10/bridge-switchdev-notify-about-vlan-protocol-changes.patch @@ -0,0 +1,100 @@ +From 451c2076e401ed4a2ba30109f3f1ba06d11a98f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 14:54:05 +0200 +Subject: bridge: switchdev: Notify about VLAN protocol changes + +From: Danielle Ratson + +[ Upstream commit 22ec19f3aee327806c37c9fa1188741574bc6445 ] + +Drivers that support bridge offload need to be notified about changes to +the bridge's VLAN protocol so that they could react accordingly and +potentially veto the change. + +Add a new switchdev attribute to communicate the change to drivers. + +Signed-off-by: Danielle Ratson +Reviewed-by: Petr Machata +Acked-by: Nikolay Aleksandrov +Signed-off-by: Ido Schimmel +Reviewed-by: Ivan Vecera +Signed-off-by: Jakub Kicinski +Stable-dep-of: 9d45921ee4cb ("bridge: switchdev: Fix memory leaks when changing VLAN protocol") +Signed-off-by: Sasha Levin +--- + include/net/switchdev.h | 2 ++ + net/bridge/br_vlan.c | 16 ++++++++++++++-- + 2 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/include/net/switchdev.h b/include/net/switchdev.h +index 8528015590e4..afdf8bd1b4fe 100644 +--- a/include/net/switchdev.h ++++ b/include/net/switchdev.h +@@ -38,6 +38,7 @@ enum switchdev_attr_id { + SWITCHDEV_ATTR_ID_PORT_MROUTER, + SWITCHDEV_ATTR_ID_BRIDGE_AGEING_TIME, + SWITCHDEV_ATTR_ID_BRIDGE_VLAN_FILTERING, ++ SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL, + SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED, + SWITCHDEV_ATTR_ID_BRIDGE_MROUTER, + #if IS_ENABLED(CONFIG_BRIDGE_MRP) +@@ -57,6 +58,7 @@ struct switchdev_attr { + bool mrouter; /* PORT_MROUTER */ + clock_t ageing_time; /* BRIDGE_AGEING_TIME */ + bool vlan_filtering; /* BRIDGE_VLAN_FILTERING */ ++ u16 vlan_protocol; /* BRIDGE_VLAN_PROTOCOL */ + bool mc_disabled; /* MC_DISABLED */ + #if IS_ENABLED(CONFIG_BRIDGE_MRP) + u8 mrp_port_role; /* MRP_PORT_ROLE */ +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 852f4b54e881..7e5968e7aad5 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -855,15 +855,25 @@ EXPORT_SYMBOL_GPL(br_vlan_get_proto); + + int __br_vlan_set_proto(struct net_bridge *br, __be16 proto) + { ++ struct switchdev_attr attr = { ++ .orig_dev = br->dev, ++ .id = SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL, ++ .flags = SWITCHDEV_F_SKIP_EOPNOTSUPP, ++ .u.vlan_protocol = ntohs(proto), ++ }; + int err = 0; + struct net_bridge_port *p; + struct net_bridge_vlan *vlan; + struct net_bridge_vlan_group *vg; +- __be16 oldproto; ++ __be16 oldproto = br->vlan_proto; + + if (br->vlan_proto == proto) + return 0; + ++ err = switchdev_port_attr_set(br->dev, &attr); ++ if (err && err != -EOPNOTSUPP) ++ return err; ++ + /* Add VLANs for the new proto to the device filter. */ + list_for_each_entry(p, &br->port_list, list) { + vg = nbp_vlan_group(p); +@@ -874,7 +884,6 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto) + } + } + +- oldproto = br->vlan_proto; + br->vlan_proto = proto; + + recalculate_group_addr(br); +@@ -890,6 +899,9 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto) + return 0; + + err_filt: ++ attr.u.vlan_protocol = ntohs(oldproto); ++ switchdev_port_attr_set(br->dev, &attr); ++ + list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) + vlan_vid_del(p->dev, proto, vlan->vid); + +-- +2.35.1 + diff --git a/queue-5.10/ceph-avoid-putting-the-realm-twice-when-decoding-sna.patch b/queue-5.10/ceph-avoid-putting-the-realm-twice-when-decoding-sna.patch new file mode 100644 index 00000000000..fb3b06a8896 --- /dev/null +++ b/queue-5.10/ceph-avoid-putting-the-realm-twice-when-decoding-sna.patch @@ -0,0 +1,48 @@ +From 2f632ddcb530088264b0cadf695c73bf823bb6c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 11:00:39 +0800 +Subject: ceph: avoid putting the realm twice when decoding snaps fails + +From: Xiubo Li + +[ Upstream commit 51884d153f7ec85e18d607b2467820a90e0f4359 ] + +When decoding the snaps fails it maybe leaving the 'first_realm' +and 'realm' pointing to the same snaprealm memory. And then it'll +put it twice and could cause random use-after-free, BUG_ON, etc +issues. + +Cc: stable@vger.kernel.org +Link: https://tracker.ceph.com/issues/57686 +Signed-off-by: Xiubo Li +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/snap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c +index e779f0e2bdb8..734873be56a7 100644 +--- a/fs/ceph/snap.c ++++ b/fs/ceph/snap.c +@@ -697,7 +697,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, + struct ceph_mds_snap_realm *ri; /* encoded */ + __le64 *snaps; /* encoded */ + __le64 *prior_parent_snaps; /* encoded */ +- struct ceph_snap_realm *realm = NULL; ++ struct ceph_snap_realm *realm; + struct ceph_snap_realm *first_realm = NULL; + struct ceph_snap_realm *realm_to_rebuild = NULL; + int rebuild_snapcs; +@@ -708,6 +708,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, + + dout("update_snap_trace deletion=%d\n", deletion); + more: ++ realm = NULL; + rebuild_snapcs = 0; + ceph_decode_need(&p, e, sizeof(*ri), bad); + ri = p; +-- +2.35.1 + diff --git a/queue-5.10/ceph-do-not-update-snapshot-context-when-there-is-no.patch b/queue-5.10/ceph-do-not-update-snapshot-context-when-there-is-no.patch new file mode 100644 index 00000000000..048716a62a6 --- /dev/null +++ b/queue-5.10/ceph-do-not-update-snapshot-context-when-there-is-no.patch @@ -0,0 +1,129 @@ +From e8b13c2dcf2b8961b0401a794ad3b7a6d57db5ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Feb 2022 14:28:33 +0800 +Subject: ceph: do not update snapshot context when there is no new snapshot + +From: Xiubo Li + +[ Upstream commit 2e586641c950e7f3e7e008404bd783a466b9b590 ] + +We will only track the uppest parent snapshot realm from which we +need to rebuild the snapshot contexts _downward_ in hierarchy. For +all the others having no new snapshot we will do nothing. + +This fix will avoid calling ceph_queue_cap_snap() on some inodes +inappropriately. For example, with the code in mainline, suppose there +are 2 directory hierarchies (with 6 directories total), like this: + +/dir_X1/dir_X2/dir_X3/ +/dir_Y1/dir_Y2/dir_Y3/ + +Firstly, make a snapshot under /dir_X1/dir_X2/.snap/snap_X2, then make a +root snapshot under /.snap/root_snap. Every time we make snapshots under +/dir_Y1/..., the kclient will always try to rebuild the snap context for +snap_X2 realm and finally will always try to queue cap snaps for dir_Y2 +and dir_Y3, which makes no sense. + +That's because the snap_X2's seq is 2 and root_snap's seq is 3. So when +creating a new snapshot under /dir_Y1/... the new seq will be 4, and +the mds will send the kclient a snapshot backtrace in _downward_ +order: seqs 4, 3. + +When ceph_update_snap_trace() is called, it will always rebuild the from +the last realm, that's the root_snap. So later when rebuilding the snap +context, the current logic will always cause it to rebuild the snap_X2 +realm and then try to queue cap snaps for all the inodes related in that +realm, even though it's not necessary. + +This is accompanied by a lot of these sorts of dout messages: + + "ceph: queue_cap_snap 00000000a42b796b nothing dirty|writing" + +Fix the logic to avoid this situation. + +Also, the 'invalidate' word is not precise here. In actuality, it will +cause a rebuild of the existing snapshot contexts or just build +non-existent ones. Rename it to 'rebuild_snapcs'. + +URL: https://tracker.ceph.com/issues/44100 +Signed-off-by: Xiubo Li +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Stable-dep-of: 51884d153f7e ("ceph: avoid putting the realm twice when decoding snaps fails") +Signed-off-by: Sasha Levin +--- + fs/ceph/snap.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c +index 0369f672a76f..e779f0e2bdb8 100644 +--- a/fs/ceph/snap.c ++++ b/fs/ceph/snap.c +@@ -699,7 +699,8 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, + __le64 *prior_parent_snaps; /* encoded */ + struct ceph_snap_realm *realm = NULL; + struct ceph_snap_realm *first_realm = NULL; +- int invalidate = 0; ++ struct ceph_snap_realm *realm_to_rebuild = NULL; ++ int rebuild_snapcs; + int err = -ENOMEM; + LIST_HEAD(dirty_realms); + +@@ -707,6 +708,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, + + dout("update_snap_trace deletion=%d\n", deletion); + more: ++ rebuild_snapcs = 0; + ceph_decode_need(&p, e, sizeof(*ri), bad); + ri = p; + p += sizeof(*ri); +@@ -730,7 +732,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, + err = adjust_snap_realm_parent(mdsc, realm, le64_to_cpu(ri->parent)); + if (err < 0) + goto fail; +- invalidate += err; ++ rebuild_snapcs += err; + + if (le64_to_cpu(ri->seq) > realm->seq) { + dout("update_snap_trace updating %llx %p %lld -> %lld\n", +@@ -755,22 +757,30 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, + if (realm->seq > mdsc->last_snap_seq) + mdsc->last_snap_seq = realm->seq; + +- invalidate = 1; ++ rebuild_snapcs = 1; + } else if (!realm->cached_context) { + dout("update_snap_trace %llx %p seq %lld new\n", + realm->ino, realm, realm->seq); +- invalidate = 1; ++ rebuild_snapcs = 1; + } else { + dout("update_snap_trace %llx %p seq %lld unchanged\n", + realm->ino, realm, realm->seq); + } + +- dout("done with %llx %p, invalidated=%d, %p %p\n", realm->ino, +- realm, invalidate, p, e); ++ dout("done with %llx %p, rebuild_snapcs=%d, %p %p\n", realm->ino, ++ realm, rebuild_snapcs, p, e); + +- /* invalidate when we reach the _end_ (root) of the trace */ +- if (invalidate && p >= e) +- rebuild_snap_realms(realm, &dirty_realms); ++ /* ++ * this will always track the uppest parent realm from which ++ * we need to rebuild the snapshot contexts _downward_ in ++ * hierarchy. ++ */ ++ if (rebuild_snapcs) ++ realm_to_rebuild = realm; ++ ++ /* rebuild_snapcs when we reach the _end_ (root) of the trace */ ++ if (realm_to_rebuild && p >= e) ++ rebuild_snap_realms(realm_to_rebuild, &dirty_realms); + + if (!first_realm) + first_realm = realm; +-- +2.35.1 + diff --git a/queue-5.10/drm-display-don-t-assume-dual-mode-adaptors-support-.patch b/queue-5.10/drm-display-don-t-assume-dual-mode-adaptors-support-.patch new file mode 100644 index 00000000000..341b6d8676d --- /dev/null +++ b/queue-5.10/drm-display-don-t-assume-dual-mode-adaptors-support-.patch @@ -0,0 +1,150 @@ +From 1b75f43bc92b10abac696822dda3bc6a610d8199 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 11:33:14 +0200 +Subject: drm/display: Don't assume dual mode adaptors support i2c + sub-addressing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Simon Rettberg + +[ Upstream commit 5954acbacbd1946b96ce8ee799d309cb0cd3cb9d ] + +Current dual mode adaptor ("DP++") detection code assumes that all +adaptors support i2c sub-addressing for read operations from the +DP-HDMI adaptor ID buffer. It has been observed that multiple +adaptors do not in fact support this, and always return data starting +at register 0. On affected adaptors, the code fails to read the proper +registers that would identify the device as a type 2 adaptor, and +handles those as type 1, limiting the TMDS clock to 165MHz, even if +the according register would announce a higher TMDS clock. +Fix this by always reading the ID buffer starting from offset 0, and +discarding any bytes before the actual offset of interest. + +We tried finding authoritative documentation on whether or not this is +allowed behaviour, but since all the official VESA docs are paywalled, +the best we could come up with was the spec sheet for Texas Instruments' +SNx5DP149 chip family.[1] It explicitly mentions that sub-addressing is +supported for register writes, but *not* for reads (See NOTE in +section 8.5.3). Unless TI openly decided to violate the VESA spec, one +could take that as a hint that sub-addressing is in fact not mandated +by VESA. +The other two adaptors affected used the PS8409(A) and the LT8611, +according to the data returned from their ID buffers. + +[1] https://www.ti.com/lit/ds/symlink/sn75dp149.pdf + +Cc: stable@vger.kernel.org +Signed-off-by: Simon Rettberg +Reviewed-by: Rafael Gieschke +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221006113314.41101987@computer +Acked-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_dp_dual_mode_helper.c | 51 +++++++++++++---------- + 1 file changed, 29 insertions(+), 22 deletions(-) + +diff --git a/drivers/gpu/drm/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/drm_dp_dual_mode_helper.c +index 1c9ea9f7fdaf..f2ff0bfdf54d 100644 +--- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c ++++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c +@@ -62,23 +62,45 @@ + ssize_t drm_dp_dual_mode_read(struct i2c_adapter *adapter, + u8 offset, void *buffer, size_t size) + { ++ u8 zero = 0; ++ char *tmpbuf = NULL; ++ /* ++ * As sub-addressing is not supported by all adaptors, ++ * always explicitly read from the start and discard ++ * any bytes that come before the requested offset. ++ * This way, no matter whether the adaptor supports it ++ * or not, we'll end up reading the proper data. ++ */ + struct i2c_msg msgs[] = { + { + .addr = DP_DUAL_MODE_SLAVE_ADDRESS, + .flags = 0, + .len = 1, +- .buf = &offset, ++ .buf = &zero, + }, + { + .addr = DP_DUAL_MODE_SLAVE_ADDRESS, + .flags = I2C_M_RD, +- .len = size, ++ .len = size + offset, + .buf = buffer, + }, + }; + int ret; + ++ if (offset) { ++ tmpbuf = kmalloc(size + offset, GFP_KERNEL); ++ if (!tmpbuf) ++ return -ENOMEM; ++ ++ msgs[1].buf = tmpbuf; ++ } ++ + ret = i2c_transfer(adapter, msgs, ARRAY_SIZE(msgs)); ++ if (tmpbuf) ++ memcpy(buffer, tmpbuf + offset, size); ++ ++ kfree(tmpbuf); ++ + if (ret < 0) + return ret; + if (ret != ARRAY_SIZE(msgs)) +@@ -205,18 +227,6 @@ enum drm_dp_dual_mode_type drm_dp_dual_mode_detect(struct i2c_adapter *adapter) + if (ret) + return DRM_DP_DUAL_MODE_UNKNOWN; + +- /* +- * Sigh. Some (maybe all?) type 1 adaptors are broken and ack +- * the offset but ignore it, and instead they just always return +- * data from the start of the HDMI ID buffer. So for a broken +- * type 1 HDMI adaptor a single byte read will always give us +- * 0x44, and for a type 1 DVI adaptor it should give 0x00 +- * (assuming it implements any registers). Fortunately neither +- * of those values will match the type 2 signature of the +- * DP_DUAL_MODE_ADAPTOR_ID register so we can proceed with +- * the type 2 adaptor detection safely even in the presence +- * of broken type 1 adaptors. +- */ + ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_ADAPTOR_ID, + &adaptor_id, sizeof(adaptor_id)); + DRM_DEBUG_KMS("DP dual mode adaptor ID: %02x (err %zd)\n", +@@ -231,11 +241,10 @@ enum drm_dp_dual_mode_type drm_dp_dual_mode_detect(struct i2c_adapter *adapter) + return DRM_DP_DUAL_MODE_TYPE2_DVI; + } + /* +- * If neither a proper type 1 ID nor a broken type 1 adaptor +- * as described above, assume type 1, but let the user know +- * that we may have misdetected the type. ++ * If not a proper type 1 ID, still assume type 1, but let ++ * the user know that we may have misdetected the type. + */ +- if (!is_type1_adaptor(adaptor_id) && adaptor_id != hdmi_id[0]) ++ if (!is_type1_adaptor(adaptor_id)) + DRM_ERROR("Unexpected DP dual mode adaptor ID %02x\n", + adaptor_id); + +@@ -339,10 +348,8 @@ EXPORT_SYMBOL(drm_dp_dual_mode_get_tmds_output); + * @enable: enable (as opposed to disable) the TMDS output buffers + * + * Set the state of the TMDS output buffers in the adaptor. For +- * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register. As +- * some type 1 adaptors have problems with registers (see comments +- * in drm_dp_dual_mode_detect()) we avoid touching the register, +- * making this function a no-op on type 1 adaptors. ++ * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register. ++ * Type1 adaptors do not support any register writes. + * + * Returns: + * 0 on success, negative error code on failure +-- +2.35.1 + diff --git a/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-acer-swit.patch b/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-acer-swit.patch new file mode 100644 index 00000000000..6b70fe2fbe1 --- /dev/null +++ b/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-acer-swit.patch @@ -0,0 +1,43 @@ +From 1531ac67f271b222396f07c715a47ecdcc6325bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Nov 2022 22:50:52 +0100 +Subject: drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 + (SW5-017) + +From: Hans de Goede + +[ Upstream commit 653f2d94fcda200b02bd79cea2e0307b26c1b747 ] + +Like the Acer Switch One 10 S1003, for which there already is a quirk, +the Acer Switch V 10 (SW5-017) has a 800x1280 portrait screen mounted +in the tablet part of a landscape oriented 2-in-1. Add a quirk for this. + +Cc: Rudolf Polzer +Signed-off-by: Hans de Goede +Acked-by: Simon Ser +Link: https://patchwork.freedesktop.org/patch/msgid/20221106215052.66995-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 083273736c83..ca0fefeaab20 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -128,6 +128,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* Acer Switch V 10 (SW5-017) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Anbernic Win600 */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Anbernic"), +-- +2.35.1 + diff --git a/queue-5.10/iio-ms5611-simplify-io-callback-parameters.patch b/queue-5.10/iio-ms5611-simplify-io-callback-parameters.patch new file mode 100644 index 00000000000..68602dac966 --- /dev/null +++ b/queue-5.10/iio-ms5611-simplify-io-callback-parameters.patch @@ -0,0 +1,188 @@ +From ee78b565e594be2b51d3cbd9096857dc18649913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 16:21:10 +0200 +Subject: iio: ms5611: Simplify IO callback parameters + +From: Lars-Peter Clausen + +[ Upstream commit dc19fa63ad80a636fdbc1a02153d1ab140cb901f ] + +The ms5611 passes &indio_dev->dev as a parameter to all its IO callbacks +only to directly cast the struct device back to struct iio_dev. And the +struct iio_dev is then only used to get the drivers state struct. + +Simplify this a bit by passing the state struct directly. This makes it a +bit easier to follow what the code is doing. + +Signed-off-by: Lars-Peter Clausen +Link: https://lore.kernel.org/r/20211020142110.7060-1-lars@metafoo.de +Signed-off-by: Jonathan Cameron +Stable-dep-of: 17f442e7e475 ("iio: pressure: ms5611: fixed value compensation bug") +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/ms5611.h | 6 +++--- + drivers/iio/pressure/ms5611_core.c | 7 +++---- + drivers/iio/pressure/ms5611_i2c.c | 11 ++++------- + drivers/iio/pressure/ms5611_spi.c | 17 +++++++---------- + 4 files changed, 17 insertions(+), 24 deletions(-) + +diff --git a/drivers/iio/pressure/ms5611.h b/drivers/iio/pressure/ms5611.h +index bc06271fa38b..345f3902e3e3 100644 +--- a/drivers/iio/pressure/ms5611.h ++++ b/drivers/iio/pressure/ms5611.h +@@ -50,9 +50,9 @@ struct ms5611_state { + const struct ms5611_osr *pressure_osr; + const struct ms5611_osr *temp_osr; + +- int (*reset)(struct device *dev); +- int (*read_prom_word)(struct device *dev, int index, u16 *word); +- int (*read_adc_temp_and_pressure)(struct device *dev, ++ int (*reset)(struct ms5611_state *st); ++ int (*read_prom_word)(struct ms5611_state *st, int index, u16 *word); ++ int (*read_adc_temp_and_pressure)(struct ms5611_state *st, + s32 *temp, s32 *pressure); + + struct ms5611_chip_info *chip_info; +diff --git a/drivers/iio/pressure/ms5611_core.c b/drivers/iio/pressure/ms5611_core.c +index 214b0d25f598..885ccb7914dc 100644 +--- a/drivers/iio/pressure/ms5611_core.c ++++ b/drivers/iio/pressure/ms5611_core.c +@@ -85,8 +85,7 @@ static int ms5611_read_prom(struct iio_dev *indio_dev) + struct ms5611_state *st = iio_priv(indio_dev); + + for (i = 0; i < MS5611_PROM_WORDS_NB; i++) { +- ret = st->read_prom_word(&indio_dev->dev, +- i, &st->chip_info->prom[i]); ++ ret = st->read_prom_word(st, i, &st->chip_info->prom[i]); + if (ret < 0) { + dev_err(&indio_dev->dev, + "failed to read prom at %d\n", i); +@@ -108,7 +107,7 @@ static int ms5611_read_temp_and_pressure(struct iio_dev *indio_dev, + int ret; + struct ms5611_state *st = iio_priv(indio_dev); + +- ret = st->read_adc_temp_and_pressure(&indio_dev->dev, temp, pressure); ++ ret = st->read_adc_temp_and_pressure(st, temp, pressure); + if (ret < 0) { + dev_err(&indio_dev->dev, + "failed to read temperature and pressure\n"); +@@ -196,7 +195,7 @@ static int ms5611_reset(struct iio_dev *indio_dev) + int ret; + struct ms5611_state *st = iio_priv(indio_dev); + +- ret = st->reset(&indio_dev->dev); ++ ret = st->reset(st); + if (ret < 0) { + dev_err(&indio_dev->dev, "failed to reset device\n"); + return ret; +diff --git a/drivers/iio/pressure/ms5611_i2c.c b/drivers/iio/pressure/ms5611_i2c.c +index 7c04f730430c..cccc40f7df0b 100644 +--- a/drivers/iio/pressure/ms5611_i2c.c ++++ b/drivers/iio/pressure/ms5611_i2c.c +@@ -20,17 +20,15 @@ + + #include "ms5611.h" + +-static int ms5611_i2c_reset(struct device *dev) ++static int ms5611_i2c_reset(struct ms5611_state *st) + { +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); +- + return i2c_smbus_write_byte(st->client, MS5611_RESET); + } + +-static int ms5611_i2c_read_prom_word(struct device *dev, int index, u16 *word) ++static int ms5611_i2c_read_prom_word(struct ms5611_state *st, int index, ++ u16 *word) + { + int ret; +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); + + ret = i2c_smbus_read_word_swapped(st->client, + MS5611_READ_PROM_WORD + (index << 1)); +@@ -57,11 +55,10 @@ static int ms5611_i2c_read_adc(struct ms5611_state *st, s32 *val) + return 0; + } + +-static int ms5611_i2c_read_adc_temp_and_pressure(struct device *dev, ++static int ms5611_i2c_read_adc_temp_and_pressure(struct ms5611_state *st, + s32 *temp, s32 *pressure) + { + int ret; +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); + const struct ms5611_osr *osr = st->temp_osr; + + ret = i2c_smbus_write_byte(st->client, osr->cmd); +diff --git a/drivers/iio/pressure/ms5611_spi.c b/drivers/iio/pressure/ms5611_spi.c +index f7743ee3318f..3039fe8aa2a2 100644 +--- a/drivers/iio/pressure/ms5611_spi.c ++++ b/drivers/iio/pressure/ms5611_spi.c +@@ -15,18 +15,17 @@ + + #include "ms5611.h" + +-static int ms5611_spi_reset(struct device *dev) ++static int ms5611_spi_reset(struct ms5611_state *st) + { + u8 cmd = MS5611_RESET; +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); + + return spi_write_then_read(st->client, &cmd, 1, NULL, 0); + } + +-static int ms5611_spi_read_prom_word(struct device *dev, int index, u16 *word) ++static int ms5611_spi_read_prom_word(struct ms5611_state *st, int index, ++ u16 *word) + { + int ret; +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); + + ret = spi_w8r16be(st->client, MS5611_READ_PROM_WORD + (index << 1)); + if (ret < 0) +@@ -37,11 +36,10 @@ static int ms5611_spi_read_prom_word(struct device *dev, int index, u16 *word) + return 0; + } + +-static int ms5611_spi_read_adc(struct device *dev, s32 *val) ++static int ms5611_spi_read_adc(struct ms5611_state *st, s32 *val) + { + int ret; + u8 buf[3] = { MS5611_READ_ADC }; +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); + + ret = spi_write_then_read(st->client, buf, 1, buf, 3); + if (ret < 0) +@@ -52,11 +50,10 @@ static int ms5611_spi_read_adc(struct device *dev, s32 *val) + return 0; + } + +-static int ms5611_spi_read_adc_temp_and_pressure(struct device *dev, ++static int ms5611_spi_read_adc_temp_and_pressure(struct ms5611_state *st, + s32 *temp, s32 *pressure) + { + int ret; +- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev)); + const struct ms5611_osr *osr = st->temp_osr; + + /* +@@ -68,7 +65,7 @@ static int ms5611_spi_read_adc_temp_and_pressure(struct device *dev, + return ret; + + usleep_range(osr->conv_usec, osr->conv_usec + (osr->conv_usec / 10UL)); +- ret = ms5611_spi_read_adc(dev, temp); ++ ret = ms5611_spi_read_adc(st, temp); + if (ret < 0) + return ret; + +@@ -78,7 +75,7 @@ static int ms5611_spi_read_adc_temp_and_pressure(struct device *dev, + return ret; + + usleep_range(osr->conv_usec, osr->conv_usec + (osr->conv_usec / 10UL)); +- return ms5611_spi_read_adc(dev, pressure); ++ return ms5611_spi_read_adc(st, pressure); + } + + static int ms5611_spi_probe(struct spi_device *spi) +-- +2.35.1 + diff --git a/queue-5.10/iio-pressure-ms5611-fixed-value-compensation-bug.patch b/queue-5.10/iio-pressure-ms5611-fixed-value-compensation-bug.patch new file mode 100644 index 00000000000..c46c56a05e2 --- /dev/null +++ b/queue-5.10/iio-pressure-ms5611-fixed-value-compensation-bug.patch @@ -0,0 +1,173 @@ +From fffb8f40fa656d009c1b774ae26de28cde0d6bf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 15:58:20 +0200 +Subject: iio: pressure: ms5611: fixed value compensation bug + +From: Mitja Spes + +[ Upstream commit 17f442e7e47579d3881fc4d47354eaef09302e6f ] + +When using multiple instances of this driver the compensation PROM was +overwritten by the last initialized sensor. Now each sensor has own PROM +storage. + +Signed-off-by: Mitja Spes +Fixes: 9690d81a02dc ("iio: pressure: ms5611: add support for MS5607 temperature and pressure sensor") +Link: https://lore.kernel.org/r/20221021135827.1444793-2-mitja@lxnav.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/ms5611.h | 12 +++---- + drivers/iio/pressure/ms5611_core.c | 51 ++++++++++++++++-------------- + 2 files changed, 31 insertions(+), 32 deletions(-) + +diff --git a/drivers/iio/pressure/ms5611.h b/drivers/iio/pressure/ms5611.h +index 345f3902e3e3..5e2d2d4d87b5 100644 +--- a/drivers/iio/pressure/ms5611.h ++++ b/drivers/iio/pressure/ms5611.h +@@ -25,13 +25,6 @@ enum { + MS5607, + }; + +-struct ms5611_chip_info { +- u16 prom[MS5611_PROM_WORDS_NB]; +- +- int (*temp_and_pressure_compensate)(struct ms5611_chip_info *chip_info, +- s32 *temp, s32 *pressure); +-}; +- + /* + * OverSampling Rate descriptor. + * Warning: cmd MUST be kept aligned on a word boundary (see +@@ -50,12 +43,15 @@ struct ms5611_state { + const struct ms5611_osr *pressure_osr; + const struct ms5611_osr *temp_osr; + ++ u16 prom[MS5611_PROM_WORDS_NB]; ++ + int (*reset)(struct ms5611_state *st); + int (*read_prom_word)(struct ms5611_state *st, int index, u16 *word); + int (*read_adc_temp_and_pressure)(struct ms5611_state *st, + s32 *temp, s32 *pressure); + +- struct ms5611_chip_info *chip_info; ++ int (*compensate_temp_and_pressure)(struct ms5611_state *st, s32 *temp, ++ s32 *pressure); + struct regulator *vdd; + }; + +diff --git a/drivers/iio/pressure/ms5611_core.c b/drivers/iio/pressure/ms5611_core.c +index 885ccb7914dc..874a73b3ea9d 100644 +--- a/drivers/iio/pressure/ms5611_core.c ++++ b/drivers/iio/pressure/ms5611_core.c +@@ -85,7 +85,7 @@ static int ms5611_read_prom(struct iio_dev *indio_dev) + struct ms5611_state *st = iio_priv(indio_dev); + + for (i = 0; i < MS5611_PROM_WORDS_NB; i++) { +- ret = st->read_prom_word(st, i, &st->chip_info->prom[i]); ++ ret = st->read_prom_word(st, i, &st->prom[i]); + if (ret < 0) { + dev_err(&indio_dev->dev, + "failed to read prom at %d\n", i); +@@ -93,7 +93,7 @@ static int ms5611_read_prom(struct iio_dev *indio_dev) + } + } + +- if (!ms5611_prom_is_valid(st->chip_info->prom, MS5611_PROM_WORDS_NB)) { ++ if (!ms5611_prom_is_valid(st->prom, MS5611_PROM_WORDS_NB)) { + dev_err(&indio_dev->dev, "PROM integrity check failed\n"); + return -ENODEV; + } +@@ -114,21 +114,20 @@ static int ms5611_read_temp_and_pressure(struct iio_dev *indio_dev, + return ret; + } + +- return st->chip_info->temp_and_pressure_compensate(st->chip_info, +- temp, pressure); ++ return st->compensate_temp_and_pressure(st, temp, pressure); + } + +-static int ms5611_temp_and_pressure_compensate(struct ms5611_chip_info *chip_info, ++static int ms5611_temp_and_pressure_compensate(struct ms5611_state *st, + s32 *temp, s32 *pressure) + { + s32 t = *temp, p = *pressure; + s64 off, sens, dt; + +- dt = t - (chip_info->prom[5] << 8); +- off = ((s64)chip_info->prom[2] << 16) + ((chip_info->prom[4] * dt) >> 7); +- sens = ((s64)chip_info->prom[1] << 15) + ((chip_info->prom[3] * dt) >> 8); ++ dt = t - (st->prom[5] << 8); ++ off = ((s64)st->prom[2] << 16) + ((st->prom[4] * dt) >> 7); ++ sens = ((s64)st->prom[1] << 15) + ((st->prom[3] * dt) >> 8); + +- t = 2000 + ((chip_info->prom[6] * dt) >> 23); ++ t = 2000 + ((st->prom[6] * dt) >> 23); + if (t < 2000) { + s64 off2, sens2, t2; + +@@ -154,17 +153,17 @@ static int ms5611_temp_and_pressure_compensate(struct ms5611_chip_info *chip_inf + return 0; + } + +-static int ms5607_temp_and_pressure_compensate(struct ms5611_chip_info *chip_info, ++static int ms5607_temp_and_pressure_compensate(struct ms5611_state *st, + s32 *temp, s32 *pressure) + { + s32 t = *temp, p = *pressure; + s64 off, sens, dt; + +- dt = t - (chip_info->prom[5] << 8); +- off = ((s64)chip_info->prom[2] << 17) + ((chip_info->prom[4] * dt) >> 6); +- sens = ((s64)chip_info->prom[1] << 16) + ((chip_info->prom[3] * dt) >> 7); ++ dt = t - (st->prom[5] << 8); ++ off = ((s64)st->prom[2] << 17) + ((st->prom[4] * dt) >> 6); ++ sens = ((s64)st->prom[1] << 16) + ((st->prom[3] * dt) >> 7); + +- t = 2000 + ((chip_info->prom[6] * dt) >> 23); ++ t = 2000 + ((st->prom[6] * dt) >> 23); + if (t < 2000) { + s64 off2, sens2, t2, tmp; + +@@ -342,15 +341,6 @@ static int ms5611_write_raw(struct iio_dev *indio_dev, + + static const unsigned long ms5611_scan_masks[] = {0x3, 0}; + +-static struct ms5611_chip_info chip_info_tbl[] = { +- [MS5611] = { +- .temp_and_pressure_compensate = ms5611_temp_and_pressure_compensate, +- }, +- [MS5607] = { +- .temp_and_pressure_compensate = ms5607_temp_and_pressure_compensate, +- } +-}; +- + static const struct iio_chan_spec ms5611_channels[] = { + { + .type = IIO_PRESSURE, +@@ -433,7 +423,20 @@ int ms5611_probe(struct iio_dev *indio_dev, struct device *dev, + struct ms5611_state *st = iio_priv(indio_dev); + + mutex_init(&st->lock); +- st->chip_info = &chip_info_tbl[type]; ++ ++ switch (type) { ++ case MS5611: ++ st->compensate_temp_and_pressure = ++ ms5611_temp_and_pressure_compensate; ++ break; ++ case MS5607: ++ st->compensate_temp_and_pressure = ++ ms5607_temp_and_pressure_compensate; ++ break; ++ default: ++ return -EINVAL; ++ } ++ + st->temp_osr = + &ms5611_avail_temp_osr[ARRAY_SIZE(ms5611_avail_temp_osr) - 1]; + st->pressure_osr = +-- +2.35.1 + diff --git a/queue-5.10/mips-pic32-treat-port-as-signed-integer.patch b/queue-5.10/mips-pic32-treat-port-as-signed-integer.patch new file mode 100644 index 00000000000..d7765cf607a --- /dev/null +++ b/queue-5.10/mips-pic32-treat-port-as-signed-integer.patch @@ -0,0 +1,105 @@ +From 8eb5a2d831123a3e9fe08d128dd5b7c2bc619515 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:23:44 +0200 +Subject: MIPS: pic32: treat port as signed integer + +From: Jason A. Donenfeld + +[ Upstream commit 648060902aa302331b5d6e4f26d8ee0761d239ab ] + +get_port_from_cmdline() returns an int, yet is assigned to a char, which +is wrong in its own right, but also, with char becoming unsigned, this +poses problems, because -1 is used as an error value. Further +complicating things, fw_init_early_console() is only ever called with a +-1 argument. Fix this up by removing the unused argument from +fw_init_early_console() and treating port as a proper signed integer. + +Cc: Thomas Bogendoerfer +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/fw/fw.h | 2 +- + arch/mips/pic32/pic32mzda/early_console.c | 13 ++++++------- + arch/mips/pic32/pic32mzda/init.c | 2 +- + 3 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/arch/mips/include/asm/fw/fw.h b/arch/mips/include/asm/fw/fw.h +index d0ef8b4892bb..d0494ce4b337 100644 +--- a/arch/mips/include/asm/fw/fw.h ++++ b/arch/mips/include/asm/fw/fw.h +@@ -26,6 +26,6 @@ extern char *fw_getcmdline(void); + extern void fw_meminit(void); + extern char *fw_getenv(char *name); + extern unsigned long fw_getenvl(char *name); +-extern void fw_init_early_console(char port); ++extern void fw_init_early_console(void); + + #endif /* __ASM_FW_H_ */ +diff --git a/arch/mips/pic32/pic32mzda/early_console.c b/arch/mips/pic32/pic32mzda/early_console.c +index 25372e62783b..3cd1b408fa1c 100644 +--- a/arch/mips/pic32/pic32mzda/early_console.c ++++ b/arch/mips/pic32/pic32mzda/early_console.c +@@ -27,7 +27,7 @@ + #define U_BRG(x) (UART_BASE(x) + 0x40) + + static void __iomem *uart_base; +-static char console_port = -1; ++static int console_port = -1; + + static int __init configure_uart_pins(int port) + { +@@ -47,7 +47,7 @@ static int __init configure_uart_pins(int port) + return 0; + } + +-static void __init configure_uart(char port, int baud) ++static void __init configure_uart(int port, int baud) + { + u32 pbclk; + +@@ -60,7 +60,7 @@ static void __init configure_uart(char port, int baud) + uart_base + PIC32_SET(U_STA(port))); + } + +-static void __init setup_early_console(char port, int baud) ++static void __init setup_early_console(int port, int baud) + { + if (configure_uart_pins(port)) + return; +@@ -130,16 +130,15 @@ static int __init get_baud_from_cmdline(char *arch_cmdline) + return baud; + } + +-void __init fw_init_early_console(char port) ++void __init fw_init_early_console(void) + { + char *arch_cmdline = pic32_getcmdline(); +- int baud = -1; ++ int baud, port; + + uart_base = ioremap(PIC32_BASE_UART, 0xc00); + + baud = get_baud_from_cmdline(arch_cmdline); +- if (port == -1) +- port = get_port_from_cmdline(arch_cmdline); ++ port = get_port_from_cmdline(arch_cmdline); + + if (port == -1) + port = EARLY_CONSOLE_PORT; +diff --git a/arch/mips/pic32/pic32mzda/init.c b/arch/mips/pic32/pic32mzda/init.c +index f232c77ff526..488c0bee7ebf 100644 +--- a/arch/mips/pic32/pic32mzda/init.c ++++ b/arch/mips/pic32/pic32mzda/init.c +@@ -60,7 +60,7 @@ void __init plat_mem_setup(void) + strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE); + + #ifdef CONFIG_EARLY_PRINTK +- fw_init_early_console(-1); ++ fw_init_early_console(); + #endif + pic32_config_init(); + } +-- +2.35.1 + diff --git a/queue-5.10/nvme-add-a-bogus-subsystem-nqn-quirk-for-micron-mtfd.patch b/queue-5.10/nvme-add-a-bogus-subsystem-nqn-quirk-for-micron-mtfd.patch new file mode 100644 index 00000000000..526c1f59657 --- /dev/null +++ b/queue-5.10/nvme-add-a-bogus-subsystem-nqn-quirk-for-micron-mtfd.patch @@ -0,0 +1,37 @@ +From 163ab4cde68e07a79711612e8aeb3fcc43614cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 12:19:21 +0200 +Subject: nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH + +From: Leo Savernik + +[ Upstream commit 41f38043f884c66af4114a7109cf540d6222f450 ] + +The Micron MTFDKBA2T0TFH device reports the same subsysem NQN for +all devices. Add a quick to ignore it. + +Signed-off-by: Leo Savernik +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Stable-dep-of: d5ceb4d1c507 ("nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 65f4bf880608..7e2ee636c5f9 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3252,6 +3252,8 @@ static const struct pci_device_id nvme_id_table[] = { + { PCI_DEVICE(0x1cc1, 0x8201), /* ADATA SX8200PNP 512GB */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS | + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ { PCI_DEVICE(0x1344, 0x5407), /* Micron Technology Inc NVMe SSD */ ++ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN }, + { PCI_DEVICE(0x1c5c, 0x1504), /* SK Hynix PC400 */ + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + { PCI_DEVICE(0x15b7, 0x2001), /* Sandisk Skyhawk */ +-- +2.35.1 + diff --git a/queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-micron-nitro.patch b/queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-micron-nitro.patch new file mode 100644 index 00000000000..ccd40dc7a2e --- /dev/null +++ b/queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-micron-nitro.patch @@ -0,0 +1,35 @@ +From cc46a17a1215de0ccdb1357f2a233981ce858219 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 14:48:52 +0100 +Subject: nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro + +From: Bean Huo + +[ Upstream commit d5ceb4d1c50786d21de3d4b06c3f43109ec56dd8 ] + +Added a quirk to fix Micron Nitro NVMe reporting duplicate NGUIDs. + +Cc: +Signed-off-by: Bean Huo +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 7e2ee636c5f9..089f39103584 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3254,6 +3254,8 @@ static const struct pci_device_id nvme_id_table[] = { + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1344, 0x5407), /* Micron Technology Inc NVMe SSD */ + .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN }, ++ { PCI_DEVICE(0x1344, 0x6001), /* Micron Nitro NVMe */ ++ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1c5c, 0x1504), /* SK Hynix PC400 */ + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + { PCI_DEVICE(0x15b7, 0x2001), /* Sandisk Skyhawk */ +-- +2.35.1 + diff --git a/queue-5.10/pinctrl-rockchip-do-coding-style-for-mux-route-struc.patch b/queue-5.10/pinctrl-rockchip-do-coding-style-for-mux-route-struc.patch new file mode 100644 index 00000000000..d2cfa29ae25 --- /dev/null +++ b/queue-5.10/pinctrl-rockchip-do-coding-style-for-mux-route-struc.patch @@ -0,0 +1,762 @@ +From b885df7cf938ec6af1c0d73576998310be859a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 17:12:40 +0800 +Subject: pinctrl: rockchip: do coding style for mux route struct + +From: Jianqun Xu + +[ Upstream commit fe202ea8e5b170ef7b3741da885e8cb7bae1106e ] + +The mux route tables take many lines for each SoC, and it will be more +instances for newly SoC, that makes the file size increase larger. + +This patch only do coding style for mux route struct, by adding a new +definition and replace the structs by script which supplied by +huangtao@rock-chips.com + +sed -i -e " +/static struct rockchip_mux_route_data /bcheck +b +:append-next-line +N +:check +/^[^;]*$/bappend-next-line +s/[[:blank:]]*.bank_num = \([[:digit:]]*,\)\n/\tRK_MUXROUTE_SAME(\1/g +s/[[:blank:]]*.pin =[[:blank:]]*0,\n/ RK_PA0,/g +s/[[:blank:]]*.pin =[[:blank:]]*1,\n/ RK_PA1,/g +s/[[:blank:]]*.pin =[[:blank:]]*2,\n/ RK_PA2,/g +s/[[:blank:]]*.pin =[[:blank:]]*3,\n/ RK_PA3,/g +s/[[:blank:]]*.pin =[[:blank:]]*4,\n/ RK_PA4,/g +s/[[:blank:]]*.pin =[[:blank:]]*5,\n/ RK_PA5,/g +s/[[:blank:]]*.pin =[[:blank:]]*6,\n/ RK_PA6,/g +s/[[:blank:]]*.pin =[[:blank:]]*7,\n/ RK_PA7,/g +s/[[:blank:]]*.pin =[[:blank:]]*8,\n/ RK_PB0,/g +s/[[:blank:]]*.pin =[[:blank:]]*9,\n/ RK_PB1,/g +s/[[:blank:]]*.pin =[[:blank:]]*10,\n/ RK_PB2,/g +s/[[:blank:]]*.pin =[[:blank:]]*11,\n/ RK_PB3,/g +s/[[:blank:]]*.pin =[[:blank:]]*12,\n/ RK_PB4,/g +s/[[:blank:]]*.pin =[[:blank:]]*13,\n/ RK_PB5,/g +s/[[:blank:]]*.pin =[[:blank:]]*14,\n/ RK_PB6,/g +s/[[:blank:]]*.pin =[[:blank:]]*15,\n/ RK_PB7,/g +s/[[:blank:]]*.pin =[[:blank:]]*16,\n/ RK_PC0,/g +s/[[:blank:]]*.pin =[[:blank:]]*17,\n/ RK_PC1,/g +s/[[:blank:]]*.pin =[[:blank:]]*18,\n/ RK_PC2,/g +s/[[:blank:]]*.pin =[[:blank:]]*19,\n/ RK_PC3,/g +s/[[:blank:]]*.pin =[[:blank:]]*20,\n/ RK_PC4,/g +s/[[:blank:]]*.pin =[[:blank:]]*21,\n/ RK_PC5,/g +s/[[:blank:]]*.pin =[[:blank:]]*22,\n/ RK_PC6,/g +s/[[:blank:]]*.pin =[[:blank:]]*23,\n/ RK_PC7,/g +s/[[:blank:]]*.pin =[[:blank:]]*24,\n/ RK_PD0,/g +s/[[:blank:]]*.pin =[[:blank:]]*25,\n/ RK_PD1,/g +s/[[:blank:]]*.pin =[[:blank:]]*26,\n/ RK_PD2,/g +s/[[:blank:]]*.pin =[[:blank:]]*27,\n/ RK_PD3,/g +s/[[:blank:]]*.pin =[[:blank:]]*28,\n/ RK_PD4,/g +s/[[:blank:]]*.pin =[[:blank:]]*29,\n/ RK_PD5,/g +s/[[:blank:]]*.pin =[[:blank:]]*30,\n/ RK_PD6,/g +s/[[:blank:]]*.pin =[[:blank:]]*31,\n/ RK_PD7,/g +s/[[:blank:]]*.func = \([[:digit:]]*,\)\n/ \1/g +s/[[:blank:]]*.route_location =[[:blank:]]*\([[:print:]]*,\)\n//g +s/[[:blank:]]*.route_offset = \(0x[[:xdigit:]]*,\)\n/ \1/g +s/[[:blank:]]*.route_val =[[:blank:]]*\([[:print:]]*\),\n/ \1),/g +s/\t{\n//g +s/\t}, {\n//g +s/\t},//g +s/[[:blank:]]*\(\/\*[[:print:]]*\*\/\)\n[[:blank:]]*RK_MUXROUTE_SAME(\([[:print:]]*\)),\n/\tRK_MUXROUTE_SAME(\2), \1\n/g +s/[[:blank:]]*\(\/\*[[:print:]]*\*\/\)\n[[:blank:]]*RK_MUXROUTE_SAME(\([[:print:]]*\)),/\tRK_MUXROUTE_SAME(\2), \1\n/g +" drivers/pinctrl/pinctrl-rockchip.c + +Reviewed-by: Heiko Stuebner +Signed-off-by: Jianqun Xu +Link: https://lore.kernel.org/r/20210420091240.1246429-1-jay.xu@rock-chips.com +Signed-off-by: Linus Walleij +Stable-dep-of: bee55f2e7a44 ("pinctrl: rockchip: list all pins in a possible mux route for PX30") +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 650 ++++------------------------- + 1 file changed, 80 insertions(+), 570 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 07b1204174bf..f0da98655794 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -816,597 +816,107 @@ static void rockchip_get_recalced_mux(struct rockchip_pin_bank *bank, int pin, + } + + static struct rockchip_mux_route_data px30_mux_route_data[] = { +- { +- /* cif-d2m0 */ +- .bank_num = 2, +- .pin = 0, +- .func = 1, +- .route_offset = 0x184, +- .route_val = BIT(16 + 7), +- }, { +- /* cif-d2m1 */ +- .bank_num = 3, +- .pin = 3, +- .func = 3, +- .route_offset = 0x184, +- .route_val = BIT(16 + 7) | BIT(7), +- }, { +- /* pdm-m0 */ +- .bank_num = 3, +- .pin = 22, +- .func = 2, +- .route_offset = 0x184, +- .route_val = BIT(16 + 8), +- }, { +- /* pdm-m1 */ +- .bank_num = 2, +- .pin = 22, +- .func = 1, +- .route_offset = 0x184, +- .route_val = BIT(16 + 8) | BIT(8), +- }, { +- /* uart2-rxm0 */ +- .bank_num = 1, +- .pin = 27, +- .func = 2, +- .route_offset = 0x184, +- .route_val = BIT(16 + 10), +- }, { +- /* uart2-rxm1 */ +- .bank_num = 2, +- .pin = 14, +- .func = 2, +- .route_offset = 0x184, +- .route_val = BIT(16 + 10) | BIT(10), +- }, { +- /* uart3-rxm0 */ +- .bank_num = 0, +- .pin = 17, +- .func = 2, +- .route_offset = 0x184, +- .route_val = BIT(16 + 9), +- }, { +- /* uart3-rxm1 */ +- .bank_num = 1, +- .pin = 15, +- .func = 2, +- .route_offset = 0x184, +- .route_val = BIT(16 + 9) | BIT(9), +- }, ++ RK_MUXROUTE_SAME(2, RK_PA0, 1, 0x184, BIT(16 + 7)), /* cif-d2m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d2m1 */ ++ RK_MUXROUTE_SAME(3, RK_PC6, 2, 0x184, BIT(16 + 8)), /* pdm-m0 */ ++ RK_MUXROUTE_SAME(2, RK_PC6, 1, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-m1 */ ++ RK_MUXROUTE_SAME(1, RK_PD3, 2, 0x184, BIT(16 + 10)), /* uart2-rxm0 */ ++ RK_MUXROUTE_SAME(2, RK_PB6, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-rxm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC1, 2, 0x184, BIT(16 + 9)), /* uart3-rxm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB7, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rxm1 */ + }; + + static struct rockchip_mux_route_data rk3128_mux_route_data[] = { +- { +- /* spi-0 */ +- .bank_num = 1, +- .pin = 10, +- .func = 1, +- .route_offset = 0x144, +- .route_val = BIT(16 + 3) | BIT(16 + 4), +- }, { +- /* spi-1 */ +- .bank_num = 1, +- .pin = 27, +- .func = 3, +- .route_offset = 0x144, +- .route_val = BIT(16 + 3) | BIT(16 + 4) | BIT(3), +- }, { +- /* spi-2 */ +- .bank_num = 0, +- .pin = 13, +- .func = 2, +- .route_offset = 0x144, +- .route_val = BIT(16 + 3) | BIT(16 + 4) | BIT(4), +- }, { +- /* i2s-0 */ +- .bank_num = 1, +- .pin = 5, +- .func = 1, +- .route_offset = 0x144, +- .route_val = BIT(16 + 5), +- }, { +- /* i2s-1 */ +- .bank_num = 0, +- .pin = 14, +- .func = 1, +- .route_offset = 0x144, +- .route_val = BIT(16 + 5) | BIT(5), +- }, { +- /* emmc-0 */ +- .bank_num = 1, +- .pin = 22, +- .func = 2, +- .route_offset = 0x144, +- .route_val = BIT(16 + 6), +- }, { +- /* emmc-1 */ +- .bank_num = 2, +- .pin = 4, +- .func = 2, +- .route_offset = 0x144, +- .route_val = BIT(16 + 6) | BIT(6), +- }, ++ RK_MUXROUTE_SAME(1, RK_PB2, 1, 0x144, BIT(16 + 3) | BIT(16 + 4)), /* spi-0 */ ++ RK_MUXROUTE_SAME(1, RK_PD3, 3, 0x144, BIT(16 + 3) | BIT(16 + 4) | BIT(3)), /* spi-1 */ ++ RK_MUXROUTE_SAME(0, RK_PB5, 2, 0x144, BIT(16 + 3) | BIT(16 + 4) | BIT(4)), /* spi-2 */ ++ RK_MUXROUTE_SAME(1, RK_PA5, 1, 0x144, BIT(16 + 5)), /* i2s-0 */ ++ RK_MUXROUTE_SAME(0, RK_PB6, 1, 0x144, BIT(16 + 5) | BIT(5)), /* i2s-1 */ ++ RK_MUXROUTE_SAME(1, RK_PC6, 2, 0x144, BIT(16 + 6)), /* emmc-0 */ ++ RK_MUXROUTE_SAME(2, RK_PA4, 2, 0x144, BIT(16 + 6) | BIT(6)), /* emmc-1 */ + }; + + static struct rockchip_mux_route_data rk3188_mux_route_data[] = { +- { +- /* non-iomuxed emmc/flash pins on flash-dqs */ +- .bank_num = 0, +- .pin = 24, +- .func = 1, +- .route_location = ROCKCHIP_ROUTE_GRF, +- .route_offset = 0xa0, +- .route_val = BIT(16 + 11), +- }, { +- /* non-iomuxed emmc/flash pins on emmc-clk */ +- .bank_num = 0, +- .pin = 24, +- .func = 2, +- .route_location = ROCKCHIP_ROUTE_GRF, +- .route_offset = 0xa0, +- .route_val = BIT(16 + 11) | BIT(11), +- }, ++ RK_MUXROUTE_SAME(0, RK_PD0, 1, 0xa0, BIT(16 + 11)), /* non-iomuxed emmc/flash pins on flash-dqs */ ++ RK_MUXROUTE_SAME(0, RK_PD0, 2, 0xa0, BIT(16 + 11) | BIT(11)), /* non-iomuxed emmc/flash pins on emmc-clk */ + }; + + static struct rockchip_mux_route_data rk3228_mux_route_data[] = { +- { +- /* pwm0-0 */ +- .bank_num = 0, +- .pin = 26, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16), +- }, { +- /* pwm0-1 */ +- .bank_num = 3, +- .pin = 21, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16) | BIT(0), +- }, { +- /* pwm1-0 */ +- .bank_num = 0, +- .pin = 27, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 1), +- }, { +- /* pwm1-1 */ +- .bank_num = 0, +- .pin = 30, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 1) | BIT(1), +- }, { +- /* pwm2-0 */ +- .bank_num = 0, +- .pin = 28, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 2), +- }, { +- /* pwm2-1 */ +- .bank_num = 1, +- .pin = 12, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 2) | BIT(2), +- }, { +- /* pwm3-0 */ +- .bank_num = 3, +- .pin = 26, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 3), +- }, { +- /* pwm3-1 */ +- .bank_num = 1, +- .pin = 11, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 3) | BIT(3), +- }, { +- /* sdio-0_d0 */ +- .bank_num = 1, +- .pin = 1, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 4), +- }, { +- /* sdio-1_d0 */ +- .bank_num = 3, +- .pin = 2, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 4) | BIT(4), +- }, { +- /* spi-0_rx */ +- .bank_num = 0, +- .pin = 13, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 5), +- }, { +- /* spi-1_rx */ +- .bank_num = 2, +- .pin = 0, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 5) | BIT(5), +- }, { +- /* emmc-0_cmd */ +- .bank_num = 1, +- .pin = 22, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 7), +- }, { +- /* emmc-1_cmd */ +- .bank_num = 2, +- .pin = 4, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 7) | BIT(7), +- }, { +- /* uart2-0_rx */ +- .bank_num = 1, +- .pin = 19, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 8), +- }, { +- /* uart2-1_rx */ +- .bank_num = 1, +- .pin = 10, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 8) | BIT(8), +- }, { +- /* uart1-0_rx */ +- .bank_num = 1, +- .pin = 10, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 11), +- }, { +- /* uart1-1_rx */ +- .bank_num = 3, +- .pin = 13, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 11) | BIT(11), +- }, ++ RK_MUXROUTE_SAME(0, RK_PD2, 1, 0x50, BIT(16)), /* pwm0-0 */ ++ RK_MUXROUTE_SAME(3, RK_PC5, 1, 0x50, BIT(16) | BIT(0)), /* pwm0-1 */ ++ RK_MUXROUTE_SAME(0, RK_PD3, 1, 0x50, BIT(16 + 1)), /* pwm1-0 */ ++ RK_MUXROUTE_SAME(0, RK_PD6, 2, 0x50, BIT(16 + 1) | BIT(1)), /* pwm1-1 */ ++ RK_MUXROUTE_SAME(0, RK_PD4, 1, 0x50, BIT(16 + 2)), /* pwm2-0 */ ++ RK_MUXROUTE_SAME(1, RK_PB4, 2, 0x50, BIT(16 + 2) | BIT(2)), /* pwm2-1 */ ++ RK_MUXROUTE_SAME(3, RK_PD2, 1, 0x50, BIT(16 + 3)), /* pwm3-0 */ ++ RK_MUXROUTE_SAME(1, RK_PB3, 2, 0x50, BIT(16 + 3) | BIT(3)), /* pwm3-1 */ ++ RK_MUXROUTE_SAME(1, RK_PA1, 1, 0x50, BIT(16 + 4)), /* sdio-0_d0 */ ++ RK_MUXROUTE_SAME(3, RK_PA2, 1, 0x50, BIT(16 + 4) | BIT(4)), /* sdio-1_d0 */ ++ RK_MUXROUTE_SAME(0, RK_PB5, 2, 0x50, BIT(16 + 5)), /* spi-0_rx */ ++ RK_MUXROUTE_SAME(2, RK_PA0, 2, 0x50, BIT(16 + 5) | BIT(5)), /* spi-1_rx */ ++ RK_MUXROUTE_SAME(1, RK_PC6, 2, 0x50, BIT(16 + 7)), /* emmc-0_cmd */ ++ RK_MUXROUTE_SAME(2, RK_PA4, 2, 0x50, BIT(16 + 7) | BIT(7)), /* emmc-1_cmd */ ++ RK_MUXROUTE_SAME(1, RK_PC3, 2, 0x50, BIT(16 + 8)), /* uart2-0_rx */ ++ RK_MUXROUTE_SAME(1, RK_PB2, 2, 0x50, BIT(16 + 8) | BIT(8)), /* uart2-1_rx */ ++ RK_MUXROUTE_SAME(1, RK_PB2, 1, 0x50, BIT(16 + 11)), /* uart1-0_rx */ ++ RK_MUXROUTE_SAME(3, RK_PB5, 1, 0x50, BIT(16 + 11) | BIT(11)), /* uart1-1_rx */ + }; + + static struct rockchip_mux_route_data rk3288_mux_route_data[] = { +- { +- /* edphdmi_cecinoutt1 */ +- .bank_num = 7, +- .pin = 16, +- .func = 2, +- .route_offset = 0x264, +- .route_val = BIT(16 + 12) | BIT(12), +- }, { +- /* edphdmi_cecinout */ +- .bank_num = 7, +- .pin = 23, +- .func = 4, +- .route_offset = 0x264, +- .route_val = BIT(16 + 12), +- }, ++ RK_MUXROUTE_SAME(7, RK_PC0, 2, 0x264, BIT(16 + 12) | BIT(12)), /* edphdmi_cecinoutt1 */ ++ RK_MUXROUTE_SAME(7, RK_PC7, 4, 0x264, BIT(16 + 12)), /* edphdmi_cecinout */ + }; + + static struct rockchip_mux_route_data rk3308_mux_route_data[] = { +- { +- /* rtc_clk */ +- .bank_num = 0, +- .pin = 19, +- .func = 1, +- .route_offset = 0x314, +- .route_val = BIT(16 + 0) | BIT(0), +- }, { +- /* uart2_rxm0 */ +- .bank_num = 1, +- .pin = 22, +- .func = 2, +- .route_offset = 0x314, +- .route_val = BIT(16 + 2) | BIT(16 + 3), +- }, { +- /* uart2_rxm1 */ +- .bank_num = 4, +- .pin = 26, +- .func = 2, +- .route_offset = 0x314, +- .route_val = BIT(16 + 2) | BIT(16 + 3) | BIT(2), +- }, { +- /* i2c3_sdam0 */ +- .bank_num = 0, +- .pin = 15, +- .func = 2, +- .route_offset = 0x608, +- .route_val = BIT(16 + 8) | BIT(16 + 9), +- }, { +- /* i2c3_sdam1 */ +- .bank_num = 3, +- .pin = 12, +- .func = 2, +- .route_offset = 0x608, +- .route_val = BIT(16 + 8) | BIT(16 + 9) | BIT(8), +- }, { +- /* i2c3_sdam2 */ +- .bank_num = 2, +- .pin = 0, +- .func = 3, +- .route_offset = 0x608, +- .route_val = BIT(16 + 8) | BIT(16 + 9) | BIT(9), +- }, { +- /* i2s-8ch-1-sclktxm0 */ +- .bank_num = 1, +- .pin = 3, +- .func = 2, +- .route_offset = 0x308, +- .route_val = BIT(16 + 3), +- }, { +- /* i2s-8ch-1-sclkrxm0 */ +- .bank_num = 1, +- .pin = 4, +- .func = 2, +- .route_offset = 0x308, +- .route_val = BIT(16 + 3), +- }, { +- /* i2s-8ch-1-sclktxm1 */ +- .bank_num = 1, +- .pin = 13, +- .func = 2, +- .route_offset = 0x308, +- .route_val = BIT(16 + 3) | BIT(3), +- }, { +- /* i2s-8ch-1-sclkrxm1 */ +- .bank_num = 1, +- .pin = 14, +- .func = 2, +- .route_offset = 0x308, +- .route_val = BIT(16 + 3) | BIT(3), +- }, { +- /* pdm-clkm0 */ +- .bank_num = 1, +- .pin = 4, +- .func = 3, +- .route_offset = 0x308, +- .route_val = BIT(16 + 12) | BIT(16 + 13), +- }, { +- /* pdm-clkm1 */ +- .bank_num = 1, +- .pin = 14, +- .func = 4, +- .route_offset = 0x308, +- .route_val = BIT(16 + 12) | BIT(16 + 13) | BIT(12), +- }, { +- /* pdm-clkm2 */ +- .bank_num = 2, +- .pin = 6, +- .func = 2, +- .route_offset = 0x308, +- .route_val = BIT(16 + 12) | BIT(16 + 13) | BIT(13), +- }, { +- /* pdm-clkm-m2 */ +- .bank_num = 2, +- .pin = 4, +- .func = 3, +- .route_offset = 0x600, +- .route_val = BIT(16 + 2) | BIT(2), +- }, { +- /* spi1_miso */ +- .bank_num = 3, +- .pin = 10, +- .func = 3, +- .route_offset = 0x314, +- .route_val = BIT(16 + 9), +- }, { +- /* spi1_miso_m1 */ +- .bank_num = 2, +- .pin = 4, +- .func = 2, +- .route_offset = 0x314, +- .route_val = BIT(16 + 9) | BIT(9), +- }, { +- /* owire_m0 */ +- .bank_num = 0, +- .pin = 11, +- .func = 3, +- .route_offset = 0x314, +- .route_val = BIT(16 + 10) | BIT(16 + 11), +- }, { +- /* owire_m1 */ +- .bank_num = 1, +- .pin = 22, +- .func = 7, +- .route_offset = 0x314, +- .route_val = BIT(16 + 10) | BIT(16 + 11) | BIT(10), +- }, { +- /* owire_m2 */ +- .bank_num = 2, +- .pin = 2, +- .func = 5, +- .route_offset = 0x314, +- .route_val = BIT(16 + 10) | BIT(16 + 11) | BIT(11), +- }, { +- /* can_rxd_m0 */ +- .bank_num = 0, +- .pin = 11, +- .func = 2, +- .route_offset = 0x314, +- .route_val = BIT(16 + 12) | BIT(16 + 13), +- }, { +- /* can_rxd_m1 */ +- .bank_num = 1, +- .pin = 22, +- .func = 5, +- .route_offset = 0x314, +- .route_val = BIT(16 + 12) | BIT(16 + 13) | BIT(12), +- }, { +- /* can_rxd_m2 */ +- .bank_num = 2, +- .pin = 2, +- .func = 4, +- .route_offset = 0x314, +- .route_val = BIT(16 + 12) | BIT(16 + 13) | BIT(13), +- }, { +- /* mac_rxd0_m0 */ +- .bank_num = 1, +- .pin = 20, +- .func = 3, +- .route_offset = 0x314, +- .route_val = BIT(16 + 14), +- }, { +- /* mac_rxd0_m1 */ +- .bank_num = 4, +- .pin = 2, +- .func = 2, +- .route_offset = 0x314, +- .route_val = BIT(16 + 14) | BIT(14), +- }, { +- /* uart3_rx */ +- .bank_num = 3, +- .pin = 12, +- .func = 4, +- .route_offset = 0x314, +- .route_val = BIT(16 + 15), +- }, { +- /* uart3_rx_m1 */ +- .bank_num = 0, +- .pin = 17, +- .func = 3, +- .route_offset = 0x314, +- .route_val = BIT(16 + 15) | BIT(15), +- }, ++ RK_MUXROUTE_SAME(0, RK_PC3, 1, 0x314, BIT(16 + 0) | BIT(0)), /* rtc_clk */ ++ RK_MUXROUTE_SAME(1, RK_PC6, 2, 0x314, BIT(16 + 2) | BIT(16 + 3)), /* uart2_rxm0 */ ++ RK_MUXROUTE_SAME(4, RK_PD2, 2, 0x314, BIT(16 + 2) | BIT(16 + 3) | BIT(2)), /* uart2_rxm1 */ ++ RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x608, BIT(16 + 8) | BIT(16 + 9)), /* i2c3_sdam0 */ ++ RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(8)), /* i2c3_sdam1 */ ++ RK_MUXROUTE_SAME(2, RK_PA0, 3, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(9)), /* i2c3_sdam2 */ ++ RK_MUXROUTE_SAME(1, RK_PA3, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclktxm0 */ ++ RK_MUXROUTE_SAME(1, RK_PA4, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclkrxm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x308, BIT(16 + 3) | BIT(3)), /* i2s-8ch-1-sclktxm1 */ ++ RK_MUXROUTE_SAME(1, RK_PB6, 2, 0x308, BIT(16 + 3) | BIT(3)), /* i2s-8ch-1-sclkrxm1 */ ++ RK_MUXROUTE_SAME(1, RK_PA4, 3, 0x308, BIT(16 + 12) | BIT(16 + 13)), /* pdm-clkm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB6, 4, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* pdm-clkm1 */ ++ RK_MUXROUTE_SAME(2, RK_PA6, 2, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* pdm-clkm2 */ ++ RK_MUXROUTE_SAME(2, RK_PA4, 3, 0x600, BIT(16 + 2) | BIT(2)), /* pdm-clkm-m2 */ ++ RK_MUXROUTE_SAME(3, RK_PB2, 3, 0x314, BIT(16 + 9)), /* spi1_miso */ ++ RK_MUXROUTE_SAME(2, RK_PA4, 2, 0x314, BIT(16 + 9) | BIT(9)), /* spi1_miso_m1 */ ++ RK_MUXROUTE_SAME(0, RK_PB3, 3, 0x314, BIT(16 + 10) | BIT(16 + 11)), /* owire_m0 */ ++ RK_MUXROUTE_SAME(1, RK_PC6, 7, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(10)), /* owire_m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA2, 5, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(11)), /* owire_m2 */ ++ RK_MUXROUTE_SAME(0, RK_PB3, 2, 0x314, BIT(16 + 12) | BIT(16 + 13)), /* can_rxd_m0 */ ++ RK_MUXROUTE_SAME(1, RK_PC6, 5, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* can_rxd_m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA2, 4, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* can_rxd_m2 */ ++ RK_MUXROUTE_SAME(1, RK_PC4, 3, 0x314, BIT(16 + 14)), /* mac_rxd0_m0 */ ++ RK_MUXROUTE_SAME(4, RK_PA2, 2, 0x314, BIT(16 + 14) | BIT(14)), /* mac_rxd0_m1 */ ++ RK_MUXROUTE_SAME(3, RK_PB4, 4, 0x314, BIT(16 + 15)), /* uart3_rx */ ++ RK_MUXROUTE_SAME(0, RK_PC1, 3, 0x314, BIT(16 + 15) | BIT(15)), /* uart3_rx_m1 */ + }; + + static struct rockchip_mux_route_data rk3328_mux_route_data[] = { +- { +- /* uart2dbg_rxm0 */ +- .bank_num = 1, +- .pin = 1, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16) | BIT(16 + 1), +- }, { +- /* uart2dbg_rxm1 */ +- .bank_num = 2, +- .pin = 1, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16) | BIT(16 + 1) | BIT(0), +- }, { +- /* gmac-m1_rxd0 */ +- .bank_num = 1, +- .pin = 11, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 2) | BIT(2), +- }, { +- /* gmac-m1-optimized_rxd3 */ +- .bank_num = 1, +- .pin = 14, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 10) | BIT(10), +- }, { +- /* pdm_sdi0m0 */ +- .bank_num = 2, +- .pin = 19, +- .func = 2, +- .route_offset = 0x50, +- .route_val = BIT(16 + 3), +- }, { +- /* pdm_sdi0m1 */ +- .bank_num = 1, +- .pin = 23, +- .func = 3, +- .route_offset = 0x50, +- .route_val = BIT(16 + 3) | BIT(3), +- }, { +- /* spi_rxdm2 */ +- .bank_num = 3, +- .pin = 2, +- .func = 4, +- .route_offset = 0x50, +- .route_val = BIT(16 + 4) | BIT(16 + 5) | BIT(5), +- }, { +- /* i2s2_sdim0 */ +- .bank_num = 1, +- .pin = 24, +- .func = 1, +- .route_offset = 0x50, +- .route_val = BIT(16 + 6), +- }, { +- /* i2s2_sdim1 */ +- .bank_num = 3, +- .pin = 2, +- .func = 6, +- .route_offset = 0x50, +- .route_val = BIT(16 + 6) | BIT(6), +- }, { +- /* card_iom1 */ +- .bank_num = 2, +- .pin = 22, +- .func = 3, +- .route_offset = 0x50, +- .route_val = BIT(16 + 7) | BIT(7), +- }, { +- /* tsp_d5m1 */ +- .bank_num = 2, +- .pin = 16, +- .func = 3, +- .route_offset = 0x50, +- .route_val = BIT(16 + 8) | BIT(8), +- }, { +- /* cif_data5m1 */ +- .bank_num = 2, +- .pin = 16, +- .func = 4, +- .route_offset = 0x50, +- .route_val = BIT(16 + 9) | BIT(9), +- }, ++ RK_MUXROUTE_SAME(1, RK_PA1, 2, 0x50, BIT(16) | BIT(16 + 1)), /* uart2dbg_rxm0 */ ++ RK_MUXROUTE_SAME(2, RK_PA1, 1, 0x50, BIT(16) | BIT(16 + 1) | BIT(0)), /* uart2dbg_rxm1 */ ++ RK_MUXROUTE_SAME(1, RK_PB3, 2, 0x50, BIT(16 + 2) | BIT(2)), /* gmac-m1_rxd0 */ ++ RK_MUXROUTE_SAME(1, RK_PB6, 2, 0x50, BIT(16 + 10) | BIT(10)), /* gmac-m1-optimized_rxd3 */ ++ RK_MUXROUTE_SAME(2, RK_PC3, 2, 0x50, BIT(16 + 3)), /* pdm_sdi0m0 */ ++ RK_MUXROUTE_SAME(1, RK_PC7, 3, 0x50, BIT(16 + 3) | BIT(3)), /* pdm_sdi0m1 */ ++ RK_MUXROUTE_SAME(3, RK_PA2, 4, 0x50, BIT(16 + 4) | BIT(16 + 5) | BIT(5)), /* spi_rxdm2 */ ++ RK_MUXROUTE_SAME(1, RK_PD0, 1, 0x50, BIT(16 + 6)), /* i2s2_sdim0 */ ++ RK_MUXROUTE_SAME(3, RK_PA2, 6, 0x50, BIT(16 + 6) | BIT(6)), /* i2s2_sdim1 */ ++ RK_MUXROUTE_SAME(2, RK_PC6, 3, 0x50, BIT(16 + 7) | BIT(7)), /* card_iom1 */ ++ RK_MUXROUTE_SAME(2, RK_PC0, 3, 0x50, BIT(16 + 8) | BIT(8)), /* tsp_d5m1 */ ++ RK_MUXROUTE_SAME(2, RK_PC0, 4, 0x50, BIT(16 + 9) | BIT(9)), /* cif_data5m1 */ + }; + + static struct rockchip_mux_route_data rk3399_mux_route_data[] = { +- { +- /* uart2dbga_rx */ +- .bank_num = 4, +- .pin = 8, +- .func = 2, +- .route_offset = 0xe21c, +- .route_val = BIT(16 + 10) | BIT(16 + 11), +- }, { +- /* uart2dbgb_rx */ +- .bank_num = 4, +- .pin = 16, +- .func = 2, +- .route_offset = 0xe21c, +- .route_val = BIT(16 + 10) | BIT(16 + 11) | BIT(10), +- }, { +- /* uart2dbgc_rx */ +- .bank_num = 4, +- .pin = 19, +- .func = 1, +- .route_offset = 0xe21c, +- .route_val = BIT(16 + 10) | BIT(16 + 11) | BIT(11), +- }, { +- /* pcie_clkreqn */ +- .bank_num = 2, +- .pin = 26, +- .func = 2, +- .route_offset = 0xe21c, +- .route_val = BIT(16 + 14), +- }, { +- /* pcie_clkreqnb */ +- .bank_num = 4, +- .pin = 24, +- .func = 1, +- .route_offset = 0xe21c, +- .route_val = BIT(16 + 14) | BIT(14), +- }, ++ RK_MUXROUTE_SAME(4, RK_PB0, 2, 0xe21c, BIT(16 + 10) | BIT(16 + 11)), /* uart2dbga_rx */ ++ RK_MUXROUTE_SAME(4, RK_PC0, 2, 0xe21c, BIT(16 + 10) | BIT(16 + 11) | BIT(10)), /* uart2dbgb_rx */ ++ RK_MUXROUTE_SAME(4, RK_PC3, 1, 0xe21c, BIT(16 + 10) | BIT(16 + 11) | BIT(11)), /* uart2dbgc_rx */ ++ RK_MUXROUTE_SAME(2, RK_PD2, 2, 0xe21c, BIT(16 + 14)), /* pcie_clkreqn */ ++ RK_MUXROUTE_SAME(4, RK_PD0, 1, 0xe21c, BIT(16 + 14) | BIT(14)), /* pcie_clkreqnb */ + }; + + static bool rockchip_get_mux_route(struct rockchip_pin_bank *bank, int pin, +-- +2.35.1 + diff --git a/queue-5.10/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch b/queue-5.10/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch new file mode 100644 index 00000000000..a83aa5efd7c --- /dev/null +++ b/queue-5.10/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch @@ -0,0 +1,99 @@ +From 43b7bd8cb3e6584fb7e9b4a992d50b04c61351ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 14:17:23 +0200 +Subject: pinctrl: rockchip: list all pins in a possible mux route for PX30 + +From: Quentin Schulz + +[ Upstream commit bee55f2e7a44e7a7676e264b42f026e34bd244d9 ] + +The mux routes are incomplete for the PX30. This was discovered because +we had a HW design using cif-clkoutm1 with the correct pinmux in the +Device Tree but the clock would still not work. + +There are actually two muxing required: the pin muxing (performed by the +usual Device Tree pinctrl nodes) and the "function" muxing (m0 vs m1; +performed by the mux routing inside the driver). The pin muxing was +correct but the function muxing was not. + +This adds the missing pins and their configuration for the mux routes +that are already specified in the driver. + +Note that there are some "conflicts": it is possible *in Device Tree* to +(attempt to) mux the pins for e.g. clkoutm1 and clkinm0 at the same time +but this is actually not possible in hardware (because both share the +same bit for the function muxing). Since it is an impossible hardware +design, it is not deemed necessary to prevent the user from attempting +to "misconfigure" the pins/functions. + +Fixes: 87065ca9b8e5 ("pinctrl: rockchip: Add pinctrl support for PX30") +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20221017-upstream-px30-cif-clkoutm1-v1-0-4ea1389237f7@theobroma-systems.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 40 ++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index f0da98655794..bab7400493db 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -816,14 +816,54 @@ static void rockchip_get_recalced_mux(struct rockchip_pin_bank *bank, int pin, + } + + static struct rockchip_mux_route_data px30_mux_route_data[] = { ++ RK_MUXROUTE_SAME(2, RK_PB4, 1, 0x184, BIT(16 + 7)), /* cif-d0m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d0m1 */ ++ RK_MUXROUTE_SAME(2, RK_PB6, 1, 0x184, BIT(16 + 7)), /* cif-d1m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d1m1 */ + RK_MUXROUTE_SAME(2, RK_PA0, 1, 0x184, BIT(16 + 7)), /* cif-d2m0 */ + RK_MUXROUTE_SAME(3, RK_PA3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d2m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA1, 1, 0x184, BIT(16 + 7)), /* cif-d3m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA5, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d3m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA2, 1, 0x184, BIT(16 + 7)), /* cif-d4m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d4m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA3, 1, 0x184, BIT(16 + 7)), /* cif-d5m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d5m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA4, 1, 0x184, BIT(16 + 7)), /* cif-d6m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d6m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA5, 1, 0x184, BIT(16 + 7)), /* cif-d7m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB4, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d7m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA6, 1, 0x184, BIT(16 + 7)), /* cif-d8m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d8m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA7, 1, 0x184, BIT(16 + 7)), /* cif-d9m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d9m1 */ ++ RK_MUXROUTE_SAME(2, RK_PB7, 1, 0x184, BIT(16 + 7)), /* cif-d10m0 */ ++ RK_MUXROUTE_SAME(3, RK_PC6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d10m1 */ ++ RK_MUXROUTE_SAME(2, RK_PC0, 1, 0x184, BIT(16 + 7)), /* cif-d11m0 */ ++ RK_MUXROUTE_SAME(3, RK_PC7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d11m1 */ ++ RK_MUXROUTE_SAME(2, RK_PB0, 1, 0x184, BIT(16 + 7)), /* cif-vsyncm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-vsyncm1 */ ++ RK_MUXROUTE_SAME(2, RK_PB1, 1, 0x184, BIT(16 + 7)), /* cif-hrefm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-hrefm1 */ ++ RK_MUXROUTE_SAME(2, RK_PB2, 1, 0x184, BIT(16 + 7)), /* cif-clkinm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkinm1 */ ++ RK_MUXROUTE_SAME(2, RK_PB3, 1, 0x184, BIT(16 + 7)), /* cif-clkoutm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkoutm1 */ + RK_MUXROUTE_SAME(3, RK_PC6, 2, 0x184, BIT(16 + 8)), /* pdm-m0 */ + RK_MUXROUTE_SAME(2, RK_PC6, 1, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-m1 */ ++ RK_MUXROUTE_SAME(3, RK_PD3, 2, 0x184, BIT(16 + 8)), /* pdm-sdi0m0 */ ++ RK_MUXROUTE_SAME(2, RK_PC5, 2, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-sdi0m1 */ + RK_MUXROUTE_SAME(1, RK_PD3, 2, 0x184, BIT(16 + 10)), /* uart2-rxm0 */ + RK_MUXROUTE_SAME(2, RK_PB6, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-rxm1 */ ++ RK_MUXROUTE_SAME(1, RK_PD2, 2, 0x184, BIT(16 + 10)), /* uart2-txm0 */ ++ RK_MUXROUTE_SAME(2, RK_PB4, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-txm1 */ + RK_MUXROUTE_SAME(0, RK_PC1, 2, 0x184, BIT(16 + 9)), /* uart3-rxm0 */ + RK_MUXROUTE_SAME(1, RK_PB7, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rxm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC0, 2, 0x184, BIT(16 + 9)), /* uart3-txm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB6, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-txm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC2, 2, 0x184, BIT(16 + 9)), /* uart3-ctsm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB4, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-ctsm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC3, 2, 0x184, BIT(16 + 9)), /* uart3-rtsm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rtsm1 */ + }; + + static struct rockchip_mux_route_data rk3128_mux_route_data[] = { +-- +2.35.1 + diff --git a/queue-5.10/platform-x86-touchscreen_dmi-add-info-for-the-rca-ca.patch b/queue-5.10/platform-x86-touchscreen_dmi-add-info-for-the-rca-ca.patch new file mode 100644 index 00000000000..e043d2d5e0a --- /dev/null +++ b/queue-5.10/platform-x86-touchscreen_dmi-add-info-for-the-rca-ca.patch @@ -0,0 +1,66 @@ +From 869f42e0fc24b2abafdd2f06e9293db65137bc83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 16:11:31 +0200 +Subject: platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 + 2-in-1 + +From: Hans de Goede + +[ Upstream commit 0df044b34bf33e7e35c32b3bf6747fde6279c162 ] + +Add touchscreen info for the RCA Cambio W101 v2 2-in-1. + +Link: https://github.com/onitake/gsl-firmware/discussions/193 +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20221025141131.509211-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index ab6a9369649d..110ff1e6ef81 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -756,6 +756,22 @@ static const struct ts_dmi_data predia_basic_data = { + .properties = predia_basic_props, + }; + ++static const struct property_entry rca_cambio_w101_v2_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 4), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 20), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1644), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 874), ++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-rca-cambio-w101-v2.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ { } ++}; ++ ++static const struct ts_dmi_data rca_cambio_w101_v2_data = { ++ .acpi_name = "MSSL1680:00", ++ .properties = rca_cambio_w101_v2_props, ++}; ++ + static const struct property_entry rwc_nanote_p8_props[] = { + PROPERTY_ENTRY_U32("touchscreen-min-y", 46), + PROPERTY_ENTRY_U32("touchscreen-size-x", 1728), +@@ -1341,6 +1357,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_EXACT_MATCH(DMI_BOARD_NAME, "0E57"), + }, + }, ++ { ++ /* RCA Cambio W101 v2 */ ++ /* https://github.com/onitake/gsl-firmware/discussions/193 */ ++ .driver_data = (void *)&rca_cambio_w101_v2_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "RCA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "W101SA23T1"), ++ }, ++ }, + { + /* RWC NANOTE P8 */ + .driver_data = (void *)&rwc_nanote_p8_data, +-- +2.35.1 + diff --git a/queue-5.10/revert-net-macsec-report-real_dev-features-when-hw-o.patch b/queue-5.10/revert-net-macsec-report-real_dev-features-when-hw-o.patch new file mode 100644 index 00000000000..f666e1f3eea --- /dev/null +++ b/queue-5.10/revert-net-macsec-report-real_dev-features-when-hw-o.patch @@ -0,0 +1,114 @@ +From 3aa74921f29f5a3a059951412ae8b1027313b91a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 22:33:12 +0100 +Subject: Revert "net: macsec: report real_dev features when HW offloading is + enabled" + +From: Sabrina Dubroca + +[ Upstream commit 8bcd560ae8784da57c610d857118c5d6576b1a8f ] + +This reverts commit c850240b6c4132574a00f2da439277ab94265b66. + +That commit tried to improve the performance of macsec offload by +taking advantage of some of the NIC's features, but in doing so, broke +macsec offload when the lower device supports both macsec and ipsec +offload, as the ipsec offload feature flags (mainly NETIF_F_HW_ESP) +were copied from the real device. Since the macsec device doesn't +provide xdo_* ops, the XFRM core rejects the registration of the new +macsec device in xfrm_api_check. + +Example perf trace when running + ip link add link eni1np1 type macsec port 4 offload mac + + ip 737 [003] 795.477676: probe:xfrm_dev_event__REGISTER name="macsec0" features=0x1c000080014869 + xfrm_dev_event+0x3a + notifier_call_chain+0x47 + register_netdevice+0x846 + macsec_newlink+0x25a + + ip 737 [003] 795.477687: probe:xfrm_dev_event__return ret=0x8002 (NOTIFY_BAD) + notifier_call_chain+0x47 + register_netdevice+0x846 + macsec_newlink+0x25a + +dev->features includes NETIF_F_HW_ESP (0x04000000000000), so +xfrm_api_check returns NOTIFY_BAD because we don't have +dev->xfrmdev_ops on the macsec device. + +We could probably propagate GSO and a few other features from the +lower device, similar to macvlan. This will be done in a future patch. + +Signed-off-by: Sabrina Dubroca +Reviewed-by: Antoine Tenart +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macsec.c | 27 ++++----------------------- + 1 file changed, 4 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index f84e3cc0d3ec..c20ebf44acfe 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -2648,11 +2648,6 @@ static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info) + if (ret) + goto rollback; + +- /* Force features update, since they are different for SW MACSec and +- * HW offloading cases. +- */ +- netdev_update_features(dev); +- + rtnl_unlock(); + return 0; + +@@ -3420,16 +3415,9 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, + return ret; + } + +-#define SW_MACSEC_FEATURES \ ++#define MACSEC_FEATURES \ + (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST) + +-/* If h/w offloading is enabled, use real device features save for +- * VLAN_FEATURES - they require additional ops +- * HW_MACSEC - no reason to report it +- */ +-#define REAL_DEV_FEATURES(dev) \ +- ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC)) +- + static int macsec_dev_init(struct net_device *dev) + { + struct macsec_dev *macsec = macsec_priv(dev); +@@ -3446,12 +3434,8 @@ static int macsec_dev_init(struct net_device *dev) + return err; + } + +- if (macsec_is_offloaded(macsec)) { +- dev->features = REAL_DEV_FEATURES(real_dev); +- } else { +- dev->features = real_dev->features & SW_MACSEC_FEATURES; +- dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE; +- } ++ dev->features = real_dev->features & MACSEC_FEATURES; ++ dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE; + + dev->needed_headroom = real_dev->needed_headroom + + MACSEC_NEEDED_HEADROOM; +@@ -3480,10 +3464,7 @@ static netdev_features_t macsec_fix_features(struct net_device *dev, + struct macsec_dev *macsec = macsec_priv(dev); + struct net_device *real_dev = macsec->real_dev; + +- if (macsec_is_offloaded(macsec)) +- return REAL_DEV_FEATURES(real_dev); +- +- features &= (real_dev->features & SW_MACSEC_FEATURES) | ++ features &= (real_dev->features & MACSEC_FEATURES) | + NETIF_F_GSO_SOFTWARE | NETIF_F_SOFT_FEATURES; + features |= NETIF_F_LLTX; + +-- +2.35.1 + diff --git a/queue-5.10/risc-v-vdso-do-not-add-missing-symbols-to-version-se.patch b/queue-5.10/risc-v-vdso-do-not-add-missing-symbols-to-version-se.patch new file mode 100644 index 00000000000..dbddf9b4619 --- /dev/null +++ b/queue-5.10/risc-v-vdso-do-not-add-missing-symbols-to-version-se.patch @@ -0,0 +1,69 @@ +From eef9d30c5d34bd20f2156c6c97b467d8a697f9f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 10:13:23 -0700 +Subject: RISC-V: vdso: Do not add missing symbols to version section in linker + script + +From: Nathan Chancellor + +[ Upstream commit fcae44fd36d052e956e69a64642fc03820968d78 ] + +Recently, ld.lld moved from '--undefined-version' to +'--no-undefined-version' as the default, which breaks the compat vDSO +build: + + ld.lld: error: version script assignment of 'LINUX_4.15' to symbol '__vdso_gettimeofday' failed: symbol not defined + ld.lld: error: version script assignment of 'LINUX_4.15' to symbol '__vdso_clock_gettime' failed: symbol not defined + ld.lld: error: version script assignment of 'LINUX_4.15' to symbol '__vdso_clock_getres' failed: symbol not defined + +These symbols are not present in the compat vDSO or the regular vDSO for +32-bit but they are unconditionally included in the version section of +the linker script, which is prohibited with '--no-undefined-version'. + +Fix this issue by only including the symbols that are actually exported +in the version section of the linker script. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1756 +Signed-off-by: Nathan Chancellor +Tested-by: Conor Dooley +Link: https://lore.kernel.org/r/20221108171324.3377226-1-nathan@kernel.org/ +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/vdso/Makefile | 3 +++ + arch/riscv/kernel/vdso/vdso.lds.S | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index 926ab3960f9e..c92b55a0ec1c 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -28,6 +28,9 @@ obj-vdso := $(addprefix $(obj)/, $(obj-vdso)) + + obj-y += vdso.o vdso-syms.o + CPPFLAGS_vdso.lds += -P -C -U$(ARCH) ++ifneq ($(filter vgettimeofday, $(vdso-syms)),) ++CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY ++endif + + # Disable -pg to prevent insert call site + CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) +diff --git a/arch/riscv/kernel/vdso/vdso.lds.S b/arch/riscv/kernel/vdso/vdso.lds.S +index e6f558bca71b..b3e58402c342 100644 +--- a/arch/riscv/kernel/vdso/vdso.lds.S ++++ b/arch/riscv/kernel/vdso/vdso.lds.S +@@ -64,9 +64,11 @@ VERSION + LINUX_4.15 { + global: + __vdso_rt_sigreturn; ++#ifdef HAS_VGETTIMEOFDAY + __vdso_gettimeofday; + __vdso_clock_gettime; + __vdso_clock_getres; ++#endif + __vdso_getcpu; + __vdso_flush_icache; + local: *; +-- +2.35.1 + diff --git a/queue-5.10/riscv-dts-sifive-unleashed-add-pwm-controlled-leds.patch b/queue-5.10/riscv-dts-sifive-unleashed-add-pwm-controlled-leds.patch new file mode 100644 index 00000000000..6b604bbb04c --- /dev/null +++ b/queue-5.10/riscv-dts-sifive-unleashed-add-pwm-controlled-leds.patch @@ -0,0 +1,83 @@ +From 7fc2e55f46c21a9ff2c533a6c49caa6f81a89dd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 13:09:28 +0200 +Subject: riscv: dts: sifive unleashed: Add PWM controlled LEDs + +From: Emil Renner Berthing + +[ Upstream commit 8bc8824d30193eb7755043d5bb65fa7f0d11a595 ] + +This adds the 4 PWM controlled green LEDs to the HiFive Unleashed device +tree. The schematic doesn't specify any special function for the LEDs, +so they're added here without any default triggers and named d1, d2, d3 +and d4 just like in the schematic. + +Signed-off-by: Emil Renner Berthing +Reviewed-by: Conor Dooley +Tested-by: Conor Dooley +Link: https://lore.kernel.org/r/20221012110928.352910-1-emil.renner.berthing@canonical.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + .../boot/dts/sifive/hifive-unleashed-a00.dts | 38 +++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts +index 60846e88ae4b..dddabfbbc7a9 100644 +--- a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts ++++ b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts +@@ -3,6 +3,8 @@ + + #include "fu540-c000.dtsi" + #include ++#include ++#include + + /* Clock frequency (in Hz) of the PCB crystal for rtcclk */ + #define RTCCLK_FREQ 1000000 +@@ -46,6 +48,42 @@ + compatible = "gpio-restart"; + gpios = <&gpio 10 GPIO_ACTIVE_LOW>; + }; ++ ++ led-controller { ++ compatible = "pwm-leds"; ++ ++ led-d1 { ++ pwms = <&pwm0 0 7812500 PWM_POLARITY_INVERTED>; ++ active-low; ++ color = ; ++ max-brightness = <255>; ++ label = "d1"; ++ }; ++ ++ led-d2 { ++ pwms = <&pwm0 1 7812500 PWM_POLARITY_INVERTED>; ++ active-low; ++ color = ; ++ max-brightness = <255>; ++ label = "d2"; ++ }; ++ ++ led-d3 { ++ pwms = <&pwm0 2 7812500 PWM_POLARITY_INVERTED>; ++ active-low; ++ color = ; ++ max-brightness = <255>; ++ label = "d3"; ++ }; ++ ++ led-d4 { ++ pwms = <&pwm0 3 7812500 PWM_POLARITY_INVERTED>; ++ active-low; ++ color = ; ++ max-brightness = <255>; ++ label = "d4"; ++ }; ++ }; + }; + + &uart0 { +-- +2.35.1 + diff --git a/queue-5.10/scsi-ibmvfc-avoid-path-failures-during-live-migratio.patch b/queue-5.10/scsi-ibmvfc-avoid-path-failures-during-live-migratio.patch new file mode 100644 index 00000000000..902746f808c --- /dev/null +++ b/queue-5.10/scsi-ibmvfc-avoid-path-failures-during-live-migratio.patch @@ -0,0 +1,65 @@ +From 898bf0c21fcfc8e9f957a43f1875e4efb2c6a1bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 13:13:56 -0500 +Subject: scsi: ibmvfc: Avoid path failures during live migration + +From: Brian King + +[ Upstream commit 62fa3ce05d5d73c5eccc40b2db493f55fecfc446 ] + +Fix an issue reported when performing a live migration when multipath is +configured with a short fast fail timeout of 5 seconds and also to have +no_path_retry set to fail. In this scenario, all paths would go into the +devloss state while the ibmvfc driver went through discovery to log back +in. On a loaded system, the discovery might take longer than 5 seconds, +which was resulting in all paths being marked failed, which then resulted +in a read only filesystem. + +This patch changes the migration code in ibmvfc to avoid deleting rports at +all in this scenario, so we avoid losing all paths. + +Signed-off-by: Brian King +Link: https://lore.kernel.org/r/20221026181356.148517-1-brking@linux.vnet.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index f6d6539c657f..b793e342ab7c 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -635,8 +635,13 @@ static void ibmvfc_init_host(struct ibmvfc_host *vhost) + memset(vhost->async_crq.msgs, 0, PAGE_SIZE); + vhost->async_crq.cur = 0; + +- list_for_each_entry(tgt, &vhost->targets, queue) +- ibmvfc_del_tgt(tgt); ++ list_for_each_entry(tgt, &vhost->targets, queue) { ++ if (vhost->client_migrated) ++ tgt->need_login = 1; ++ else ++ ibmvfc_del_tgt(tgt); ++ } ++ + scsi_block_requests(vhost->host); + ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT); + vhost->job_step = ibmvfc_npiv_login; +@@ -2822,9 +2827,12 @@ static void ibmvfc_handle_crq(struct ibmvfc_crq *crq, struct ibmvfc_host *vhost) + /* We need to re-setup the interpartition connection */ + dev_info(vhost->dev, "Partition migrated, Re-enabling adapter\n"); + vhost->client_migrated = 1; ++ ++ scsi_block_requests(vhost->host); + ibmvfc_purge_requests(vhost, DID_REQUEUE); +- ibmvfc_link_down(vhost, IBMVFC_LINK_DOWN); ++ ibmvfc_set_host_state(vhost, IBMVFC_LINK_DOWN); + ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_REENABLE); ++ wake_up(&vhost->work_wait_q); + } else if (crq->format == IBMVFC_PARTNER_FAILED || crq->format == IBMVFC_PARTNER_DEREGISTER) { + dev_err(vhost->dev, "Host partner adapter deregistered or failed (rc=%d)\n", crq->format); + ibmvfc_purge_requests(vhost, DID_ERROR); +-- +2.35.1 + diff --git a/queue-5.10/scsi-scsi_debug-make-the-read-capacity-response-comp.patch b/queue-5.10/scsi-scsi_debug-make-the-read-capacity-response-comp.patch new file mode 100644 index 00000000000..ff887ea6f17 --- /dev/null +++ b/queue-5.10/scsi-scsi_debug-make-the-read-capacity-response-comp.patch @@ -0,0 +1,59 @@ +From f9429c34812c2147f2b6309f2b19c1fecc6780f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 12:32:48 -0700 +Subject: scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC + +From: Bart Van Assche + +[ Upstream commit ecb8c2580d37dbb641451049376d80c8afaa387f ] + +From ZBC-1: + + - RC BASIS = 0: The RETURNED LOGICAL BLOCK ADDRESS field indicates the + highest LBA of a contiguous range of zones that are not sequential write + required zones starting with the first zone. + + - RC BASIS = 1: The RETURNED LOGICAL BLOCK ADDRESS field indicates the LBA + of the last logical block on the logical unit. + +The current scsi_debug READ CAPACITY response does not comply with the +above if there are one or more sequential write required zones. SCSI +initiators need a way to retrieve the largest valid LBA from SCSI +devices. Reporting the largest valid LBA if there are one or more +sequential zones requires to set the RC BASIS field in the READ CAPACITY +response to one. Hence this patch. + +Cc: Douglas Gilbert +Cc: Damien Le Moal +Suggested-by: Damien Le Moal +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20221102193248.3177608-1-bvanassche@acm.org +Reviewed-by: Damien Le Moal +Acked-by: Douglas Gilbert +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 261b915835b4..cc20621bb49d 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -1878,6 +1878,13 @@ static int resp_readcap16(struct scsi_cmnd *scp, + arr[14] |= 0x40; + } + ++ /* ++ * Since the scsi_debug READ CAPACITY implementation always reports the ++ * total disk capacity, set RC BASIS = 1 for host-managed ZBC devices. ++ */ ++ if (devip->zmodel == BLK_ZONED_HM) ++ arr[12] |= 1 << 4; ++ + arr[15] = sdebug_lowest_aligned & 0xff; + + if (have_dif_prot) { +-- +2.35.1 + diff --git a/queue-5.10/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch b/queue-5.10/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch new file mode 100644 index 00000000000..e9db4da1acb --- /dev/null +++ b/queue-5.10/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch @@ -0,0 +1,77 @@ +From 042629930b9691bbc6a26b861fdb5f84c4ce252b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 20:48:28 +0800 +Subject: scsi: scsi_transport_sas: Fix error handling in sas_phy_add() + +From: Yang Yingliang + +[ Upstream commit 5d7bebf2dfb0dc97aac1fbace0910e557ecdb16f ] + +If transport_add_device() fails in sas_phy_add(), the kernel will crash +trying to delete the device in transport_remove_device() called from +sas_remove_host(). + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 +CPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc1+ #173 +pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : device_del+0x54/0x3d0 +lr : device_del+0x37c/0x3d0 +Call trace: + device_del+0x54/0x3d0 + attribute_container_class_device_del+0x28/0x38 + transport_remove_classdev+0x6c/0x80 + attribute_container_device_trigger+0x108/0x110 + transport_remove_device+0x28/0x38 + sas_phy_delete+0x30/0x60 [scsi_transport_sas] + do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas] + device_for_each_child+0x68/0xb0 + sas_remove_children+0x40/0x50 [scsi_transport_sas] + sas_remove_host+0x20/0x38 [scsi_transport_sas] + hisi_sas_remove+0x40/0x68 [hisi_sas_main] + hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw] + platform_remove+0x2c/0x60 + +Fix this by checking and handling return value of transport_add_device() +in sas_phy_add(). + +Fixes: c7ebbbce366c ("[SCSI] SAS transport class") +Suggested-by: John Garry +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221107124828.115557-1-yangyingliang@huawei.com +Reviewed-by: John Garry +Reviewed-by: Jason Yan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_sas.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c +index 4a96fb05731d..c6256fdc24b1 100644 +--- a/drivers/scsi/scsi_transport_sas.c ++++ b/drivers/scsi/scsi_transport_sas.c +@@ -716,12 +716,17 @@ int sas_phy_add(struct sas_phy *phy) + int error; + + error = device_add(&phy->dev); +- if (!error) { +- transport_add_device(&phy->dev); +- transport_configure_device(&phy->dev); ++ if (error) ++ return error; ++ ++ error = transport_add_device(&phy->dev); ++ if (error) { ++ device_del(&phy->dev); ++ return error; + } ++ transport_configure_device(&phy->dev); + +- return error; ++ return 0; + } + EXPORT_SYMBOL(sas_phy_add); + +-- +2.35.1 + diff --git a/queue-5.10/selftests-bpf-add-verifier-test-for-release_referenc.patch b/queue-5.10/selftests-bpf-add-verifier-test-for-release_referenc.patch new file mode 100644 index 00000000000..b8c8813c071 --- /dev/null +++ b/queue-5.10/selftests-bpf-add-verifier-test-for-release_referenc.patch @@ -0,0 +1,86 @@ +From 72e4a4ddf1ac47ffbc9ab12a0c26f7d5c3142542 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 17:34:40 +0800 +Subject: selftests/bpf: Add verifier test for release_reference() + +From: Youlin Li + +[ Upstream commit 475244f5e06beeda7b557d9dde46a5f439bf3379 ] + +Add a test case to ensure that released pointer registers will not be +leaked into the map. + +Before fix: + + ./test_verifier 984 + 984/u reference tracking: try to leak released ptr reg FAIL + Unexpected success to load! + verification time 67 usec + stack depth 4 + processed 23 insns (limit 1000000) max_states_per_insn 0 total_states 2 + peak_states 2 mark_read 1 + 984/p reference tracking: try to leak released ptr reg OK + Summary: 1 PASSED, 0 SKIPPED, 1 FAILED + +After fix: + + ./test_verifier 984 + 984/u reference tracking: try to leak released ptr reg OK + 984/p reference tracking: try to leak released ptr reg OK + Summary: 2 PASSED, 0 SKIPPED, 0 FAILED + +Signed-off-by: Youlin Li +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20221103093440.3161-2-liulin063@gmail.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/verifier/ref_tracking.c | 36 +++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c +index 006b5bd99c08..525d810b10b8 100644 +--- a/tools/testing/selftests/bpf/verifier/ref_tracking.c ++++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c +@@ -901,3 +901,39 @@ + .result_unpriv = REJECT, + .errstr_unpriv = "unknown func", + }, ++{ ++ "reference tracking: try to leak released ptr reg", ++ .insns = { ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), ++ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), ++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), ++ BPF_LD_MAP_FD(BPF_REG_1, 0), ++ BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), ++ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), ++ BPF_EXIT_INSN(), ++ BPF_MOV64_REG(BPF_REG_9, BPF_REG_0), ++ ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_LD_MAP_FD(BPF_REG_1, 0), ++ BPF_MOV64_IMM(BPF_REG_2, 8), ++ BPF_MOV64_IMM(BPF_REG_3, 0), ++ BPF_EMIT_CALL(BPF_FUNC_ringbuf_reserve), ++ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), ++ BPF_EXIT_INSN(), ++ BPF_MOV64_REG(BPF_REG_8, BPF_REG_0), ++ ++ BPF_MOV64_REG(BPF_REG_1, BPF_REG_8), ++ BPF_MOV64_IMM(BPF_REG_2, 0), ++ BPF_EMIT_CALL(BPF_FUNC_ringbuf_discard), ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ ++ BPF_STX_MEM(BPF_DW, BPF_REG_9, BPF_REG_8, 0), ++ BPF_EXIT_INSN() ++ }, ++ .fixup_map_array_48b = { 4 }, ++ .fixup_map_ringbuf = { 11 }, ++ .result = ACCEPT, ++ .result_unpriv = REJECT, ++ .errstr_unpriv = "R8 !read_ok" ++}, +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index e69de29bb2d..502d6f98b66 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -0,0 +1,33 @@ +pinctrl-rockchip-do-coding-style-for-mux-route-struc.patch +pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch +scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch +ata-libata-scsi-simplify-__ata_scsi_queuecmd.patch +ata-libata-core-do-not-issue-non-internal-commands-o.patch +bridge-switchdev-notify-about-vlan-protocol-changes.patch +bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch +drm-display-don-t-assume-dual-mode-adaptors-support-.patch +nvme-add-a-bogus-subsystem-nqn-quirk-for-micron-mtfd.patch +nvme-pci-add-nvme_quirk_bogus_nid-for-micron-nitro.patch +speakup-generate-speakupmap.h-automatically.patch +speakup-replace-utils-u_char-with-unsigned-char.patch +iio-ms5611-simplify-io-callback-parameters.patch +iio-pressure-ms5611-fixed-value-compensation-bug.patch +ceph-do-not-update-snapshot-context-when-there-is-no.patch +ceph-avoid-putting-the-realm-twice-when-decoding-sna.patch +wifi-mac80211-fix-memory-free-error-when-registering.patch +wifi-mac80211_hwsim-fix-debugfs-attribute-ps-with-rc.patch +riscv-dts-sifive-unleashed-add-pwm-controlled-leds.patch +audit-fix-undefined-behavior-in-bit-shift-for-audit_.patch +wifi-airo-do-not-assign-1-to-unsigned-char.patch +wifi-mac80211-fix-ack-frame-idr-leak-when-mesh-has-n.patch +spi-stm32-fix-stm32_spi_prepare_mbr-that-halves-spi-.patch +selftests-bpf-add-verifier-test-for-release_referenc.patch +revert-net-macsec-report-real_dev-features-when-hw-o.patch +platform-x86-touchscreen_dmi-add-info-for-the-rca-ca.patch +scsi-ibmvfc-avoid-path-failures-during-live-migratio.patch +scsi-scsi_debug-make-the-read-capacity-response-comp.patch +drm-panel-orientation-quirks-add-quirk-for-acer-swit.patch +block-bfq-fix-null-pointer-dereference-in-bfq_bio_bf.patch +arm64-syscall-include-asm-ptrace.h-in-syscall_wrappe.patch +risc-v-vdso-do-not-add-missing-symbols-to-version-se.patch +mips-pic32-treat-port-as-signed-integer.patch diff --git a/queue-5.10/speakup-generate-speakupmap.h-automatically.patch b/queue-5.10/speakup-generate-speakupmap.h-automatically.patch new file mode 100644 index 00000000000..b3065e33a24 --- /dev/null +++ b/queue-5.10/speakup-generate-speakupmap.h-automatically.patch @@ -0,0 +1,563 @@ +From 07e6e8258190d72818dd94a516e32ccdebc92041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 19:22:44 +0200 +Subject: speakup: Generate speakupmap.h automatically + +From: Samuel Thibault + +[ Upstream commit 6646b95aab5f62c049f1416a3801dec5432c348b ] + +speakupmap.h was not actually intended to be source code, speakupmap.map +is. + +This resurrects the makemapdata.c and genmap.c tools to generate +speakupmap.h automatically from the input and speakup headers, and the +speakupmap.map keyboard mapping source file. + +Signed-off-by: Samuel Thibault +Link: https://lore.kernel.org/r/20220515230358.ikwt2kspiwvv5cf4@begin +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 92ca969ff881 ("speakup: replace utils' u_char with unsigned char") +Signed-off-by: Sasha Levin +--- + drivers/accessibility/speakup/.gitignore | 4 + + drivers/accessibility/speakup/Makefile | 28 ++++ + drivers/accessibility/speakup/genmap.c | 162 ++++++++++++++++++++ + drivers/accessibility/speakup/makemapdata.c | 125 +++++++++++++++ + drivers/accessibility/speakup/speakupmap.h | 66 -------- + drivers/accessibility/speakup/utils.h | 102 ++++++++++++ + 6 files changed, 421 insertions(+), 66 deletions(-) + create mode 100644 drivers/accessibility/speakup/.gitignore + create mode 100644 drivers/accessibility/speakup/genmap.c + create mode 100644 drivers/accessibility/speakup/makemapdata.c + delete mode 100644 drivers/accessibility/speakup/speakupmap.h + create mode 100644 drivers/accessibility/speakup/utils.h + +diff --git a/drivers/accessibility/speakup/.gitignore b/drivers/accessibility/speakup/.gitignore +new file mode 100644 +index 000000000000..ac084679fea7 +--- /dev/null ++++ b/drivers/accessibility/speakup/.gitignore +@@ -0,0 +1,4 @@ ++/makemapdata ++/mapdata.h ++/genmap ++/speakupmap.h +diff --git a/drivers/accessibility/speakup/Makefile b/drivers/accessibility/speakup/Makefile +index 6e4bfac8af65..ba69b0803d42 100644 +--- a/drivers/accessibility/speakup/Makefile ++++ b/drivers/accessibility/speakup/Makefile +@@ -30,3 +30,31 @@ speakup-y := \ + thread.o \ + varhandlers.o + speakup-$(CONFIG_SPEAKUP_SERIALIO) += serialio.o ++ ++ ++clean-files := mapdata.h speakupmap.h ++ ++ ++# Generate mapdata.h from headers ++hostprogs += makemapdata ++makemapdata-objs := makemapdata.o ++ ++quiet_cmd_mkmap = MKMAP $@ ++ cmd_mkmap = TOPDIR=$(srctree) $(obj)/makemapdata > $@ ++ ++$(obj)/mapdata.h: $(obj)/makemapdata ++ $(call cmd,mkmap) ++ ++ ++# Generate speakupmap.h from mapdata.h ++hostprogs += genmap ++genmap-objs := genmap.o ++$(obj)/genmap.o: $(obj)/mapdata.h ++ ++quiet_cmd_genmap = GENMAP $@ ++ cmd_genmap = $(obj)/genmap $< > $@ ++ ++$(obj)/speakupmap.h: $(src)/speakupmap.map $(obj)/genmap ++ $(call cmd,genmap) ++ ++$(obj)/main.o: $(obj)/speakupmap.h +diff --git a/drivers/accessibility/speakup/genmap.c b/drivers/accessibility/speakup/genmap.c +new file mode 100644 +index 000000000000..0125000e00d9 +--- /dev/null ++++ b/drivers/accessibility/speakup/genmap.c +@@ -0,0 +1,162 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++/* genmap.c ++ * originally written by: Kirk Reiser. ++ * ++ ** Copyright (C) 2002 Kirk Reiser. ++ * Copyright (C) 2003 David Borowski. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include "utils.h" ++ ++struct st_key_init { ++ char *name; ++ int value, shift; ++}; ++ ++static unsigned char key_data[MAXKEYVAL][16], *kp; ++ ++#include "mapdata.h" ++ ++static const char delims[] = "\t\n "; ++static char *cp; ++static int map_ver = 119; /* an arbitrary number so speakup can check */ ++static int shift_table[17]; ++static int max_states = 1, flags; ++/* flags reserved for later, maybe for individual console maps */ ++ ++static int get_shift_value(int state) ++{ ++ int i; ++ ++ for (i = 0; shift_table[i] != state; i++) { ++ if (shift_table[i] == -1) { ++ if (i >= 16) ++ oops("too many shift states", NULL); ++ shift_table[i] = state; ++ max_states = i+1; ++ break; ++ } ++ } ++ return i; ++} ++ ++int ++main(int argc, char *argv[]) ++{ ++ int value, shift_state, i, spk_val = 0, lock_val = 0; ++ int max_key_used = 0, num_keys_used = 0; ++ struct st_key *this; ++ struct st_key_init *p_init; ++ char buffer[256]; ++ ++ bzero(key_table, sizeof(key_table)); ++ bzero(key_data, sizeof(key_data)); ++ ++ shift_table[0] = 0; ++ for (i = 1; i <= 16; i++) ++ shift_table[i] = -1; ++ ++ if (argc < 2) { ++ fputs("usage: genmap filename\n", stderr); ++ exit(1); ++ } ++ ++ for (p_init = init_key_data; p_init->name[0] != '.'; p_init++) ++ add_key(p_init->name, p_init->value, p_init->shift); ++ ++ open_input(NULL, argv[1]); ++ while (fgets(buffer, sizeof(buffer), infile)) { ++ lc++; ++ value = shift_state = 0; ++ ++ cp = strtok(buffer, delims); ++ if (*cp == '#') ++ continue; ++ ++ while (cp) { ++ if (*cp == '=') ++ break; ++ this = find_key(cp); ++ if (this == NULL) ++ oops("unknown key/modifier", cp); ++ if (this->shift == is_shift) { ++ if (value) ++ oops("modifiers must come first", cp); ++ shift_state += this->value; ++ } else if (this->shift == is_input) ++ value = this->value; ++ else ++ oops("bad modifier or key", cp); ++ cp = strtok(0, delims); ++ } ++ if (!cp) ++ oops("no = found", NULL); ++ ++ cp = strtok(0, delims); ++ if (!cp) ++ oops("no speakup function after =", NULL); ++ ++ this = find_key(cp); ++ if (this == NULL || this->shift != is_spk) ++ oops("invalid speakup function", cp); ++ ++ i = get_shift_value(shift_state); ++ if (key_data[value][i]) { ++ while (--cp > buffer) ++ if (!*cp) ++ *cp = ' '; ++ oops("two functions on same key combination", cp); ++ } ++ key_data[value][i] = (char)this->value; ++ if (value > max_key_used) ++ max_key_used = value; ++ } ++ fclose(infile); ++ ++ this = find_key("spk_key"); ++ if (this) ++ spk_val = this->value; ++ ++ this = find_key("spk_lock"); ++ if (this) ++ lock_val = this->value; ++ ++ for (lc = 1; lc <= max_key_used; lc++) { ++ kp = key_data[lc]; ++ if (!memcmp(key_data[0], kp, 16)) ++ continue; ++ num_keys_used++; ++ for (i = 0; i < max_states; i++) { ++ if (kp[i] != spk_val && kp[i] != lock_val) ++ continue; ++ shift_state = shift_table[i]; ++ if (shift_state&16) ++ continue; ++ shift_state = get_shift_value(shift_state+16); ++ kp[shift_state] = kp[i]; ++ /* fill in so we can process the key up, as spk bit will be set */ ++ } ++ } ++ ++ printf("\t%d, %d, %d,\n\t", map_ver, num_keys_used, max_states); ++ for (i = 0; i < max_states; i++) ++ printf("%d, ", shift_table[i]); ++ printf("%d,", flags); ++ for (lc = 1; lc <= max_key_used; lc++) { ++ kp = key_data[lc]; ++ if (!memcmp(key_data[0], kp, 16)) ++ continue; ++ printf("\n\t%d,", lc); ++ for (i = 0; i < max_states; i++) ++ printf(" %d,", (unsigned int)kp[i]); ++ } ++ printf("\n\t0, %d\n", map_ver); ++ ++ exit(0); ++} +diff --git a/drivers/accessibility/speakup/makemapdata.c b/drivers/accessibility/speakup/makemapdata.c +new file mode 100644 +index 000000000000..81db9ebf1fff +--- /dev/null ++++ b/drivers/accessibility/speakup/makemapdata.c +@@ -0,0 +1,125 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++/* makemapdata.c ++ * originally written by: Kirk Reiser. ++ * ++ ** Copyright (C) 2002 Kirk Reiser. ++ * Copyright (C) 2003 David Borowski. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include "utils.h" ++ ++static char buffer[256]; ++ ++static int get_define(void) ++{ ++ char *c; ++ ++ while (fgets(buffer, sizeof(buffer)-1, infile)) { ++ lc++; ++ if (strncmp(buffer, "#define", 7)) ++ continue; ++ c = buffer + 7; ++ while (*c == ' ' || *c == '\t') ++ c++; ++ def_name = c; ++ while (*c && *c != ' ' && *c != '\t' && *c != '\n') ++ c++; ++ if (!*c || *c == '\n') ++ continue; ++ *c++ = '\0'; ++ while (*c == ' ' || *c == '\t' || *c == '(') ++ c++; ++ def_val = c; ++ while (*c && *c != '\n' && *c != ')') ++ c++; ++ *c++ = '\0'; ++ return 1; ++ } ++ fclose(infile); ++ infile = 0; ++ return 0; ++} ++ ++int ++main(int argc, char *argv[]) ++{ ++ int value, i; ++ struct st_key *this; ++ const char *dir_name; ++ char *cp; ++ ++ dir_name = getenv("TOPDIR"); ++ if (!dir_name) ++ dir_name = "."; ++ bzero(key_table, sizeof(key_table)); ++ add_key("shift", 1, is_shift); ++ add_key("altgr", 2, is_shift); ++ add_key("ctrl", 4, is_shift); ++ add_key("alt", 8, is_shift); ++ add_key("spk", 16, is_shift); ++ add_key("double", 32, is_shift); ++ ++ open_input(dir_name, "include/linux/input.h"); ++ while (get_define()) { ++ if (strncmp(def_name, "KEY_", 4)) ++ continue; ++ value = atoi(def_val); ++ if (value > 0 && value < MAXKEYVAL) ++ add_key(def_name, value, is_input); ++ } ++ ++ open_input(dir_name, "include/uapi/linux/input-event-codes.h"); ++ while (get_define()) { ++ if (strncmp(def_name, "KEY_", 4)) ++ continue; ++ value = atoi(def_val); ++ if (value > 0 && value < MAXKEYVAL) ++ add_key(def_name, value, is_input); ++ } ++ ++ open_input(dir_name, "drivers/accessibility/speakup/spk_priv_keyinfo.h"); ++ while (get_define()) { ++ if (strlen(def_val) > 5) { ++ //if (def_val[0] == '(') ++ // def_val++; ++ cp = strchr(def_val, '+'); ++ if (!cp) ++ continue; ++ if (cp[-1] == ' ') ++ cp[-1] = '\0'; ++ *cp++ = '\0'; ++ this = find_key(def_val); ++ while (*cp == ' ') ++ cp++; ++ if (!this || *cp < '0' || *cp > '9') ++ continue; ++ value = this->value+atoi(cp); ++ } else if (!strncmp(def_val, "0x", 2)) ++ sscanf(def_val+2, "%x", &value); ++ else if (*def_val >= '0' && *def_val <= '9') ++ value = atoi(def_val); ++ else ++ continue; ++ add_key(def_name, value, is_spk); ++ } ++ ++ printf("struct st_key_init init_key_data[] = {\n"); ++ for (i = 0; i < HASHSIZE; i++) { ++ this = &key_table[i]; ++ if (!this->name) ++ continue; ++ do { ++ printf("\t{ \"%s\", %d, %d, },\n", this->name, this->value, this->shift); ++ this = this->next; ++ } while (this); ++ } ++ printf("\t{ \".\", 0, 0 }\n};\n"); ++ ++ exit(0); ++} +diff --git a/drivers/accessibility/speakup/speakupmap.h b/drivers/accessibility/speakup/speakupmap.h +deleted file mode 100644 +index c60d7339b89a..000000000000 +--- a/drivers/accessibility/speakup/speakupmap.h ++++ /dev/null +@@ -1,66 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +- 119, 62, 6, +- 0, 16, 20, 17, 32, 48, 0, +- 2, 0, 78, 0, 0, 0, 0, +- 3, 0, 79, 0, 0, 0, 0, +- 4, 0, 76, 0, 0, 0, 0, +- 5, 0, 77, 0, 0, 0, 0, +- 6, 0, 74, 0, 0, 0, 0, +- 7, 0, 75, 0, 0, 0, 0, +- 9, 0, 5, 46, 0, 0, 0, +- 10, 0, 4, 0, 0, 0, 0, +- 11, 0, 0, 1, 0, 0, 0, +- 12, 0, 27, 0, 33, 0, 0, +- 19, 0, 47, 0, 0, 0, 0, +- 21, 0, 29, 17, 0, 0, 0, +- 22, 0, 15, 0, 0, 0, 0, +- 23, 0, 14, 0, 0, 0, 28, +- 24, 0, 16, 0, 0, 0, 0, +- 25, 0, 30, 18, 0, 0, 0, +- 28, 0, 3, 26, 0, 0, 0, +- 35, 0, 31, 0, 0, 0, 0, +- 36, 0, 12, 0, 0, 0, 0, +- 37, 0, 11, 0, 0, 0, 22, +- 38, 0, 13, 0, 0, 0, 0, +- 39, 0, 32, 7, 0, 0, 0, +- 40, 0, 23, 0, 0, 0, 0, +- 44, 0, 44, 0, 0, 0, 0, +- 49, 0, 24, 0, 0, 0, 0, +- 50, 0, 9, 19, 6, 0, 0, +- 51, 0, 8, 0, 0, 0, 36, +- 52, 0, 10, 20, 0, 0, 0, +- 53, 0, 25, 0, 0, 0, 0, +- 55, 46, 1, 0, 0, 0, 0, +- 58, 128, 128, 0, 0, 0, 0, +- 59, 0, 45, 0, 0, 0, 0, +- 60, 0, 40, 0, 0, 0, 0, +- 61, 0, 41, 0, 0, 0, 0, +- 62, 0, 42, 0, 0, 0, 0, +- 63, 0, 34, 0, 0, 0, 0, +- 64, 0, 35, 0, 0, 0, 0, +- 65, 0, 37, 0, 0, 0, 0, +- 66, 0, 38, 0, 0, 0, 0, +- 67, 0, 66, 0, 39, 0, 0, +- 68, 0, 67, 0, 0, 0, 0, +- 71, 15, 19, 0, 0, 0, 0, +- 72, 14, 29, 0, 0, 28, 0, +- 73, 16, 17, 0, 0, 0, 0, +- 74, 27, 33, 0, 0, 0, 0, +- 75, 12, 31, 0, 0, 0, 0, +- 76, 11, 21, 0, 0, 22, 0, +- 77, 13, 32, 0, 0, 0, 0, +- 78, 23, 43, 0, 0, 0, 0, +- 79, 9, 20, 0, 0, 0, 0, +- 80, 8, 30, 0, 0, 36, 0, +- 81, 10, 18, 0, 0, 0, 0, +- 82, 128, 128, 0, 0, 0, 0, +- 83, 24, 25, 0, 0, 0, 0, +- 87, 0, 68, 0, 0, 0, 0, +- 88, 0, 69, 0, 0, 0, 0, +- 96, 3, 26, 0, 0, 0, 0, +- 98, 4, 5, 0, 0, 0, 0, +- 99, 2, 0, 0, 0, 0, 0, +- 104, 0, 6, 0, 0, 0, 0, +- 109, 0, 7, 0, 0, 0, 0, +- 125, 128, 128, 0, 0, 0, 0, +- 0, 119 +diff --git a/drivers/accessibility/speakup/utils.h b/drivers/accessibility/speakup/utils.h +new file mode 100644 +index 000000000000..4bf2ee8ac246 +--- /dev/null ++++ b/drivers/accessibility/speakup/utils.h +@@ -0,0 +1,102 @@ ++/* SPDX-License-Identifier: GPL-2.0+ */ ++/* utils.h ++ * originally written by: Kirk Reiser. ++ * ++ ** Copyright (C) 2002 Kirk Reiser. ++ * Copyright (C) 2003 David Borowski. ++ */ ++ ++#include ++ ++#define MAXKEYS 512 ++#define MAXKEYVAL 160 ++#define HASHSIZE 101 ++#define is_shift -3 ++#define is_spk -2 ++#define is_input -1 ++ ++struct st_key { ++ char *name; ++ struct st_key *next; ++ int value, shift; ++}; ++ ++struct st_key key_table[MAXKEYS]; ++struct st_key *extra_keys = key_table+HASHSIZE; ++char *def_name, *def_val; ++FILE *infile; ++int lc; ++ ++char filename[256]; ++ ++static inline void open_input(const char *dir_name, const char *name) ++{ ++ if (dir_name) ++ snprintf(filename, sizeof(filename), "%s/%s", dir_name, name); ++ else ++ snprintf(filename, sizeof(filename), "%s", name); ++ infile = fopen(filename, "r"); ++ if (infile == 0) { ++ fprintf(stderr, "can't open %s\n", filename); ++ exit(1); ++ } ++ lc = 0; ++} ++ ++static inline int oops(const char *msg, const char *info) ++{ ++ if (info == NULL) ++ info = ""; ++ fprintf(stderr, "error: file %s line %d\n", filename, lc); ++ fprintf(stderr, "%s %s\n", msg, info); ++ exit(1); ++} ++ ++static inline struct st_key *hash_name(char *name) ++{ ++ u_char *pn = (u_char *)name; ++ int hash = 0; ++ ++ while (*pn) { ++ hash = (hash * 17) & 0xfffffff; ++ if (isupper(*pn)) ++ *pn = tolower(*pn); ++ hash += (int)*pn; ++ pn++; ++ } ++ hash %= HASHSIZE; ++ return &key_table[hash]; ++} ++ ++static inline struct st_key *find_key(char *name) ++{ ++ struct st_key *this = hash_name(name); ++ ++ while (this) { ++ if (this->name && !strcmp(name, this->name)) ++ return this; ++ this = this->next; ++ } ++ return this; ++} ++ ++static inline struct st_key *add_key(char *name, int value, int shift) ++{ ++ struct st_key *this = hash_name(name); ++ ++ if (extra_keys-key_table >= MAXKEYS) ++ oops("out of key table space, enlarge MAXKEYS", NULL); ++ if (this->name != NULL) { ++ while (this->next) { ++ if (!strcmp(name, this->name)) ++ oops("attempt to add duplicate key", name); ++ this = this->next; ++ } ++ this->next = extra_keys++; ++ this = this->next; ++ } ++ this->name = strdup(name); ++ this->value = value; ++ this->shift = shift; ++ return this; ++} +-- +2.35.1 + diff --git a/queue-5.10/speakup-replace-utils-u_char-with-unsigned-char.patch b/queue-5.10/speakup-replace-utils-u_char-with-unsigned-char.patch new file mode 100644 index 00000000000..ecb40f5e86a --- /dev/null +++ b/queue-5.10/speakup-replace-utils-u_char-with-unsigned-char.patch @@ -0,0 +1,46 @@ +From 2837a523b2a53ba04d17c49cfdda1f3078429a9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 15:09:36 +0700 +Subject: speakup: replace utils' u_char with unsigned char +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Đoàn Trần Công Danh + +[ Upstream commit 92ca969ff8815f3feef2645199bd39bf594e5eeb ] + +drivers/accessibility/speakup/utils.h will be used to compile host tool +to generate metadata. + +"u_char" is a non-standard type, which is defined to "unsigned char" +on glibc but not defined by some libc, e.g. musl. + +Let's replace "u_char" with "unsigned char" + +Signed-off-by: Đoàn Trần Công Danh +Reviewed-by: Samuel Thibault +Cc: stable +Link: https://lore.kernel.org/r/b75743026aaee2d81efe3d7f2e8fa47f7d0b8ea7.1665736571.git.congdanhqx@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/accessibility/speakup/utils.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/accessibility/speakup/utils.h b/drivers/accessibility/speakup/utils.h +index 4bf2ee8ac246..4ce9a12f7664 100644 +--- a/drivers/accessibility/speakup/utils.h ++++ b/drivers/accessibility/speakup/utils.h +@@ -54,7 +54,7 @@ static inline int oops(const char *msg, const char *info) + + static inline struct st_key *hash_name(char *name) + { +- u_char *pn = (u_char *)name; ++ unsigned char *pn = (unsigned char *)name; + int hash = 0; + + while (*pn) { +-- +2.35.1 + diff --git a/queue-5.10/spi-stm32-fix-stm32_spi_prepare_mbr-that-halves-spi-.patch b/queue-5.10/spi-stm32-fix-stm32_spi_prepare_mbr-that-halves-spi-.patch new file mode 100644 index 00000000000..19065666b60 --- /dev/null +++ b/queue-5.10/spi-stm32-fix-stm32_spi_prepare_mbr-that-halves-spi-.patch @@ -0,0 +1,51 @@ +From 8901c97d1132a847a7caa0fc214a735816ea3cfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 09:00:42 +0100 +Subject: spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every + run + +From: Sean Nyekjaer + +[ Upstream commit 62aa1a344b0904549f6de7af958e8a1136fd5228 ] + +When this driver is used with a driver that uses preallocated spi_transfer +structs. The speed_hz is halved by every run. This results in: + +spi_stm32 44004000.spi: SPI transfer setup failed +ads7846 spi0.0: SPI transfer failed: -22 + +Example when running with DIV_ROUND_UP(): +- First run; speed_hz = 1000000, spi->clk_rate 125000000 + div 125 -> mbrdiv = 7, cur_speed = 976562 +- Second run; speed_hz = 976562 + div 128,00007 (roundup to 129) -> mbrdiv = 8, cur_speed = 488281 +- Third run; speed_hz = 488281 + div 256,000131072067109 (roundup to 257) and then -EINVAL is returned. + +Use DIV_ROUND_CLOSEST to allow to round down and allow us to keep the +set speed. + +Signed-off-by: Sean Nyekjaer +Link: https://lore.kernel.org/r/20221103080043.3033414-1-sean@geanix.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 651a6510fb54..9ec37cf10c01 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -443,7 +443,7 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, + u32 div, mbrdiv; + + /* Ensure spi->clk_rate is even */ +- div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); ++ div = DIV_ROUND_CLOSEST(spi->clk_rate & ~0x1, speed_hz); + + /* + * SPI framework set xfer->speed_hz to master->max_speed_hz if +-- +2.35.1 + diff --git a/queue-5.10/wifi-airo-do-not-assign-1-to-unsigned-char.patch b/queue-5.10/wifi-airo-do-not-assign-1-to-unsigned-char.patch new file mode 100644 index 00000000000..79a367599da --- /dev/null +++ b/queue-5.10/wifi-airo-do-not-assign-1-to-unsigned-char.patch @@ -0,0 +1,75 @@ +From b0a0ea58e25de08c51f3afb1497ded9f0477a49e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 18:28:43 +0200 +Subject: wifi: airo: do not assign -1 to unsigned char + +From: Jason A. Donenfeld + +[ Upstream commit e6cb8769452e8236b52134e5cb4a18b8f5986932 ] + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, we get a warning when assigning the +unchecked output of hex_to_bin() to that unsigned char. Mark `key` as a +`u8`, which matches the struct's type, and then check each call to +hex_to_bin() before casting. + +Cc: Kalle Valo +Cc: linux-wireless@vger.kernel.org +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221024162843.535921-1-Jason@zx2c4.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/cisco/airo.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c +index 0569f37e9ed5..8c9c6bfbaeee 100644 +--- a/drivers/net/wireless/cisco/airo.c ++++ b/drivers/net/wireless/cisco/airo.c +@@ -5236,7 +5236,7 @@ static int get_wep_tx_idx(struct airo_info *ai) + return -1; + } + +-static int set_wep_key(struct airo_info *ai, u16 index, const char *key, ++static int set_wep_key(struct airo_info *ai, u16 index, const u8 *key, + u16 keylen, int perm, int lock) + { + static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 }; +@@ -5287,7 +5287,7 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file) + struct net_device *dev = PDE_DATA(inode); + struct airo_info *ai = dev->ml_priv; + int i, rc; +- char key[16]; ++ u8 key[16]; + u16 index = 0; + int j = 0; + +@@ -5315,12 +5315,22 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file) + } + + for (i = 0; i < 16*3 && data->wbuffer[i+j]; i++) { ++ int val; ++ ++ if (i % 3 == 2) ++ continue; ++ ++ val = hex_to_bin(data->wbuffer[i+j]); ++ if (val < 0) { ++ airo_print_err(ai->dev->name, "WebKey passed invalid key hex"); ++ return; ++ } + switch(i%3) { + case 0: +- key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4; ++ key[i/3] = (u8)val << 4; + break; + case 1: +- key[i/3] |= hex_to_bin(data->wbuffer[i+j]); ++ key[i/3] |= (u8)val; + break; + } + } +-- +2.35.1 + diff --git a/queue-5.10/wifi-mac80211-fix-ack-frame-idr-leak-when-mesh-has-n.patch b/queue-5.10/wifi-mac80211-fix-ack-frame-idr-leak-when-mesh-has-n.patch new file mode 100644 index 00000000000..1255768fcd7 --- /dev/null +++ b/queue-5.10/wifi-mac80211-fix-ack-frame-idr-leak-when-mesh-has-n.patch @@ -0,0 +1,42 @@ +From 77d79495f6f5387698282546b5afaecc254424ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 16:01:33 +0200 +Subject: wifi: mac80211: Fix ack frame idr leak when mesh has no route + +From: Nicolas Cavallari + +[ Upstream commit 39e7b5de9853bd92ddbfa4b14165babacd7da0ba ] + +When trying to transmit an data frame with tx_status to a destination +that have no route in the mesh, then it is dropped without recrediting +the ack_status_frames idr. + +Once it is exhausted, wpa_supplicant starts failing to do SAE with +NL80211_CMD_FRAME and logs "nl80211: Frame command failed". + +Use ieee80211_free_txskb() instead of kfree_skb() to fix it. + +Signed-off-by: Nicolas Cavallari +Link: https://lore.kernel.org/r/20221027140133.1504-1-nicolas.cavallari@green-communications.fr +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh_pathtbl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index 870c8eafef92..c2b051e0610a 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -718,7 +718,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath) + void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, + struct sk_buff *skb) + { +- kfree_skb(skb); ++ ieee80211_free_txskb(&sdata->local->hw, skb); + sdata->u.mesh.mshstats.dropped_frames_no_route++; + } + +-- +2.35.1 + diff --git a/queue-5.10/wifi-mac80211-fix-memory-free-error-when-registering.patch b/queue-5.10/wifi-mac80211-fix-memory-free-error-when-registering.patch new file mode 100644 index 00000000000..ce45cc47fbc --- /dev/null +++ b/queue-5.10/wifi-mac80211-fix-memory-free-error-when-registering.patch @@ -0,0 +1,53 @@ +From 3c25ae919ffe9422d9a3a8d7980365650713340c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Oct 2022 17:38:31 +0800 +Subject: wifi: mac80211: fix memory free error when registering wiphy fail + +From: taozhang + +[ Upstream commit 50b2e8711462409cd368c41067405aa446dfa2af ] + +ieee80211_register_hw free the allocated cipher suites when +registering wiphy fail, and ieee80211_free_hw will re-free it. + +set wiphy_ciphers_allocated to false after freeing allocated +cipher suites. + +Signed-off-by: taozhang +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 73893025922f..ae90ac3be59a 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1349,8 +1349,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + ieee80211_led_exit(local); + destroy_workqueue(local->workqueue); + fail_workqueue: +- if (local->wiphy_ciphers_allocated) ++ if (local->wiphy_ciphers_allocated) { + kfree(local->hw.wiphy->cipher_suites); ++ local->wiphy_ciphers_allocated = false; ++ } + kfree(local->int_scan_req); + return result; + } +@@ -1420,8 +1422,10 @@ void ieee80211_free_hw(struct ieee80211_hw *hw) + mutex_destroy(&local->iflist_mtx); + mutex_destroy(&local->mtx); + +- if (local->wiphy_ciphers_allocated) ++ if (local->wiphy_ciphers_allocated) { + kfree(local->hw.wiphy->cipher_suites); ++ local->wiphy_ciphers_allocated = false; ++ } + + idr_for_each(&local->ack_status_frames, + ieee80211_free_ack_frame, NULL); +-- +2.35.1 + diff --git a/queue-5.10/wifi-mac80211_hwsim-fix-debugfs-attribute-ps-with-rc.patch b/queue-5.10/wifi-mac80211_hwsim-fix-debugfs-attribute-ps-with-rc.patch new file mode 100644 index 00000000000..447e0969d06 --- /dev/null +++ b/queue-5.10/wifi-mac80211_hwsim-fix-debugfs-attribute-ps-with-rc.patch @@ -0,0 +1,57 @@ +From 4982b714b81edcf8602d155f37fcc5233eb9f60b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 16:54:39 +0200 +Subject: wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support + +From: Jonas Jelonek + +[ Upstream commit 69188df5f6e4cecc6b76b958979ba363cd5240e8 ] + +Fixes a warning that occurs when rc table support is enabled +(IEEE80211_HW_SUPPORTS_RC_TABLE) in mac80211_hwsim and the PS mode +is changed via the exported debugfs attribute. + +When the PS mode is changed, a packet is broadcasted via +hwsim_send_nullfunc by creating and transmitting a plain skb with only +header initialized. The ieee80211 rate array in the control buffer is +zero-initialized. When ratetbl support is enabled, ieee80211_get_tx_rates +is called for the skb with sta parameter set to NULL and thus no +ratetbl can be used. The final rate array then looks like +[-1,0; 0,0; 0,0; 0,0] which causes the warning in ieee80211_get_tx_rate. + +The issue is fixed by setting the count of the first rate with idx '0' +to 1 and hence ieee80211_get_tx_rates won't overwrite it with idx '-1'. + +Signed-off-by: Jonas Jelonek +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mac80211_hwsim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index a6d4ff4760ad..255286b2324e 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -775,6 +775,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac, + struct hwsim_vif_priv *vp = (void *)vif->drv_priv; + struct sk_buff *skb; + struct ieee80211_hdr *hdr; ++ struct ieee80211_tx_info *cb; + + if (!vp->assoc) + return; +@@ -796,6 +797,10 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac, + memcpy(hdr->addr2, mac, ETH_ALEN); + memcpy(hdr->addr3, vp->bssid, ETH_ALEN); + ++ cb = IEEE80211_SKB_CB(skb); ++ cb->control.rates[0].count = 1; ++ cb->control.rates[1].idx = -1; ++ + rcu_read_lock(); + mac80211_hwsim_tx_frame(data->hw, skb, + rcu_dereference(vif->chanctx_conf)->def.chan); +-- +2.35.1 + -- 2.47.3